TillyReply

Privacy Policy

Last updated: 6 August 2026

TillyReply helps businesses respond to comments and messages on their social media accounts. This policy explains what information we handle, why, and the choices you have. We keep it plain and honest.

Who we are

TillyReply is a social-media reply and moderation service operated by TillyCall Ltd, a company registered in England & Wales under company number 17402622, with its registered office at 66 Paul Street, London, EC2A 4NA. You can contact us any time at info@tillycall.com.

Information we collect

Account details — your email address and a securely hashed password.
Connected social accounts — when you connect Facebook or Instagram, we store the access token and account identifiers (Page ID, Instagram Business ID) needed to act on your behalf. We never see or store your Facebook/Instagram password.
Business information you provide — details you enter to help the assistant reply well (services, hours, location, FAQs, links).
Content we process — public comments on your connected accounts, and the replies, direct messages, or moderation actions you configure TillyReply to carry out.
Billing information — if you subscribe, payments are handled by Stripe. We do not store your card details.

How we use your information

To read comments on your connected accounts and post the replies, send the direct messages, or hide the spam that you've set up.
To generate suggested replies using AI (see "Who we share data with").
To run your account, provide support, and process your subscription.
To send you occasional service emails, such as a monthly summary of activity.

We do not sell your personal information or your customers' information, and we do not use it for advertising.

Data from Meta (Facebook & Instagram)

When you connect a Facebook Page or Instagram account, we access it through Meta's official Graph API, using only the permissions you grant. We use this access solely to provide the features you've turned on — reading comments and posting replies, messages, or hiding comments. We store the access token securely and use it only for your account. You can disconnect at any time (see below), which stops all access.

Who we share data with

We use a small number of trusted providers purely to run the service:

Meta Platforms — to read and respond to comments and messages on your connected accounts.
Anthropic (Claude) — to generate suggested replies from the comment text and your business information. This is used to produce the reply, not to train models on your data.
Stripe — to process subscription payments.
Resend — to send service emails.
Railway — secure cloud hosting for the service.

How long we keep it

We keep your account and connected-account information for as long as your account is active. Access tokens are removed as soon as you disconnect an account or close your account.

Deleting your data

You are in control of your data at all times:

Disconnect an account — in your dashboard, disconnecting a profile immediately removes its stored access token, so TillyReply can no longer access it.
Delete everything — email us at info@tillycall.com from your account email and ask us to delete your account. We will permanently delete your account, connected-account tokens, and stored content within 30 days and confirm once done.

You can also remove TillyReply's access at any time from your Facebook or Instagram settings (Settings → Business integrations / Apps and websites).

Your rights

Depending on where you live (including under UK and EU GDPR), you have the right to access, correct, or delete your personal data, and to object to or restrict certain processing. To exercise any of these, email info@tillycall.com and we'll help.

Security

Data is transmitted over encrypted (HTTPS) connections, access tokens are stored server-side and never shown back to you or the browser, and passwords are stored only as a secure hash. No system is perfectly secure, but we take reasonable steps to protect your information.

Cookies

We use a single essential cookie to keep you logged in. We do not use advertising or tracking cookies.

Children

TillyReply is a business tool and is not intended for anyone under 18.

Changes to this policy

If we make material changes, we'll update the date at the top of this page and, where appropriate, let you know by email.

Contact us
Questions about your privacy or this policy? Email info@tillycall.com and a real person will help.