Privacy Policy
Last updated: September 25, 2026
Who we are. LzyReply is operated by 3AM SaaS OÜ, a company registered in Estonia (registry code 16445075, Ahtri tn 12, 15551 Tallinn, Estonia). "We", "us" and "LzyReply" mean 3AM SaaS OÜ. Contact: privacy@lzyreply.com.
Our two roles. For your own account details, we are the controller. For the emails your customers send you and the Shopify order data we read to answer them, we act as your processor: we handle that data only to provide LzyReply to you, following your instructions and the data processing terms in our Terms of Service.
What we collect
- Account data: your email address, login codes (stored hashed), plan and billing status. Card details are handled by Stripe or Shopify; we never see or store them.
- Support conversations: emails forwarded to your LzyReply inbox, including your customers' names, email addresses, message text and attachments, plus the replies you send.
- Shopify store data: when you connect a store, we read orders for the customer you are replying to (order number, items, status, tracking and shipping address). We read this live when drafting and do not keep a copy, except where it appears in a conversation or reply.
- Knowledge base content: FAQs, documents, links and past conversations you add to train your replies.
- Usage and technical data: sign-in times, actions in the app (an audit log), IP address and browser details, and email delivery events (delivered, opened, bounced).
How we use it
- To run LzyReply: receive emails, draft replies with AI, send the replies you approve, and update a shipping address when you ask.
- To bill you, send account emails (login codes, trial reminders) and give support.
- To keep the service secure and fix problems.
- To measure our own marketing (see Cookies).
We do not sell personal data, and we do not use your customers' data for our own marketing or to train AI models.
Who we share it with
We use these sub-processors, each only for the purpose shown:
| Sub-processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Servers and database hosting | EU (Germany) |
| Cloudflare, Inc. | Encrypted off-site backups (R2, EU jurisdiction) | EU |
| OpenAI, L.L.C. | Drafting replies and classifying emails (API; not used for training) | USA |
| SparkPost (Bird) | Receiving and sending email, delivery tracking | USA |
| Stripe, Inc. | Payments for web sign-ups | USA / EU |
| Shopify Inc. | Store data you connect; billing for App Store installs | Canada / USA |
| Telegram | Notifications, only if you turn them on | EU / worldwide |
| Meta Platforms | Measuring our ads (Pixel and Conversions API) | USA |
Transfers outside the EU rely on the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.
Cookies
The app uses one secure, HttpOnly cookie to keep you signed in, and our website and app share one cookie (lzy_consent) that remembers your cookie choice. Our website and app use the Meta Pixel to measure ad performance; in the EU and UK it only loads after you consent. You can change your choice at any time with Cookie settings in the footer. Simple Analytics measures website visits without cookies.
Data retention
- Conversations and their attachments are deleted automatically 24 months after their last activity.
- Your account data is kept while your account is open and deleted within 30 days after you ask us to close it.
- If you uninstall the Shopify app, we delete the store's access tokens right away and the store's data within 48 hours of Shopify's request.
- When a customer asks a Shopify merchant to erase their data, we delete that customer's conversations.
- Encrypted backups are kept for 30 days, then deleted.
Your rights
If you are in the EU, EEA or UK you can access, correct, export or delete your personal data, and object to or restrict its processing. California residents have similar rights under the CCPA. Email privacy@lzyreply.com; we reply within 30 days. You can also complain to your data protection authority; ours is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).
Your customers: if one of your customers contacts us about their data, we will pass the request to you and help you answer it.
Security
Data is encrypted in transit (TLS) and at rest (encrypted database, with store credentials encrypted per account). Backups are encrypted. Access is limited to the founder, protected by 2FA and SSH keys, and actions are logged. See our Security Incident Response Policy.
Children
LzyReply is a business tool and is not intended for anyone under 16.
Changes
We will post any changes here and email account owners about significant ones before they take effect.
Contact
privacy@lzyreply.com · 3AM SaaS OÜ, Ahtri tn 12, 15551 Tallinn, Estonia