Useful tools.
A small data footprint.
Updated 21 October 2026. Replylane’s public tools run in your browser. The optional connector processes webhooks on its operator’s instance.
Forms and visitor answers
Business names, numbers, questions, and styling are encoded in share links and embed configuration. These are public configuration, not secrets or proof of business identity. The configuration is carried in the URL fragment and is not sent to the hosting server in a page request.
Visitor answers stay in memory. After review and consent, the visitor may open WhatsApp with the answers in a prefilled draft. WhatsApp then receives that draft under its own terms; the visitor chooses whether to send it to the named business. We do not store visitor answers or add them to a lead database.
Local storage and downloads
The form builder saves only when you choose Save draft, under replylane.form.v1 in this browser’s local storage. It is not encrypted. Delete it in the builder’s Publish section or clear site data. Downloaded JSON files are controlled by you and may include your public business number.
Calculator, composer, and signature lab
Inputs remain in memory and are not sent to our API. A signature-lab app secret is used locally by Web Crypto, never saved to local storage or included in downloaded verification reports. Use Clear inputs to remove it from the tab. Browser extensions with page access may be able to read page content.
Optional connector
A configured instance accepts signed Meta webhooks and stores encrypted bodies in its private D1 database for delivery. Successful bodies are removed immediately. Other bodies expire after 48 hours; scheduled cleanup removes up to 100 expired receipts per minute. If the connector is disabled, cleanup stops until it is resumed or an operator removes the stored data.
The destination receives the original payload. Its retention and processing are the operator’s responsibility. Recent-delivery metadata is available only with the instance’s administrator token. The console keeps that token in memory and sends it only to the same origin’s API. The public deployment does not accept events until it is configured.
Hosting and network requests
Cloudflare serves the app and can process ordinary request information, including IP addresses and page paths, under its terms. Worker query-string redaction is enabled. Application error logs use generic event names and do not include webhook bodies or tokens. We do not install advertising pixels or third-party analytics. Fonts are hosted here.
The connector page checks the same-origin health endpoint. Operator actions call the same-origin API. Following external links, opening WhatsApp, or embedding the widget introduces those services’ normal network requests.
Deployment owners
Operators who deploy this project for customers must provide their own business identity, privacy contact, retention policy, and customer support channel. Replylane is an independent toolkit and is not affiliated with Meta or WhatsApp.