Privacy

Who this covers

Two different groups, and they are treated differently.

• Operators — the agency staff who sign in. We store the email address they sign in with, the name they choose to display, and an optional phone number they give us so calls can be forwarded to them.
• Contacts — the businesses an operator calls or texts. These are companies, not consumers, and the details held are business details: company name, publicly listed phone number, website, address, and where available a public business email.

Where contact information comes from

From public business listings on Google Maps, retrieved through a third-party scraping service, and from the businesses’ own public websites. Nothing is bought from a data broker, and nothing is collected from private profiles.

Calls

Calls are placed and received through Twilio. Call metadata — the number, the time, the duration and the outcome the operator recorded — is always stored.

Recording is not universal. A call is recorded only where the contact’s region permits one-party consent. Where the region requires all parties to consent, or where the region is unknown, no recording is kept and any audio the carrier produced is deleted from their servers rather than merely hidden from us.

Where a recording exists it may be transcribed by Deepgram, and a short summary generated by Anthropic’s Claude. Recordings, transcripts and summaries are retained for 24 months and then deleted.

Text messages

A text is only ever sent to a contact who has a recorded basis for it — for example, they called the business first, or they asked to be contacted. Replying STOP to any message ends them permanently and adds the number to a suppression list that is checked before every future send, on every channel.

Google account data

When an operator connects a Google account, Agency OS requests access to their calendar in order to find free times and to create meetings that they book.

Availability is read, not contents. Free/busy times are read through Google’s FreeBusy service, which returns only that a period is taken — not the title, the guests or the notes of a private event. Meetings that Agency OS itself creates are the exception: it wrote them, so it can read and update those.

Google data is used only to show availability and to create, move and cancel the meetings an operator books. It is never used for advertising, never sold, never used to train a model, and never shared with anyone outside the operator’s own organisation. Disconnecting the account in Settings → Calendar revokes the token and removes the stored credential.

Who else sees this data

Service providers who process it on our behalf, each for one purpose: Supabase (database and sign-in), Vercel (hosting), Twilio (calls and texts), Google (calendar), Apify (public business listings), Deepgram (transcription), Anthropic (summaries and drafting), Resend (email), Hunter (business email lookup).

Data is not sold. It is not shared with advertisers. One agency’s data is separated from another’s at the database level, and staff only see the organisation they belong to.

How long it is kept

Contact records are kept while the agency is a customer. Call recordings and transcripts are kept 24 months. Suppression records are kept indefinitely and on purpose: they are the record of somebody asking not to be contacted, and deleting one would allow the contact to be contacted again.

Getting your information removed

Any person or business may ask what is held about them, ask for it to be corrected, or ask for it to be deleted, by emailing the address below. A deletion request is honoured within 30 days. The one thing that survives is the suppression entry, which is what guarantees the contact is not approached again.

Contact

xavellis4@gmail.com