Privacy Policy

This Policy describes how we handle two kinds of information differently:

• Your account information — information about you and your business as our customer. For this information, we act as a controller.
• Customer Data — personal information about your own leads, contacts, recipients, and customers that you process using the Service (e.g., CRM records, email and message content, chatbot transcripts, prospect lists). As between you and us, you are the controller of Customer Data and we act as a processor / service provider that processes it on your instructions to provide the Service. You are responsible for the lawfulness of that data, including providing required notices and obtaining any required consents.

We collect the following categories of information:

• Account & business information: name, email address, business name, team members, and settings you provide when you create and configure an account.
• Business data you create: leads, contacts, messages, bookings, quotes, invoices, knowledge-base content, campaigns, and similar records you add to or generate within the Service.
• Communications content: the content of emails, SMS and voice/voicemail (including transcriptions), and LinkedIn and social messages (e.g., WhatsApp, Instagram, Telegram) that you send or receive through connected channels, and chatbot conversation transcripts.
• Connected-account data: when you connect a third-party account (such as Google, Microsoft, or a social/messaging account) via OAuth or an account bridge, we access data from that account as described in Sections 3–4.
• Prospecting data: business contact information (such as name, job title, company, email, and phone number) about third-party leads that you search for and unlock using credits through the Find Leads feature, sourced from our lead-data provider.
• Payment & payout information: billing details processed by our payment provider (Stripe); we do not store full card numbers on our servers. If you participate in our affiliate program, we collect the payout details you provide.
• Usage & technical data: log data, device and browser information, IP address, and similar diagnostics used to operate and secure the Service.

How we collect it. Most of the information above is collected directly from you — when you register for an account, connect a channel, fill out a form on our marketing site, or enter data into the Service. We also collect some information automatically, such as server logs, device/browser details, and page-interaction data generated whenever you or your visitors use our website, chatbot, or app.

Please do not submit Social Security numbers, government IDs, health information, payment card numbers, or other special categories of sensitive personal information through our marketing website, contact forms, or support channels unless a feature of the Service specifically requests it (for example, payment details entered directly into Stripe's hosted checkout).

If you choose to connect a Google (Gmail) or Microsoft account, we request only the permissions needed to provide the features you enable. Specifically:

• Read and organize your mailbox (Google scope gmail.modify; Microsoft Mail.ReadWrite): to display your messages in the unified inbox, sync read/label state, and let you triage, label, and archive messages from within the Service.
• Send email on your behalf (Google scope gmail.send; Microsoft Mail.Send): to send replies and messages that you (or Agent Ivan with your approval) compose in the Service.
• Calendar access (where enabled): to sync events and manage bookings.
• Basic profile / email address (openid, email): to identify the connected mailbox.

We use this data solely to provide and improve the user-facing features you have enabled (for example, the shared inbox and AI-assisted drafting/triage performed by Agent Ivan). We access the minimum data necessary and only while your account remains connected.

Agent Ivan's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, regarding data obtained through Google (or Microsoft) APIs, we do not:

• use the data for serving advertisements;
• sell the data;
• use the data to train, develop, or improve generalized or non-personalized artificial intelligence or machine-learning models. Any AI processing is performed only to provide features to you, the user, and is not used to train models;
• allow humans to read the data, unless: (a) we obtain your explicit consent to read specific messages; (b) it is necessary for security purposes (such as investigating abuse); (c) to comply with applicable law; or (d) the data is aggregated and anonymized and used for internal operations.

Where we use third-party AI providers to power Agent Ivan's features, those providers act as service providers processing data on our behalf under contractual terms that prohibit using your content to train their models.

• To provide, operate, maintain, and secure the Service;
• To deliver the features you enable, including the unified inbox, sending, CRM, bookings, billing, chatbot, prospecting, outbound, social messaging, and Agent Ivan;
• To process payments, manage subscriptions, and administer the affiliate program;
• To communicate with you about your account, security, and support;
• To monitor, prevent, and address abuse, fraud, and security incidents;
• To comply with legal obligations and enforce our terms.

We do not use Customer Data, or data obtained through Google/Microsoft APIs, to train generalized AI models. We do not sell personal information.

We use cookies, local storage, and similar technologies that are necessary to operate the Service — for example, to keep you signed in, maintain your session, remember preferences, and support security. The affiliate program uses your browser's local storage to remember a referral code so a referral can be attributed at signup. We may also use limited analytics to understand and improve usage. You can control cookies through your browser settings, though disabling necessary cookies may impair the Service.

Some browsers offer a “Do Not Track” (DNT) signal. Because there is no accepted industry standard for how to respond to DNT, we do not currently alter our data-collection practices when we detect a DNT signal.

If you receive marketing emails from us, you can unsubscribe at any time using the link at the bottom of the email, or by emailing us at hello@agentivan.ai. Unsubscribing from marketing emails does not affect transactional or account-related emails (such as billing receipts or security notices), which we send as part of operating the Service.

We do not sell your personal information. We share information only with service providers (subprocessors) that help us operate the Service, and only as needed to provide it. These include, for example:

• Supabase — database and authentication hosting;
• Vercel — application hosting and infrastructure;
• OpenAI / Anthropic — AI processing for Agent Ivan (under terms that prohibit training on your data);
• Stripe — payment processing (your subscription and, if you enable it, payments from your customers);
• Twilio — phone, SMS, and voicemail features (if enabled);
• Resend — transactional and account email delivery;
• A social/messaging channel-bridging provider — LinkedIn and social/messaging integrations (if enabled);
• A lead-data provider — lead/prospect search and contact retrieval (if you use Find Leads);
• An email-verification provider — checking email deliverability (if enabled);
• A domain registrar partner — sending-domain registration and DNS for outbound (if used);
• Upstash — rate-limiting and caching infrastructure;
• Other cloud infrastructure and email-delivery providers used to host and operate the Service.

Find Leads (credit-based lead unlocking). The Find Leads feature lets you spend credits to unlock verified business contact details — such as name, title, company, email, and phone number — for third-party leads sourced from our lead-data provider. This is a paid feature of the Service: you are paying us for access to business contact records, and we are not selling your personal information (or your customers') to our lead-data provider or anyone else in exchange for money or anything of value.

Each subprocessor operates under its own privacy policy. A current list of subprocessors is available on request. We may also disclose information to comply with the law, respond to lawful requests, enforce our agreements, or protect the rights, safety, and security of our users and the Service. If we undergo a business transfer (such as a merger or acquisition), information may be transferred subject to this Policy.

We and our subprocessors may store and process information in countries other than your own, including the United States. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for cross-border transfers of personal information. By using the Service, you understand that your information may be transferred to and processed in those countries.

Our website and Service may contain links to third-party sites (for example, integration partners or resources we reference). Those sites operate under their own privacy policies, and we are not responsible for their content or data practices. Following a link away from agentivan.ai does not mean we endorse the destination site, and we encourage you to review its privacy policy before providing any personal information.

We protect data with industry-standard safeguards, including encryption in transit (TLS), encryption of sensitive credentials at rest, access controls, and tenant isolation (including row-level security) so that each business's data is kept separate. OAuth tokens are stored securely and used only to provide the features you enabled. Social/messaging account credentials are managed by our channel-bridging provider and are not stored by us. No method of transmission or storage is 100% secure, but we work to protect your information and limit access to authorized personnel and processes.

If we become aware of a security incident that compromises the confidentiality, integrity, or availability of your personal information, we will notify affected customers without undue delay and in accordance with applicable law, and will provide information on the nature of the incident and steps taken in response.

We retain information for as long as your account is active or as needed to provide the Service and comply with our legal obligations. Following cancellation or termination, we may retain account data for a limited period (for example, 30 days) in a deactivated state to allow export or reactivation, after which it may be permanently deleted. You can:

• Disconnect a connected account at any time from the integrations or email settings in the app. Disconnecting revokes our access and removes the stored OAuth tokens; you may also revoke access directly at Google Account permissions or your Microsoft or social account's app permissions.
• Request deletion of your account and associated data, or of specific synced content (such as email bodies), by contacting us at hello@agentivan.ai. We will delete or de-identify your data except where retention is required by law.

We do not sell your personal information (or your customers'), and we do not “share” personal information for cross-context behavioral advertising. (Our Find Leads feature lets you spend credits to unlock third-party business contact records sourced from our lead-data provider — see Section 7 — which is a paid feature we provide to you, not a sale of your data.) Depending on where you live, you may still have some or all of the following rights with respect to the personal information we hold about you:

• Right to know / access — request the categories and, where required, specific pieces of personal information we have collected about you, and the sources, purposes, and categories of recipients of that information.
• Right to correct — request that we correct inaccurate personal information we hold about you.
• Right to delete — request deletion of personal information we have collected from or about you, subject to certain legal exceptions.
• Right to opt out of sale or sharing — as noted above, we don't engage in either practice, so there is nothing to opt out of today; if that ever changes, we will update this Policy and provide an opt-out mechanism first.
• Right to limit use of sensitive personal information — we do not use sensitive personal information for purposes beyond what is necessary to provide the Service.
• Right to non-discrimination — we will not discriminate against you (e.g., by denying the Service or charging different prices) for exercising any of these rights.
• Right to appeal — if we decline a request, you may ask us to reconsider by replying to our decision or emailing hello@agentivan.ai with “Appeal” in the subject line.
• Right to object, restrict, or withdraw consent — where applicable under laws like the GDPR, you may object to or ask us to restrict certain processing, or withdraw previously given consent.

How to exercise these rights. Email hello@agentivan.ai with your request. To protect your account and prevent fraudulent requests, we may ask you to verify your identity (for example, by confirming information tied to your account) before we act on the request. If you use an authorized agent to submit a request on your behalf, we may ask for proof that the agent is authorized to act for you and, in some cases, may still ask you to separately verify your own identity.

California “Shine the Light.” Because we do not disclose personal information to third parties for their own direct marketing purposes, there is nothing to report under California Civil Code § 1798.83; contact us at hello@agentivan.ai with any questions.

For Customer Data, you are the controller; if you receive a data-subject request relating to your contacts or customers, you can manage that data within the Service or contact us for assistance. If you require a Data Processing Agreement, contact us at hello@agentivan.ai.

The Service is intended for businesses and is not directed to children under 13 (or the age required by your jurisdiction). We do not knowingly collect personal information from children.

We may update this Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

If you have questions or concerns about this Privacy Policy or our data practices, contact us first at hello@agentivan.ai — we will investigate and try to resolve the issue directly. If you are located in the EEA, UK, or Switzerland and are not satisfied with our response, you also have the right to lodge a complaint with your local data protection supervisory authority.