Privacy Policy

1. Who we are and our role

AgenText is provided by Carbonium Labs, LLC ("Carbonium Labs," "we," "us," or "our"). This Privacy Policy explains how we handle personal information in connection with the agentext.app website, the AgenText web portal, the AgenText Cloud API, MCP server, and webhooks, and the AgenText Messenger Android app (together, the "Service"). Capitalized terms not defined here have the meaning given in our Terms of Service.

We play two roles:

• Controller / business. For information about our customers and website visitors — such as account details, linked-device details, and usage and log data — we decide how the information is used and are the controller (under the GDPR) or business (under the CCPA).
• Processor / service provider. For the content of SMS messages and the phone numbers of the people our customers communicate with ("Message Data"), we act on behalf of the customer who linked the phone. The customer is the controller or business for that information, and we process it under the data processing terms in Section 9 of our Terms. See Section 13 if you are someone who has texted an AgenText customer.

2. Information we collect

Information you provide

• Account information: your email address and, if you sign in with Google, your name and Google account identifier; your workspace name.
• Configuration information: names you give to API keys and phones, webhook URLs and descriptions, and similar settings.
• Communications: information you include when you contact us for support or otherwise.
• Payment information: if you buy a paid plan, billing details are collected and processed by our payment processor. We receive limited information such as your plan, billing contact, and the last digits of your card, not your full card number.

Information from your linked phone

Only after you turn on the API Bridge and link a phone, AgenText Messenger sends us:

• Device information: device model and manufacturer, Android version, app version, whether AgenText Messenger is the default SMS app, whether the bridge is enabled, and connection status and times.
• SIM information: for each SIM, its slot, carrier name, and phone number, so your Agents can choose which line to send from.
• Message Data: for messages your Agents send, and for SMS messages the phone receives while the bridge is enabled (except those filtered by the app's block rules): the other party's phone number, the message text, timestamps, delivery status, error information, and any metadata your Agents attach.

The bridge does not upload your contact list, photos, location, call history, or messages exchanged before the bridge was enabled. When the bridge is off, AgenText Messenger does not connect to our servers.

Information collected automatically

• Log and usage data: IP address, browser or client user agent, timestamps, pages and API endpoints accessed, request results, error and performance data, rate-limit events, and the last time each API key was used.
• Sign-in security data: the IP address and user agent associated with sign-in link requests and portal sessions.
• Cookies: strictly necessary cookies in the portal, described in Section 7.

Information from third parties

• Google: if you choose Google sign-in, Google provides your name, email address, whether the email is verified, and an account identifier.
• Service providers: our hosting, email, and payment providers may give us information about delivery, security events, or transactions.

3. How we use information

We use the information we collect to:

• Provide the Service: create and manage accounts, link phones, route messages between your Agents and your phones, deliver webhooks, and show you status and history.
• Authenticate and secure: verify sign-ins, API keys, and device credentials; detect, investigate, and prevent fraud, spam, abuse, security incidents, and violations of our Terms; and enforce rate limits.
• Support you: respond to questions, troubleshoot problems, and, when you ask us to, look into specific messages or devices.
• Communicate with you: send service, security, and account notices, and, where permitted, news about our products. You can opt out of marketing emails at any time.
• Improve and develop our products: analyze Usage Data and De-identified Data to understand how the Service is used, measure reliability and performance, fix problems, plan capacity, and build new features and products.
• Billing and business operations: process payments, maintain records, and manage our business.
• Comply with law and protect rights: meet legal obligations, respond to lawful requests, establish or defend legal claims, and protect the rights, property, and safety of our users, the public, and us.

De-identified and aggregated data. We may create de-identified or aggregated information that cannot reasonably be used to identify you, any individual, or any device, and use and share it for any lawful purpose, such as product research and publishing statistics. We maintain such information in de-identified form and do not attempt to re-identify it, except as permitted by law.

4. What we don't do

• We do not sell personal information or share it for cross-context behavioral advertising.
• We do not use Message Data for advertising or to build advertising profiles.
• We do not use message content to train generalized AI or machine learning models.
• Our personnel do not read message content except when you ask us to (for example, for support), when needed to investigate security incidents, abuse, or violations of our Terms, or when required by law.

5. Legal bases (EEA and UK)

If the GDPR applies, we rely on the following legal bases for information we control:

• Contract: to provide the Service you signed up for and to manage your account.
• Legitimate interests: to secure the Service and prevent abuse, to understand usage and improve and develop our products, to create De-identified Data, to communicate with business customers about our products, and to establish or defend legal claims. We balance these interests against your rights, and you may object as described in Section 11.
• Consent: where required, such as for certain marketing communications. You may withdraw consent at any time without affecting prior processing.
• Legal obligation: to comply with laws, such as tax, accounting, and lawful requests from authorities.

For Message Data, the legal basis is determined by the customer who controls it.

6. How we disclose information

We disclose personal information only as follows:

• At your direction: to the Agents, applications, and webhook endpoints you authorize with your API keys or configure in the Service, and over the mobile network when your phone sends an SMS.
• Service providers and subprocessors: to vendors who process information on our behalf under contracts that restrict their use of it, including those listed below.
• Legal and safety: when we believe in good faith that disclosure is required by law or legal process, or necessary to protect the rights, property, or safety of anyone, or to investigate fraud, abuse, or security issues.
• Business transfers: in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business, subject to this policy or one at least as protective.
• With your consent: for any other purpose you agree to.

Current subprocessors

We will update this list before authorizing a new subprocessor that processes Message Data.

7. Cookies and similar technologies

The agentext.app website does not use advertising or analytics cookies. Our website loads fonts from Google Fonts, which means your browser sends your IP address and browser information to Google when you visit.

The AgenText portal uses strictly necessary cookies to keep you signed in, to protect forms against cross-site request forgery, and to complete Google sign-in securely. These cookies are required for the portal to work and cannot be turned off. Portal sessions expire after 30 days, or after 7 days without activity.

If we introduce analytics or other non-essential cookies in the future, we will update this policy and, where required by law, ask for your consent first. We honor Global Privacy Control (GPC) signals as a request to opt out of the sale or sharing of personal information; because we do not sell or share personal information, no further action is needed. We do not otherwise respond to "Do Not Track" signals.

8. Data retention

We keep personal information only as long as reasonably necessary for the purposes in this policy:

• Message Data and webhook delivery records: deleted automatically, by default about 30 days after a message or delivery reaches a final status (for example, delivered, failed, or expired). We may adjust this period and will update this policy if we do.
• Account and configuration information: kept while your account is active and for a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce our agreements.
• Sign-in links and link codes: sign-in links expire after 15 minutes and phone link codes after 10 minutes; we keep related records for a limited time for security.
• Logs: kept for a limited period for security, troubleshooting, and operations, according to our and our providers' log retention schedules.
• De-identified Data: may be kept indefinitely.

When you revoke a phone or API key, the credential stops working immediately. Copies of messages that are already on your phone are controlled by you and your phone, not by us.

9. Security

We use administrative, technical, and physical measures designed to protect personal information, including encryption in transit (TLS) between your phone, our servers, and your applications; storing API keys, device credentials, and sign-in tokens only as cryptographic hashes; phone-initiated connections so that no inbound ports are opened on your device; signed webhooks; rate limiting; and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials safe and for the security of your phones and the endpoints you connect.

10. International transfers

We are based in the United States, and we and our service providers process information in the United States. If you are located outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country. Where required, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism. Contact us for more information about these safeguards.

11. Your privacy rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you and receive a copy, including in a portable format;
• Correct inaccurate personal information;
• Delete personal information;
• Object to or restrict certain processing, including processing based on legitimate interests and direct marketing;
• Withdraw consent where we rely on consent;
• Opt out of the sale or sharing of personal information or targeted advertising (we do not do either); and
• Not be discriminated against for exercising your rights.

How to exercise your rights. Email privacy@agentext.app with the subject "Privacy Request" and the email address on your account. You can also manage many settings yourself in the portal, such as revoking API keys and removing phones. We will verify your request by confirming control of the email address associated with your account, and may ask for more information if needed. We will respond within the time required by law — generally within one month under the GDPR and 45 days under the CCPA, which may be extended where permitted.

Authorized agents. You may use an authorized agent to make a request on your behalf. We may require written permission signed by you and may ask you to verify your identity directly.

Appeals. If we decline your request, you may appeal by replying to our decision with the subject "Privacy Appeal." We will respond within the time required by applicable law. If your appeal is denied, you may contact your state attorney general.

Complaints. If you are in the EEA or the UK, you have the right to lodge a complaint with your local data protection authority. We would appreciate the chance to address your concerns first.

If your request concerns Message Data that a customer controls, we will refer you to that customer or assist them in responding, as described in Section 13.

12. Notice to California residents

This section supplements this policy for California residents and describes our practices during the past 12 months under the California Consumer Privacy Act, as amended (CCPA).

• Sources: you, your linked phones, your Agents and applications, Google (if you use Google sign-in), and our service providers.
• Purposes: the business and commercial purposes described in Section 3.
• Sale and sharing: we have not sold or shared (for cross-context behavioral advertising) personal information in the past 12 months, and we have no actual knowledge of selling or sharing personal information of consumers under 16.
• Sensitive personal information: we use and disclose sensitive personal information only for purposes permitted under Cal. Code Regs. tit. 11, § 7027(m), such as providing the Service and ensuring security, and not to infer characteristics about you. As a result, we do not offer a right to limit its use.
• Retention: as described in Section 8.
• Shine the Light: we do not disclose personal information to third parties for their own direct marketing purposes.

California residents may exercise the rights described in Section 11.

13. If you text an AgenText customer

If you exchange text messages with a business or person that uses AgenText, your phone number and messages may be processed by AgenText on that customer's behalf. That customer is responsible for how your information is used, including obtaining any required consent and honoring your opt-out requests. To make a privacy request or stop receiving messages, contact that customer directly — for most messages, replying "STOP" is the fastest way. If you contact us instead, we will forward your request to the relevant customer where we can identify them, and assist them in responding.

14. Children

The Service is intended for business use by adults and is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

15. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page and update the "Last updated" date. If we make material changes, we will provide notice, such as by email or in the portal, before they take effect.

16. Contact us

Carbonium Labs, LLC
Email: privacy@agentext.app