Privacy Policy

This Privacy Policy (this “Policy”) explains how AgencyTitan Inc. (“AgencyTitan”, “Company”, “we”, “us”, or “our”) collects, uses, discloses, and protects Personal Information when you use the AgencyTitan platform, including any associated software-as-a-service applications, APIs, or websites (the “Service”). This Policy applies to all users, visitors, and others who access the Service (collectively, “Users”). Contractual acceptance of our terms is governed by the Terms of Service, not this Policy; where processing requires your consent, we ask for it explicitly (for example, through the cookie consent controls on our marketing website).

2. Information Collection and Data Categories

The Company collects “Personal Information” (information that identifies, relates to, or could reasonably be linked to an individual) through the following means:

Information Voluntarily Provided: This includes, without limitation, account credentials, organizational metadata, contact details (name, email, telephonic data), and any content, prompts, or inputs provided through the Service’s AI-enabled features.
Information Collected Automatically: Pursuant to standard industry practice, we automatically collect certain technical data via “Cookies,” web beacons, pixels, and log files, including Internet Protocol (IP) addresses, browser telemetry, device identifiers, and granular usage patterns within the Service. When you opt in to optional analytics or advertising technologies on our marketing website, third-party providers (such as Google Analytics and Meta) may also collect, receive, and process information about your interactions with that website.
Browser Extension Data: When you use the AgencyTitan browser extension, we may process your account email, selected workspace, extension settings, page URL and title, login form context, AI chat prompts, files you attach to AI conversations, and selected text or page content that you choose to send to the AI chat feature.
Third-Party Data: We may receive information about you from third-party integrations or from your “Organization” (the legal entity that entered into the Master Service Agreement with AgencyTitan).

3. Purposes of Processing

The Company processes Personal Information for the following business purposes:

To fulfill contractual obligations to Users and Organizations;
To maintain, optimize, and secure the Service infrastructure;
To facilitate AI-generated outputs and algorithmic automations;
To perform billing, identity verification, and fraud prevention; and
To comply with applicable statutory, regulatory, or legal obligations.

4. Artificial Intelligence and Machine Learning

The Service utilizes sophisticated large language models (LLMs) and artificial intelligence processing via third-party providers (including, but not limited to, OpenAI, Anthropic, Google AI, and xAI).

Data Processing: Any data or “Prompts” submitted to the Service’s AI features are transmitted to these providers for real-time inference.
Training Disclosures: AgencyTitan utilizes enterprise-tier API agreements. To the extent permitted by our agreements with such providers, User data submitted via the API is not utilized by third-party providers to train their foundational models.
History: The Company retains a record of AI interactions for contextual continuity and billing audit purposes.

5. Browser Extension Disclosures

The AgencyTitan browser extension is designed for authenticated AgencyTitan users and extends limited Service functionality into the browser.

Local Storage: The extension stores sign-in session data, selected workspace information, extension settings, and cached branding data locally in the browser so the extension can remain signed in and preserve user preferences.
Credential Assistance: When a user chooses to use credential assistance, the extension may compare the current page URL against credentials stored in AgencyTitan, display matching results, and fill login fields on the active page at the user’s direction.
Page Context for AI: When a user opens AI chat from the extension, the extension may collect the current page URL, page title, selected text, and relevant page text to provide context for the user’s request. This information is processed only to support the AI interaction requested by the user.
Files and Messages: If a user attaches files or sends messages through extension-based AI chat, those materials may be stored and processed as part of the user’s AgencyTitan AI conversation history.
No Sale of Extension Data: We do not sell personal information collected through the extension, and we do not use extension-collected data for purposes unrelated to the extension’s disclosed functionality.

6. SMS and Telephonic Communications

6.1 AgencyTitan SMS Program

If you opt in through the separate checkboxes on our Contact page (or another clearly disclosed opt-in method), AgencyTitan may send you automated text messages at the mobile number you provide. Informational messages may include replies to your inquiry and account or support updates. Marketing messages may include product information, promotions, and updates. Message frequency varies. Message and data rates may apply. Marketing consent is not a condition of purchase. Carriers are not liable for delayed or undelivered messages.

Opt in: Checking a consent box on our Contact page constitutes your prior express written consent only for the message type described in that box. Informational and marketing consent are collected separately.
Opt out: Reply STOP to unsubscribe at any time. You may also use our Contact form.
Help: Reply HELP or use our Contact form.
Mobile information: We do not sell, rent, or share mobile phone numbers or SMS opt-in data with third parties or affiliates for their marketing or promotional purposes. Mobile information is used only to deliver the messages you consented to and to administer the SMS program.

6.2 Tenant-Initiated SMS

AgencyTitan acts as a “Service Provider” or “Data Processor” regarding the transmission of Short Message Service (SMS) communications initiated by our Tenants.

Consent and Compliance: Tenants are solely responsible for obtaining and documenting “Prior Express Written Consent” pursuant to the Telephone Consumer Protection Act (TCPA) and applicable 10DLC (10-Digit Long Code) regulations.
Opt-Out Mechanisms: Recipients may revoke consent at any time by transmitting the “STOP” keyword.
Disclaimer: Carriers are not liable for delayed or undelivered messages. Standard message and data rates may apply.

7. Google Workspace APIs Data Usage

AgencyTitan’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

This Section applies specifically to information received from Google Workspace APIs and information derived from it (“Google User Data”) and controls over any conflicting general provision of this Policy.

Data Accessed and Use: When you connect Google Workspace, AgencyTitan may access your Google account name and email; Gmail messages, headers, attachments, labels, and mailbox actions; Drive files, metadata, and permissions; Calendar events; Docs, Sheets, and Forms content and responses; and Meet spaces, participants, recordings, transcripts, and smart notes. We use Google User Data only to provide or improve user-facing features that you request or configure, such as email and ticket management, file and attachment handling, calendars and meetings, documents and forms, and workflow automations.
AI Processing: Google User Data may be sent to an AI service provider only when you explicitly request or configure an AI-powered feature that uses that data, and only to perform the requested feature and return its result. AgencyTitan does not use Google Workspace APIs or Google User Data, and does not permit any third party to use Google User Data, to develop, improve, or train generalized or non-personalized artificial intelligence or machine-learning models, including foundation models.
Sharing and Prohibited Uses: We transfer Google User Data only to service providers as necessary to provide a user-requested feature, for security purposes, to comply with applicable law, or as part of a merger, acquisition, or asset sale after obtaining explicit prior user consent. We do not sell Google User Data; transfer it to advertising platforms, data brokers, or information resellers; use it for advertising, retargeting, marketing attribution, creditworthiness, or lending; or use it to create or enrich databases for purposes unrelated to AgencyTitan’s user-facing features. Marketing-site analytics and advertising disclosures elsewhere in this Policy do not apply to Google User Data.
Storage, Security, Retention, and Deletion: We store OAuth tokens in encrypted form and retain Google User Data only when needed to operate the features you request, such as tickets, attachments, workflows, and AI conversation history. We protect it using the safeguards in Section 9 and retain it under Section 16. Disconnecting Google Workspace stops new access through that connection but does not automatically delete content you intentionally imported into AgencyTitan. You may request deletion of stored Google User Data using the contact details in Section 18; subject to legal obligations, it will be deleted under the 90-day deletion protocol in Section 16.
Human Access: We do not allow humans to read Google User Data unless you give affirmative consent to access specific data, access is necessary for security purposes such as investigating a bug or abuse, access is required by applicable law, or the data has been aggregated and anonymized and is used for internal operations.

8. Disclosure of Information

AgencyTitan does not sell, rent, or lease Personal Information to third parties for monetary consideration. We disclose information to:

Sub-processors: Essential vendors who support our Service (e.g., Supabase, Fly.io, Mailgun, AI providers, and Payment Processors).
Optional analytics and advertising providers: If you accept optional tracking on our marketing website, we may disclose internet activity, device information, identifiers, and interaction data to third-party analytics and advertising providers (such as Google Analytics and Meta) to measure marketing attribution and platform usage. Under the California Consumer Privacy Act (CCPA), some of this disclosure may constitute “sharing” for cross-context behavioral advertising even when we do not receive money in exchange. You may opt out at any time via Your Privacy Choices / Cookie Settings on the marketing website, or by enabling a Global Privacy Control (GPC) signal.
Legal Necessity: When required by subpoena, court order, or to protect the safety and integrity of our platform.
Business Transfers: In the event of a merger, acquisition, or sale of assets.

9. Data Security and Retention

Security Measures: The Company employs administrative, technical, and physical safeguards designed to protect Personal Information, including AES-256 encryption at rest and TLS encryption for data in transit.
Retention: Retention periods and criteria are described in Section 16 (Data Retention).

10. Protection of Minors

The Service is a professional tool intended for use by persons at least 18 years of age. AgencyTitan does not knowingly collect or solicit “Personal Information” (as defined by the Children’s Online Privacy Protection Act, “COPPA”) from individuals under the age of 13. If we discover that such information has been collected without verifiable parental consent, we will execute immediate deletion procedures.

11. Legal Bases for Processing (EEA and UK)

Where the EU or UK General Data Protection Regulation (GDPR) applies, we process Personal Information only when we have a legal basis to do so:

Processing purpose	Legal basis
Providing the Service, account administration, and support	Performance of a contract (Art. 6(1)(b))
Billing, invoicing, and payment processing	Performance of a contract; legal obligation (Art. 6(1)(b), (c))
Securing and maintaining the Service, fraud prevention, and abuse detection	Legitimate interests (Art. 6(1)(f))
AI feature processing of content you submit	Performance of a contract (Art. 6(1)(b))
Optional analytics and advertising cookies on our marketing website	Consent (Art. 6(1)(a))
Marketing communications you sign up for	Consent (Art. 6(1)(a))
Compliance with law, legal process, and regulatory requests	Legal obligation (Art. 6(1)(c))

Where we rely on consent, you may withdraw it at any time with effect for the future. For website cookies, use Cookie Settings (available from the Your Privacy Choices link in the website footer). Withdrawing consent does not affect the lawfulness of processing performed before withdrawal.

12. International Data Transfers

AgencyTitan is headquartered in the United States and the Services are hosted and operated in the United States. If you access the Services from outside the United States, your Personal Information will be transferred to and processed in the United States and in other countries where our sub-processors operate. Where the GDPR or UK GDPR applies to a transfer, we rely on recognized transfer mechanisms, including Standard Contractual Clauses incorporated into our agreements with sub-processors, and we apply the security measures described in Section 9.

13. Your Rights (EEA and UK)

If you are located in the European Economic Area or the United Kingdom, you have the following rights regarding your Personal Information, subject to the conditions and exemptions in applicable law:

Access: Obtain confirmation of whether we process your Personal Information and receive a copy of it.
Rectification: Have inaccurate Personal Information corrected and incomplete Personal Information completed.
Erasure: Have your Personal Information deleted (“Right to be Forgotten”).
Restriction: Require us to restrict processing in certain circumstances, for example while a dispute about accuracy is resolved.
Objection: Object to processing based on legitimate interests, and object at any time to processing for direct marketing.
Portability: Receive Personal Information you provided to us in a structured, commonly used, machine-readable format and have it transmitted to another controller.
Withdraw Consent: Withdraw any consent you have given at any time.
Complain: Lodge a complaint with a supervisory authority, in particular in the EU member state or UK region of your habitual residence, place of work, or the place of an alleged infringement.

To exercise these rights, contact us using the details in Section 18. We will respond within the timeframes required by applicable law and may need to verify your identity before acting on a request.

14. California Notice at Collection and Privacy Rights

This section serves as our Notice at Collection and privacy-rights disclosure for California residents under the California Consumer Privacy Act, as amended (CCPA). It describes our collection, use, disclosure, sale, and sharing practices during the preceding 12 months as well as our current practices.

Categories Collected, Purposes, Disclosure, and Retention

For each category of Personal Information defined in Cal. Civ. Code 1798.140 that we collect:

Identifiers

Examples: Name, email, IP address, device identifiers
Sources: You; automatic collection
Purposes: Providing the Service; security; marketing measurement
Disclosed to: Sub-processors; if you opt in, analytics and advertising providers
Sold or shared: Shared for cross-context behavioral advertising only if you opt in to Marketing cookies
Retention: Account lifetime plus the 90-day deletion protocol; security logs kept only as long as needed for abuse prevention

Categories in Cal. Civ. Code 1798.80(e)

Examples: Contact details, billing information
Sources: You
Purposes: Providing the Service; billing
Disclosed to: Sub-processors; payment processors
Sold or shared: No
Retention: Account lifetime plus the 90-day deletion protocol; billing records as required by tax and accounting law

Commercial information

Examples: Subscription and transaction records
Sources: You; the Service
Purposes: Billing; support
Disclosed to: Sub-processors
Sold or shared: No
Retention: As required by tax and accounting law

Internet or other electronic network activity

Examples: Pages viewed, clicks, browser telemetry, usage patterns
Sources: Automatic collection
Purposes: Service operation; security; if you opt in, marketing analytics and advertising measurement
Disclosed to: Sub-processors; if you opt in, analytics and advertising providers
Sold or shared: Shared for cross-context behavioral advertising only if you opt in to Marketing cookies
Retention: Per the retention settings of the providers disclosed in Cookie Settings; consent and opt-out records at least 24 months

Geolocation data (coarse, derived from IP address)

Examples: Approximate region
Sources: Automatic collection
Purposes: Security; localization
Disclosed to: Sub-processors
Sold or shared: No
Retention: Only as long as needed for security and abuse prevention

Professional or employment-related information

Examples: Organization, role
Sources: You; your Organization
Purposes: Providing the Service
Disclosed to: Sub-processors
Sold or shared: No
Retention: Account lifetime plus the 90-day deletion protocol

We do not sell Personal Information for monetary consideration. We do not knowingly collect Personal Information of consumers under 16 years of age. Retention criteria are described further in Section 16.

Sensitive Personal Information

The only sensitive Personal Information we collect is your account log-in credentials. We use them solely to authenticate you and provide the Service, purposes permitted by the CCPA regulations, and we do not use or disclose sensitive Personal Information to infer characteristics about you. For that reason we are not required to offer a “Limit the Use of My Sensitive Personal Information” link.

Your California Rights

Right to Know and Access: Request the categories and specific pieces of Personal Information we have collected, the sources, the purposes, and the categories of third parties to whom it was disclosed.
Right to Delete: Request deletion of Personal Information we collected from you, subject to statutory exceptions.
Right to Correct: Request correction of inaccurate Personal Information.
Right to Opt Out of Sale or Sharing: Opt out of the sharing of your Personal Information for cross-context behavioral advertising at any time via the Your Privacy Choices link in the website footer (turn off the Marketing category), or by using a browser that sends a Global Privacy Control (GPC) signal, which we honor automatically as an opt-out request.
Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights. We do not offer financial incentives in exchange for consent to tracking.

If you opt out of sale or sharing, we will not ask you to opt back in for at least 12 months. You may still choose to opt back in yourself at any time through Cookie Settings.

Submitting Requests

Submit requests by emailing [email protected] or writing to the address in Section 18. We will verify your identity before fulfilling a request, typically by confirming control of the email address associated with your account or your interaction with the Services. You may designate an authorized agent to submit requests on your behalf; we will require proof of the agent’s authority and may still verify your identity directly. We respond within 45 days and will notify you if we need a 45-day extension.

15. Other U.S. State Privacy Rights

Several other U.S. states have comprehensive privacy laws (including, for example, Virginia, Colorado, Connecticut, Utah, Texas, and Oregon). Where applicable under the law of your state of residence, you may have the right to:

Confirm whether we process your personal data and access that data;
Correct inaccuracies in your personal data;
Delete personal data you provided or that we obtained about you;
Obtain a copy of your personal data in a portable and readily usable format;
Opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects;
Provide or withdraw consent regarding the processing of sensitive personal data;
Use a recognized universal opt-out mechanism, such as Global Privacy Control, where your state’s law requires us to honor one; and
Exercise these rights free from discrimination.

The rights available to you depend on your state of residence and applicable law. To exercise any of these rights, use the contact details in Section 18 or the Your Privacy Choices link in the website footer. If we deny your request and your state’s law provides an appeal right, you may appeal by replying to our decision or emailing [email protected] with the subject line “Privacy Request Appeal”; we will respond within the timeframe your state’s law requires and, if the appeal is denied, provide a method to contact your state attorney general or other regulator where required.

16. Data Retention

We retain Personal Information only as long as necessary for the purposes described in this Policy, determined by the following criteria: the duration of your account and contract, our legal and tax obligations, the need to resolve disputes and enforce agreements, and the need to demonstrate compliance with privacy laws.

Account and Service data: Retained for the duration of the active account lifecycle. Upon termination or approval of a verified deletion request, Personal Information is subject to a 90-day deletion protocol, subject to legal hold requirements.
Billing records: Retained as required by tax and accounting law.
Consent and opt-out records: Retained for at least 24 months from the date of the decision, as required by California regulations, and for as long as reasonably necessary to demonstrate compliance with consent requirements. These records are compliance evidence and are not used for marketing.
SMS opt-in records: Contact form submissions that include SMS consent (name, email, mobile number, message, each checkbox state, the consent language presented for each opted-in program, timestamp, and technical metadata such as IP address) are retained for at least four years, or longer if needed to demonstrate TCPA / A2P 10DLC compliance.
Website analytics and advertising data: Collected only with your consent and governed by the retention settings of the providers disclosed in Cookie Settings.
Beta access requests: Contact details and request messages are retained while we administer the private beta program and evaluate your request, and are then deleted in accordance with the criteria above. Associated security metadata is kept only as long as needed for abuse prevention.

17. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected in the “Last Updated” date above, and, where required by law, we will provide additional notice or obtain fresh consent. Cookie consent collected on our marketing website is versioned; if our disclosures or tracking providers materially change, prior consent is invalidated and you will be asked again before any optional tracking resumes.

18. Contact Information

All inquiries regarding this Policy or the Company’s data practices should be directed to:

AgencyTitan Inc.
Attn: Data Privacy Officer
16192 Coastal Highway
Lewes, DE 19958, United States

Email: [email protected]

1. Scope and Consent