Privacy Policy

Effective date: October 20, 2026

Agency OS LLC (“Agency OS,” “we,” “us”) is a growth firm for owner-led businesses, based in Dallas, TX, and serving clients nationwide. This policy covers both our services and the Agency OS software. It describes what we collect, why, and the choices you have. The short version: we collect only what we need to respond to you, do the work and run the features you use, and we do not sell your information. If you use the Agency OS software, the section “Agency OS software (AOS)” below also applies.

What we collect

  • Contact details you send us: name, email, phone (optional), and what you tell us about your project via the contact form, email, or phone.
  • Basic usage data: standard server logs (IP address, pages requested) used for security and performance.

How we use it

  • To respond to your inquiry and, if we work together, to deliver the engagement.
  • To send communications you have explicitly opted into.
  • To keep the site secure and fast.

SMS communications

If you provide a phone number, we collect two separate, independent consents: (1) consent to receive service messages about your inquiry and project — appointment confirmations, project updates, and service notifications — and (2) a separate, optional consent to receive marketing and promotional messages. Neither box is ever pre-checked, and marketing consent is never required.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All opt-in data and consent obtained via SMS will not be shared with any third parties, except as required to provide the SMS service (e.g., mobile carriers and messaging platform providers).

  • Opt out any time: reply STOP to any message. Opt back in: reply START.
  • Need help? Reply HELP, email info@agency-os.ai, or call (319) 409-6747.
  • Message and data rates may apply. Message frequency varies.
  • Carriers are not liable for delayed or undelivered messages.

Sharing

We do not sell personal information. We share it only with the service providers required to operate (hosting, email delivery and, for SMS, carriers and our messaging platform), and when the law requires it.

Retention and your choices

We keep inquiry records for as long as needed to serve you and meet legal obligations. You can ask what we hold about you, ask us to correct it, or ask us to delete it: info@agency-os.ai.

Agency OS software (AOS)

This section applies when you use the Agency OS software at aos.agency-os.ai (the “Service”). It adds to the policy above. Where they differ, this section governs your use of the Service.

Who we are. Agency OS LLC, an Iowa limited liability company, 4131 N. Central Expressway, Suite 900, Dallas, TX 75204. Privacy contact: info@agency-os.ai.

1. Two kinds of data, two roles

  • Your account data. You and your teammates’ names, emails, sign-in details, settings and billing details. For this data, we are the controller.
  • Your workspace data. Everything your agency puts into or creates in AOS, including your clients’ details, contacts, brand assets, messages, designs, documents, tasks and reports. For this data, your agency is the controller and we act as your processor: we process it only to provide the Service to you, on your instructions. If you need a data processing agreement, contact us.

2. What we collect

  • Account data: name, email, password or sign-in tokens (including sign-in providers such as Google), profile photo, role and permissions.
  • Workspace data: the content you and your team add or connect, and what AOS creates for you at your direction.
  • Connected accounts: when you connect a service (for example Google Calendar, Google Business Profile, Slack, a social network, WordPress, Stripe or Twilio), we store the access tokens securely, server-side only, and use them only to do what you ask.
  • Usage and technical data: logs, device and browser information, IP address, and AI usage and cost records (used to run, secure and bill the Service).
  • Payment data: handled by Stripe. We do not store full card numbers.

3. How we use it

To provide and secure the Service, carry out the tasks you ask for, show you your usage and costs, bill you, support you, and improve reliability. We do not sell personal information and do not use your workspace data for advertising.

4. Your data is kept separate

Each agency’s workspace data is isolated from every other agency’s at the database level. Your clients’ content is never shared with, or used for, another agency. Any product improvement we derive across customers uses only aggregated, de-identified usage patterns, never your content.

5. AI processing

AOS uses third-party AI model providers to carry out tasks you request (writing, design, research, voice, video). When you ask for that work, the relevant content is sent to the provider to produce the result. We use providers’ business/API services, which, under their terms, do not use API inputs to train their models by default. If you connect your own AI account, your requests go to that provider under your agreement with them. AI output can be inaccurate. Review it before relying on or publishing it.

6. Connecting an AI account (for example, ChatGPT)

You can choose to connect your own AI subscription account, such as a ChatGPT plan, so the AI work you ask for in AOS runs on that plan.

  • What we receive. From the provider, we receive your basic identity (name and email) and access tokens that let us make requests on your behalf. We never receive your password, your chat history in the provider’s own app, or your payment details.
  • How we keep the tokens. They are stored encrypted on our servers and are never exposed in your browser. We use them only to run your own requests, including automations you set up. They are never shared with other users, your teammates or other agencies.
  • What the provider receives. The content of each request is sent to that provider to produce the result, under the provider’s terms.
  • Disconnecting. You can disconnect at any time in Settings. Disconnecting deletes the stored tokens. You can also revoke our access from your account settings with the provider.
  • If your plan’s allowance runs out. The work falls back to your agency’s own API key or to Agency OS credits. We never charge anyone without their consent.

7. Service providers (sub-processors)

We share data with these providers only as needed to run the Service:

  • Hosting, database and storage: Supabase; Vercel.
  • AI models: Anthropic; OpenAI; Google (Gemini); xAI.
  • Web research: Firecrawl.
  • Email delivery: Resend.
  • SMS and voice: Twilio (and, for the AI voice receptionist, OpenAI realtime voice).
  • Payments: Stripe.
  • Social publishing: bundle.social.
  • Voice and video generation: ElevenLabs; Shotstack; Higgsfield.
  • Stock media search: Pexels; Pixabay; Unsplash; Vecteezy (search terms only).
  • Integrations you choose to connect: Google, Slack, Telegram, Zoom, Figma, Canva, WordPress.

8. International processing

We and our providers process data in the United States and, depending on the provider used for a task, in other countries. Some AI processing may occur outside the United States. Where the law requires a safeguard for personal data transferred from the EU, the EEA, the UK or Switzerland, we rely on the European Commission’s Standard Contractual Clauses, with the UK Addendum, in our agreements with providers.

9. Messages to your contacts

If your agency uses AOS to send email or SMS, your agency is responsible for having the recipients’ consent and for following the laws that apply (for example TCPA, CAN-SPAM, CASL). AOS records consent and opt-outs, honours STOP and unsubscribe requests, and blocks marketing messages without recorded consent.

10. Data from Facebook and Instagram

When you connect a Facebook Page, an Instagram professional account or a Meta ad account to AOS, and approve access, we receive the following from Meta. We receive nothing until you connect and approve.

  • Connection details: the Facebook user ID, name and email of the person who connects, the business portfolio chosen, and the access tokens Meta issues to the Service.
  • Facebook Pages: Page IDs, names, pictures, follower counts, posts and their engagement counts, and the Page’s lead forms.
  • Instagram professional accounts: account IDs, usernames, profile pictures, posts and their engagement counts.
  • Ad accounts: account IDs and names, campaigns, ad sets, ads and their creative, budgets and schedules, and results such as spend, impressions, clicks and leads.
  • Lead form submissions: what a person submits on a lead ad form (often a name, email, phone number and answers to the form’s questions), with when it arrived and which ad and form it came from.
  • Messages: Messenger and Instagram direct messages sent to a connected Page or account, and the replies sent from the Service, including the sender’s ID, name and profile picture as Meta provides them, the message text and any attachments.

How we use it. Only to run the features your agency uses: showing your Pages, accounts, ads and results; creating, editing or pausing ads when someone on your team asks (new campaigns are created paused, and nothing spends until a person on your team turns it on); delivering new leads to your contact list; showing messages in your inbox and sending the replies your team writes; publishing or scheduling the posts your team approves; and keeping connections working and secure.

What we never do with data from Meta. We never sell it or share it for anyone’s advertising. We never combine it across agencies to profile people. We never use it to train AI models. We never send a message or publish a post that someone on your team did not write or approve. We never use it to make decisions about anyone’s eligibility for housing, jobs, credit or insurance, or for surveillance.

AI processing of data from Meta. When your team asks AOS to suggest a reply or summarize results using data from Meta, that text is processed by Anthropic (the maker of Claude) only, under business terms that do not allow it to train on that data.

Deleting data from Meta. You can disconnect any Meta account in AOS. Anyone who connected Facebook or Instagram can also remove Agency OS under Business integrations in their Facebook settings, which stops our access. Anyone can ask us to delete data received from Meta by following our Data Deletion Instructions at agency-os.ai/data-deletion/ or by emailing info@agency-os.ai. We complete requests within 30 days.

11. Data from Google

When you connect Gmail, Google Calendar, Google Docs, Slides or Drive, Google Business Profile, YouTube, Google Ads, Google Analytics or Search Console, Agency OS receives only the access you approve for that feature, and uses it only to provide that feature to you:

  • Gmail: sending email you write or approve from your own address, and reading your messages so you can see and reply to them inside Agency OS. Your messages are shown only to you.
  • Calendar: showing your events and adding the bookings you or your clients make.
  • Docs, Slides and Drive: creating and exporting only the files Agency OS made for you.
  • Business Profile: reading reviews of locations you manage and posting the replies you approve.
  • YouTube: uploading the videos you choose and showing their results.
  • Google Ads, Google Analytics and Search Console: showing campaign, website and search results in your reports, and making ad changes you approve.

Signing in with Google shares only your name, email address and profile picture.

Agency OS’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We don’t use Google user data for advertising, don’t sell it, and don’t use it to develop, improve or train generalized AI or machine-learning models. People at Agency OS don’t read it unless you give permission, it’s needed for security, or the law requires it.

YouTube. Agency OS uses YouTube API Services. By connecting YouTube you agree to the YouTube Terms of Service. Google’s Privacy Policy is at policies.google.com/privacy.

Revoking access. You can revoke Agency OS’s access at any time, in Agency OS (Settings, then Integrations, then Disconnect) or at myaccount.google.com/permissions. When you disconnect, we delete your Google tokens immediately, and the Google data stored for that connection within 7 days.

Privacy questions: info@agency-os.ai.

12. Data from LinkedIn

When an agency connects a LinkedIn Page, profile or ad account to Agency OS, we use LinkedIn’s APIs only to manage it for the agency: publishing posts, showing and replying to comments, running ads the agency approves, and reporting results.

  • People who comment or react. Profile details of people who comment on or react to a post (for example name, headline and photo) are cached for no more than 24 hours. Comment and post text from LinkedIn members is kept for no more than 48 hours. This data is shown only to the agency that manages that Page and is never stored in our permanent records.
  • Reporting. Page and ad reporting figures (followers, impressions, clicks, spend) are kept for up to one year.
  • Lead forms. Responses to LinkedIn lead-gen forms are stored in the agency’s own contact list.
  • What we never do. We never use LinkedIn member data for advertising, sales prospecting, recruiting or building audience lists. We never sell it, export it or combine it with other data.
  • Disconnecting. Agencies can disconnect LinkedIn at any time. When they do, their access tokens are deleted immediately and LinkedIn-sourced data for that connection is deleted within 30 days.

Privacy questions: info@agency-os.ai.

13. Retention and deletion

We keep account and workspace data while your account is active. You can delete content and ask us to delete your account. When an account is deleted, we delete or de-identify its data within 30 days, except where we must keep it for legal, security, billing or fraud-prevention reasons. AOS keeps a permanent activity history so actions can be audited. It is designed to reference people by internal ID rather than storing names or contact details, so that personal details can be erased elsewhere.

14. Your rights

Depending on where you live (including under GDPR, UK GDPR and CCPA/CPRA), you may have rights to access, correct, delete, export or restrict your personal data, and to object to processing. Contact info@agency-os.ai. If your data is in an agency’s workspace, we’ll refer your request to that agency (the controller) and help them answer it.

15. Security

We use encryption in transit, role-based permissions, per-agency isolation, server-only storage of credentials, and audit logging. No system is perfectly secure. Tell us at info@agency-os.ai if you find a problem.

16. Children

The Service is for businesses and is not directed to anyone under 18.

17. Changes

We’ll post updates here and change the effective date. If changes are material, we’ll notify account owners.

Effective date of this section: October 20, 2026.

Contact

Agency OS LLC · 4131 N. Central Expressway, Suite 900, Dallas, TX 75204 · info@agency-os.ai · (319) 409-6747