Privacy Policy

Privacy Policy

Effective as of 9 september, 2026.

California Notice at Collection / State Privacy Rights Notice: See the State privacy rights notice section below for important information about your rights under applicable state privacy laws.

[CONFIRM: Exact legal entity name, e.g., "Tied Technologies, Inc."], a Delaware corporation ("Tied," "we," "us," or "our"), provides a customer-communication and AI-orchestration platform that enables businesses to deploy AI agents across messaging, voice, and other communication channels — including Apple Messages for Business, Google RCS, WhatsApp, SMS, email, web chat, voice, and, as they become available, video and other channels (collectively with our website at tied.com, our applications, and related services, the "Service").

This Privacy Policy describes how Tied processes personal information that we collect through the Service, our marketing activities, live events, and the other activities described in this Privacy Policy.

The two ways Tied handles personal information

Tied's role under privacy law depends on whose information is involved. Read this section first — it determines which parts of this Policy apply to you.

1. Tied as the responsible party ("controller"). When you visit tied.com, request a demo, create a Tied account, subscribe to communications, attend our events, or use the Service as a representative of a Tied business customer, Tied determines how and why your personal information is processed, and this entire Privacy Policy applies.

2. Tied as a service provider ("processor") for our business customers. When you communicate with a business that uses Tied — for example, you message a company through Apple Messages for Business, speak with its AI voice agent, or receive an order update — that business decides how and why your information is processed. Tied processes it on that business's behalf under our Data Processing Addendum with them. For those interactions, the business's own privacy policy governs, and you should direct privacy requests (access, deletion, correction) to that business. If you contact Tied directly about such data, we will refer your request to the relevant business unless the law requires us to respond directly.

3. A limited exception you should know about. As described in How we use your personal information below, Tied uses certain conversation data — only after it has been de-identified and/or pseudonymized as described below — to improve our artificial-intelligence models and the Service. For that limited improvement purpose, and for account, billing, security, and service-usage data, Tied acts in its own right rather than solely on a business customer's behalf.

Personal information we collect

Information you provide to us:

• Contact data, such as your name, email address, company name, professional title, phone number, and mailing address.

• Account and profile data, such as the credentials you use to register (including via Apple, Google, or Microsoft single sign-on), workspace details, role and team information, preferences, and settings.

• Communications data, based on exchanges with you, including when you contact us for support, chat with us (including with our own AI agents), or interact with us on social media.

• Transactional and billing data, such as subscription tier, order history, and billing details. Payment card information is collected and processed directly by our payment processors (such as Stripe) and is not stored by Tied. [CONFIRM: payment processor list]

• Marketing data, such as your communication preferences and engagement with our marketing.

• User content, such as knowledge-base materials, flow configurations, prompts, brand assets, and other content you submit to configure or operate the Service.

Conversation and channel data. When you or your organization use the Service's communication features, we process the contents and metadata of those communications, across any channel now or later supported by the Service, including: message content and attachments; voice data, including call audio, recordings, and transcripts; video data, where video channels are offered; channel identifiers (such as phone numbers or messaging handles); delivery, read, and interaction events; and payment-confirmation events (not card numbers). Where this data belongs to a business customer's end users, the service provider role described above applies.

Information from third-party sources, including: single sign-on providers you connect (Apple, Google, Microsoft); communication platforms and their service providers (Apple, Google, Meta, and messaging service providers we partner with) to the extent they make data available to us; systems you or your organization connect to the Service through our integrations; data providers and public sources; and business transaction counterparties.

Automatic data collection. We and our service providers automatically log device data (browser, OS, device type, IP address, identifiers, general location), online activity data (pages viewed, navigation paths, access times), and communication interaction data (such as whether emails were opened), including through cookies and similar technologies. For details, see our Cookie Notice at [CONFIRM: URL — Cookie Notice must be created; see Legal Review Checklist, Item 12].

How we use your personal information

• Service delivery and operations: to provide, secure, and maintain the Service; establish and administer accounts and workspaces; process transactions; route, deliver, and display communications across supported channels; execute actions you or your organization configure; and communicate with you about the Service.

• AI features: to operate the AI agents, orchestration, transcription, and related features of the Service, including sending relevant content to the large-language-model providers described in How we share your personal information.

• Improving the Service and our AI models. We use data about how the Service is used to analyze, improve, and develop the Service. In addition, we use conversation data processed through the Service to train and improve Tied's artificial-intelligence models, subject to the following: (a) identifiable conversation data is retained and used only within the originating customer's environment; (b) before any conversation data is used in model improvement across customers, it is de-identified and/or pseudonymized so that it no longer identifies any individual or customer; (c) we will not attempt to re-identify de-identified data; and (d) business customers on eligible plans may have contractual choices regarding this use, as described in their agreement with us. Please note: once a model has been trained, the training cannot be reversed. If use of data for improvement stops — for example, because a customer opts out where available or terminates — that choice applies going forward and does not remove the influence of previously used, de-identified data from models already trained.

• Personalization, such as remembering preferences and tailoring your experience.

• Marketing, including direct marketing you can opt out of at any time. [CONFIRM: whether Tied engages in any interest-based/targeted advertising. This draft assumes NO targeted advertising and NO sale/sharing of personal information; if analytics or ad pixels are on tied.com, this must change, along with the State privacy rights section.]

• Compliance and protection, including complying with law, enforcing agreements, and preventing fraud, abuse, and security incidents.

• Aggregated, de-identified, or anonymized data. We may create and use aggregated, de-identified, or anonymized data for any lawful business purpose, and we will not attempt to re-identify it except to test our de-identification processes as permitted by law.

Interacting with AI

Portions of the Service are powered by artificial intelligence. When you interact with an AI agent operated by Tied on our own site, we will identify it as such. Businesses that use Tied are contractually required to comply with applicable AI-disclosure laws in their use of the Service.

How we share your personal information

• Service providers, including cloud hosting [CONFIRM: hosting provider(s) and region(s)]; authentication (Clerk); payments (Stripe); integration infrastructure (Nango); identity/SSO tooling (WorkOS); voice infrastructure and transcription providers; analytics and email-delivery providers [CONFIRM]; and customer-support tooling.

• AI model providers. To provide AI features, relevant content (which may include conversation content) is processed by third-party large-language-model providers such as Anthropic, OpenAI, and Google. We contractually prohibit these providers from using data we send them to train their own models. Where a business customer brings its own model-provider keys, that provider acts under the customer's own agreement with it, not Tied's.

• Communication platforms and carriers. Delivering messages and calls necessarily involves the platforms and networks that carry them — including Apple (Apple Messages for Business), Google (RCS), Meta (WhatsApp, Messenger, Instagram), telecommunications carriers, and the messaging service providers we work with [CONFIRM: whether to name Spinoco / nativeMsg publicly]. Their handling of communications is governed by their own terms and policies.

• Third parties designated by you, professional advisors, authorities where legally appropriate, affiliates, and business transferees in connection with corporate transactions.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. [CONFIRM — see marketing note above.]

Retention

We retain personal information as long as needed for the purposes described above, considering the amount and sensitivity of the data, risk of harm, legal requirements, and whether purposes can be achieved by other means. Conversation data processed on behalf of business customers is retained for 12 months in active storage and 24 months in archive storage by default, or for a shorter period (as low as 90 days) where the business customer configures one, per our agreement with that customer. When personal information is no longer required, we delete it, de-identify it, or isolate it from further processing. De-identified data used in model improvement, and models trained with it, are not subject to deletion, as described above.

Your choices

You may review and update account information by logging in; opt out of marketing emails via the unsubscribe link; control cookies as described in our Cookie Notice; and close your account by [CONFIRM: method]. If you decline to provide required information, we may not be able to provide the Service. Choices regarding model-improvement use of conversation data are governed by the applicable customer agreement.

Other sites and services; Security; International transfer; Children

The Service may link to third-party services we do not control; their privacy policies apply. We employ technical, organizational, and physical safeguards designed to protect personal information, but no system is perfectly secure and we cannot guarantee security. We are headquartered in the United States and your information will be processed in the United States and other locations where privacy laws may differ from yours; European users should read the Notice to European users below. The Service is not intended for anyone under 18, and we delete children's data collected contrary to law upon becoming aware — contact us if you believe this has occurred.

Changes to this Privacy Policy

We may modify this Privacy Policy at any time. Material changes will be notified by updating the date and posting on the Service or other appropriate means, and take effect upon posting unless otherwise stated.

How to contact us

• Email: [CONFIRM: privacy@tied.com]

• Mail: [CONFIRM: registered address]

State privacy rights notice

Except as otherwise provided, this section applies to residents of U.S. states with comprehensive privacy laws applicable to us ("State Privacy Laws"). "Personal Information" and "Sensitive Personal Information" have the meanings given in the applicable State Privacy Laws. Personal information we process as a service provider on behalf of business customers is generally exempt or must be requested through that business.

Your rights (availability varies by state): to know/access the Personal Information we have collected and how it is used and disclosed; to obtain a copy; to correct inaccuracies; to delete; to appeal a denial; and non-discrimination for exercising rights.

Opt-out rights: We do not sell Personal Information, do not share it for targeted advertising, and do not process it for profiling that produces legal or similarly significant effects. [CONFIRM all three — must match the marketing/analytics reality on tied.com. If any ad-tech pixel is present, this section must be rewritten and a "Do Not Sell or Share" link added.] We honor Global Privacy Control signals as opt-out requests where required by law.

Sensitive Personal Information: We do not intentionally collect Sensitive Personal Information through tied.com, and we ask that you not submit it. Sensitive data submitted through the platform on behalf of business customers is governed by our agreements with those customers.

Information practices (current and preceding 12 months):

Retention criteria are as described in Retention above. De-identification: we do not attempt to re-identify de-identified information except to test compliance of our de-identification processes.

Exercising your rights: submit requests to [CONFIRM: email] or [CONFIRM: webform URL]. We will verify your identity, which may require information matching our records; authorized agents must provide evidence of authority (including, where permitted, a valid power of attorney). California "Shine the Light": California residents may request the notice described in Civil Code §1798.83 by emailing [CONFIRM: email] with the subject "Shine the Light Request." Nevada: Nevada residents may submit opt-out requests regarding future sales (we do not currently sell covered information) to [CONFIRM: email].

Notice to European users

This section applies only to individuals in the European Economic Area or the United Kingdom ("Europe"). References to "personal information" include "personal data" as defined in the GDPR (the EU GDPR and, as applicable, the UK GDPR).

Controller. Tied is the controller of personal information covered by this Privacy Policy (i.e., where the controller role described at the top applies). Where Tied processes personal data on behalf of business customers, the customer is the controller and Tied is the processor under our Data Processing Addendum.

GDPR representatives. [CONFIRM: whether Tied has EU/UK users or actively targets Europe. If yes, an Article 27 EU representative and UK representative must be appointed and named here. If Tied does not offer services to or monitor individuals in Europe, counsel may determine Article 27 does not apply — document that analysis.]

Legal bases for processing:

Retention follows the criteria in Retention above; when data is no longer required we delete, anonymize, or isolate it.

No sensitive data: please do not provide sensitive personal information (e.g., health, biometric, or racial/ethnic-origin data) through tied.com. Automated decision-making: we do not engage in automated decision-making producing legal or similarly significant effects about you.

Your rights: access, correction, deletion, portability, restriction, objection (including to direct marketing), and withdrawal of consent — exercisable by emailing [CONFIRM: email]. We may need to verify your identity. If unsatisfied, you may complain to your local supervisory authority; UK users may contact the Information Commissioner's Office (Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; +44 303 123 1113; ico.org.uk).

Data processing outside Europe. We are a U.S. company; using the Service means your personal information will be processed in the U.S., which is not the subject of a general adequacy decision. Where we transfer European personal information to countries without adequacy, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum or IDTA as applicable), or rely on a lawful derogation. [CONFIRM: whether Tied's hosting provider participates in the EU–U.S. Data Privacy Framework, which would simplify this.] You may contact us for information about the mechanism used for a given transfer.