Privacy policy.

01Overview

Message.com LLC ("Message," "we," or "us") provides a unified customer-communications platform, chat, tickets, calls, and AI assistance, to businesses that use our service (each a "Customer"). This policy describes how we handle personal data when you:

• Visit our marketing site at message.com
• Sign up for, evaluate, or subscribe to the Message platform
• Interact with a Customer who uses Message to provide support to you (an "End User")
• Contact us by email, phone, social media, or in person

When Message provides services to a Customer, that Customer is the data controller for the conversations and customer records they process through our platform. Message is the data processoron their behalf. For details on how a particular Customer uses your personal data, please consult that Customer's own privacy policy.

02Information we collect

We collect personal data in three ways: directly from you, automatically as you use our services, and from third parties such as your employer or single-sign-on provider.

Account information

When you sign up for an account, we collect your name, work email address, company name, role, and password. If you authenticate via Google or Microsoft, we receive your profile information from that provider.

Service Data (content you submit)

While using the Message platform, you (or End Users you interact with) submit content to our systems. This may include:

• Chat messages exchanged through the Message widget
• Email messages, web-form submissions, and ticket replies
• Phone-call audio and recordings, if your account uses Message Phone
• Real-time and post-call transcripts and AI-generated summaries of voice calls
• Customer profile records you import or sync from connected systems (Shopify, Stripe, Hubspot, Salesforce, etc.)
• Files and attachments uploaded by you or End Users

Service Data is governed by your Customer agreement and our Data Processing Addendum. We process Service Data only on the Customer's instructions and do not use it to train our AI models.

Payment information

We use Stripe, Inc. to process subscription billing. When you pay for a plan, you provide your payment card details directly to Stripe. We do not store full card numbers; we receive only a token and the last four digits.

Usage data

We collect technical data about how you use our services, including IP address, browser type, device identifiers, pages visited, session duration, feature interactions, and timestamps. This is used to operate the service, troubleshoot, and improve product quality.

Cookies and similar technologies

We use cookies and similar technologies on message.com and within the platform. See Cookies for details and choices.

Communications with us

If you email, call, or chat with our team, we keep a record of that correspondence and any attachments you share with us.

03How we use information

We use personal data to:

• Provide the service. Authenticate you, deliver messages, route calls, run AI features, store recordings, and sync with your connected systems.
• Handle payments. Bill subscriptions and usage through Stripe, generate invoices, and prevent fraud.
• Support customers. Respond to questions, troubleshoot, and provide product training.
• Improve our products. Analyse aggregated, de-identified usage patterns. We do not train AI models on Service Data.
• Secure the service. Detect and prevent abuse, unauthorised access, malware, fraud, and policy violations.
• Communicate with you. Send service emails (billing receipts, security alerts, product changes that affect you). You may opt out of marketing emails at any time; service emails are required.
• Meet legal obligations. Comply with tax, accounting, telecommunications, anti-money-laundering, and lawful-request requirements.

04Legal bases (GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases under Article 6 of the GDPR:

• Contract, to provide the services you or your employer have signed up for.
• Legitimate interests, to keep the service secure, prevent fraud, improve product quality, and pursue our business operations, balanced against your rights.
• Consent, for non-essential cookies, marketing emails, and certain optional features. You may withdraw consent at any time.
• Legal obligation, to meet tax, telecommunications, and other regulatory requirements.

05Sharing and disclosure

We share personal data only in the limited circumstances below. We never sell personal data. For data received from Google APIs, the narrower rules in Google connections and data use also apply and take precedence over general sharing provisions.

Sub-processors

We engage trusted vendors that help us run the service. They are bound by contract to use personal data only as instructed by us and to maintain appropriate security. See the sub-processor list below.

Within our company

Authorised Message employees and contractors access personal data on a need-to-know basis to operate, support, and secure the service.

With your direction

If you connect a third-party integration (e.g., Slack, Shopify, Stripe, Salesforce, Zapier), we share data with that integration as you have configured. Their use is governed by their own privacy policies.

Business transfers

If Message is involved in a merger, acquisition, sale of assets, financing, or insolvency, personal data may be transferred as part of that transaction. We will notify you of any change in ownership or material change in this policy.

Legal and safety

We may disclose information when we believe in good faith it is reasonably necessary to comply with applicable law, valid legal process, lawful government requests, or to protect the rights, property, or safety of Message, our Customers, End Users, or the public.

06Sub-processors

The table below lists the third-party sub-processors we currently use to provide the Message platform. We maintain an up-to-date list on our trust page and notify Customers of new sub-processors at least 30 days before they are engaged.

07International data transfers

Message is headquartered in the United States. If you access the service from outside the United States, you understand that personal data is transferred to and processed in the United States and other countries where our sub-processors operate. For transfers from the EEA, UK, or Switzerland to the United States, we rely on the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, or another lawful transfer mechanism.

08Data retention

We retain personal data only as long as needed for the purposes described in this policy, unless a longer period is required by law.

• Account data, retained while your account is active and for up to 90 days after deletion, then permanently erased or anonymised.
• Service Data, retained according to the Customer's subscription. Default retention is 24 months for chat and ticket data and 12 months for call recordings and transcripts; Customers can configure shorter periods.
• Backups, retained for up to 35 days for disaster recovery, then overwritten.
• Billing records, retained for at least 7 years to meet tax and accounting requirements.
• Logs, operational logs are retained for 90 days; security and audit logs for 12 months.

09Security

We use commercially reasonable administrative, technical, and physical safeguards to protect personal data. These include:

• HTTPS for public service access
• Workspace permissions and role-based access controls
• Application-level encryption of connected integration credentials
• Separation of public company knowledge from private customer context
• Security documentation available from [email protected]

No system is perfectly secure. If you believe your account has been compromised, contact us immediately at [email protected].

10Your rights

Subject to applicable law, you have the following rights regarding your personal data:

• Access, request a copy of the personal data we hold about you.
• Rectification, ask us to correct inaccurate or incomplete data.
• Erasure, ask us to delete your data, subject to legal retention requirements.
• Restriction, ask us to limit how we process your data.
• Portability, receive your data in a structured, machine-readable format.
• Objection, object to processing based on legitimate interests, including direct marketing.
• Withdraw consent, at any time, where we rely on your consent.
• Lodge a complaint, with your local data protection authority.

To exercise these rights, email [email protected]. If you are an End User of a Customer's service, we will direct your request to that Customer, who is the data controller.

11California residents (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we collect, to delete it, to correct it, to opt out of any "sale" or "sharing" (we do not sell or share for cross-context behavioural advertising), and to be free from discrimination for exercising these rights.

We collect the following categories of personal information as defined by the CCPA: identifiers, customer records, commercial information, internet activity, geolocation (general), professional/employment information, audio recordings (Message Phone), and inferences. We retain each category for the periods described in Data retention.

To exercise CCPA rights, email [email protected] with the subject "California Privacy Request". We will verify your identity before responding.

12Children's privacy

The Message platform is intended for business use and is not directed at children under 16. We do not knowingly collect personal information from children. If you believe we have collected information from a child, contact us at [email protected] and we will delete it.

13Cookies and similar technologies

We use the following categories of cookies and similar technologies:

• Strictly necessary, authentication, security, and load balancing. These cannot be disabled.
• Functional, remember preferences such as language and dark mode.
• Analytics, first-party analytics to measure product usage and improve features.
• Marketing, on message.com only, to measure ad effectiveness and personalise content. You can opt out via the cookie banner.

You can also control cookies through your browser settings. Disabling strictly necessary cookies may break the service.

14Third-party links

Our site and product may contain links to third-party websites and integrations. We are not responsible for their privacy practices. Review their privacy policies before sharing information.

15Text message verification

When you request a verification code through an application built on Message.com, we process your phone number to generate and deliver a one-time passcode. We keep verification logs (the number, a timestamp, and delivery status) for fraud prevention and carrier compliance. We do not use your phone number for marketing, we do not sell it, and we do not share it with third parties except the mobile carriers and messaging-infrastructure providers required to deliver your message. Reply STOP to any verification message to opt out. See our SMS Terms for the full program terms.

16Google connections and data use

Google connections are optional. Signing in with Google does not connect your Gmail, Calendar, Drive, or Sheets. A workspace administrator chooses each connection separately and authorizes it through Google. We store the connected account identifier, email address, granted permissions, and encrypted access and refresh tokens to identify and maintain the connection.

Gmail support mailboxes

When you connect a Gmail support mailbox, we access new incoming messages and their sender, recipient, subject, text, thread identifiers, and timestamps to create support tickets. Workspace members with the appropriate permissions can read those tickets and send replies through the connected mailbox. Synchronization starts from the connection time rather than importing your historical inbox. Imported messages and agent replies are stored as workspace Service Data. Attachments remain in the original mailbox; this connector does not download them.

We request read access and permission to send email. We do not use this connection for marketing campaigns, delete or archive Gmail messages, change their read status, or modify mailbox settings.

Google Calendar availability

We access your calendar list so you can choose which calendars affect a booking host's availability. We store those selections and request busy time intervals to exclude unavailable appointment times. These permissions do not give Message.com access to event descriptions or permission to create, edit, or delete Google Calendar events.

Google Drive, Docs, and Sheets knowledge

Google's read-only permissions cover your Drive files or spreadsheets. Within Message.com, an administrator selects a supported document or a specific spreadsheet range, previews its content, and explicitly approves it before indexing. We read and refresh approved sources; we do not crawl your entire Drive or edit your files or spreadsheets.

We store approved text, source identifiers, selected ranges, synchronization details, and search representations of the content in the workspace's knowledge system. Message AI retrieves relevant passages to answer questions for the selected website. This uses our self-hosted AI infrastructure and does not train or fine-tune the underlying model. Approve only material that is suitable for the people who will receive those answers. We do not automatically publish an imported source as a public help-center page.

Storage, access, and your controls

Google-derived Service Data is stored in our service infrastructure, including DigitalOcean, and protected by workspace permissions. Cloudflare provides traffic protection and delivery. Our self-hosted AI and embedding services process approved knowledge to provide the requested answers. Connecting Google does not authorize unrelated integrations to receive that content.

You can disconnect a mailbox or Google knowledge/calendar connection in the dashboard's integration settings. Disconnecting stops future synchronization and clears the stored connection credentials. Disconnected knowledge sources are excluded from AI retrieval. You can also revoke Google-side access in your Google Account connections; that may affect other connections using the same Google grant.

Disconnecting is not a request to delete previously imported tickets or all retained source records. Those records remain subject to the Service Data retention rules above and the Customer's instructions. To request deletion of retained Google data, contact [email protected] and identify the workspace and connection. We verify the requester's authority and process the request subject to applicable legal obligations. Workspace closure and deletion are separate from disconnecting a provider; backups expire under the backup retention policy rather than being erased instantly.

Google API Limited Use

Message.com's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google data is not sold, used for advertising or credit decisions, or used to train generalized AI models.

Access by our personnel and transfers to service providers must satisfy those requirements. Human access requires your affirmative agreement for specific data, a security need, a legal obligation, or an applicable permitted aggregated-data exception. Transfers are limited to consented user-facing features, security, legal compliance, or a business transfer with explicit prior user consent. General personnel-access and business-transfer clauses elsewhere in this policy do not broaden these permissions.

17Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify Customers by email and post a prominent notice on this page at least 30 days before the changes take effect. The "Last updated" date at the top reflects the latest revision.

18Contact us

If you have questions about this policy or our privacy practices, contact us:

Message.com LLC
Attn: Privacy Team
363 North Sam Houston Pkwy E, Suite 125
Houston, TX 77060, United States
Email: [email protected]
Data Protection Officer: [email protected]

For EEA / UK residents, our representative is reachable at the address above.