Privacy policy.

01Overview

Message.com LLC ("Message," "we," or "us") provides a unified customer-communications platform, chat, tickets, calls, and AI assistance, to businesses that use our service (each a "Customer"). This policy describes how we handle personal data when you:

• Visit our marketing site at message.com
• Sign up for, evaluate, or subscribe to the Message platform
• Interact with a Customer who uses Message to provide support to you (an "End User")
• Contact us by email, phone, social media, or in person

When Message provides services to a Customer, that Customer is the data controller for the conversations and customer records they process through our platform. Message is the data processoron their behalf. For details on how a particular Customer uses your personal data, please consult that Customer's own privacy policy.

02Information we collect

We collect personal data in three ways: directly from you, automatically as you use our services, and from third parties such as your employer or single-sign-on provider.

Account information

When you sign up for an account, we collect your name, work email address, company name, role, and password. If you authenticate via Google or Microsoft, we receive your profile information from that provider.

Service Data (content you submit)

While using the Message platform, you (or End Users you interact with) submit content to our systems. This may include:

• Chat messages exchanged through the Message widget
• Email messages, web-form submissions, and ticket replies
• Phone-call audio and recordings, if your account uses Message Phone
• Real-time and post-call transcripts and AI-generated summaries of voice calls
• Customer profile records you import or sync from connected systems (Shopify, Stripe, Hubspot, Salesforce, etc.)
• Files and attachments uploaded by you or End Users

Service Data is governed by your Customer agreement and our Data Processing Addendum. We process Service Data only on the Customer's instructions and do not use it to train our AI models.

Payment information

We use Stripe, Inc. to process subscription billing. When you pay for a plan, you provide your payment card details directly to Stripe. We do not store full card numbers; we receive only a token and the last four digits.

Usage data

We collect technical data about how you use our services, including IP address, browser type, device identifiers, pages visited, session duration, feature interactions, and timestamps. This is used to operate the service, troubleshoot, and improve product quality.

Cookies and similar technologies

We use cookies and similar technologies on message.com and within the platform. See Cookies for details and choices.

Communications with us

If you email, call, or chat with our team, we keep a record of that correspondence and any attachments you share with us.

03How we use information

We use personal data to:

• Provide the service. Authenticate you, deliver messages, route calls, run AI features, store recordings, and sync with your connected systems.
• Handle payments. Bill subscriptions and usage through Stripe, generate invoices, and prevent fraud.
• Support customers. Respond to questions, troubleshoot, and provide product training.
• Improve our products. Analyse aggregated, de-identified usage patterns. We do not train AI models on Service Data.
• Secure the service. Detect and prevent abuse, unauthorised access, malware, fraud, and policy violations.
• Communicate with you. Send service emails (billing receipts, security alerts, product changes that affect you). You may opt out of marketing emails at any time; service emails are required.
• Meet legal obligations. Comply with tax, accounting, telecommunications, anti-money-laundering, and lawful-request requirements.

04Legal bases (GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases under Article 6 of the GDPR:

• Contract, to provide the services you or your employer have signed up for.
• Legitimate interests, to keep the service secure, prevent fraud, improve product quality, and pursue our business operations, balanced against your rights.
• Consent, for non-essential cookies, marketing emails, and certain optional features. You may withdraw consent at any time.
• Legal obligation, to meet tax, telecommunications, and other regulatory requirements.

05Sharing and disclosure

We share personal data only in the limited circumstances below. We never sell personal data.

Sub-processors

We engage trusted vendors that help us run the service. They are bound by contract to use personal data only as instructed by us and to maintain appropriate security. See the sub-processor list below.

Within our company

Authorised Message employees and contractors access personal data on a need-to-know basis to operate, support, and secure the service.

With your direction

If you connect a third-party integration (e.g., Slack, Shopify, Stripe, Salesforce, Zapier), we share data with that integration as you have configured. Their use is governed by their own privacy policies.

Business transfers

If Message is involved in a merger, acquisition, sale of assets, financing, or insolvency, personal data may be transferred as part of that transaction. We will notify you of any change in ownership or material change in this policy.

Legal and safety

We may disclose information when we believe in good faith it is reasonably necessary to comply with applicable law, valid legal process, lawful government requests, or to protect the rights, property, or safety of Message, our Customers, End Users, or the public.

06Sub-processors

The table below lists the third-party sub-processors we currently use to provide the Message platform. We maintain an up-to-date list on our trust page and notify Customers of new sub-processors at least 30 days before they are engaged.

07International data transfers

Message is headquartered in the United States. If you access the service from outside the United States, you understand that personal data is transferred to and processed in the United States and other countries where our sub-processors operate. For transfers from the EEA, UK, or Switzerland to the United States, we rely on the European Commission's Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, or another lawful transfer mechanism.

08Data retention

We retain personal data only as long as needed for the purposes described in this policy, unless a longer period is required by law.

• Account data, retained while your account is active and for up to 90 days after deletion, then permanently erased or anonymised.
• Service Data, retained according to the Customer's subscription. Default retention is 24 months for chat and ticket data and 12 months for call recordings and transcripts; Customers can configure shorter periods.
• Backups, retained for up to 35 days for disaster recovery, then overwritten.
• Billing records, retained for at least 7 years to meet tax and accounting requirements.
• Logs, operational logs are retained for 90 days; security and audit logs for 12 months.

09Security

We use commercially reasonable administrative, technical, and physical safeguards to protect personal data. These include:

• TLS 1.2+ encryption in transit, AES-256 encryption at rest
• Encrypted database backups and encrypted call recordings
• Role-based access control with mandatory multi-factor authentication for all employees
• Principle of least privilege; production access logged and reviewed
• Annual penetration testing and continuous vulnerability scanning
• SOC 2 Type II controls (audit in progress)
• A documented incident response plan; affected Customers and regulators notified within 72 hours where required

No system is perfectly secure. If you believe your account has been compromised, contact us immediately at [email protected].

10Your rights

Subject to applicable law, you have the following rights regarding your personal data:

• Access, request a copy of the personal data we hold about you.
• Rectification, ask us to correct inaccurate or incomplete data.
• Erasure, ask us to delete your data, subject to legal retention requirements.
• Restriction, ask us to limit how we process your data.
• Portability, receive your data in a structured, machine-readable format.
• Objection, object to processing based on legitimate interests, including direct marketing.
• Withdraw consent, at any time, where we rely on your consent.
• Lodge a complaint, with your local data protection authority.

To exercise these rights, email [email protected]. If you are an End User of a Customer's service, we will direct your request to that Customer, who is the data controller.

11California residents (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we collect, to delete it, to correct it, to opt out of any "sale" or "sharing" (we do not sell or share for cross-context behavioural advertising), and to be free from discrimination for exercising these rights.

We collect the following categories of personal information as defined by the CCPA: identifiers, customer records, commercial information, internet activity, geolocation (general), professional/employment information, audio recordings (Message Phone), and inferences. We retain each category for the periods described in Data retention.

To exercise CCPA rights, email [email protected] with the subject "California Privacy Request". We will verify your identity before responding.

12Children's privacy

The Message platform is intended for business use and is not directed at children under 16. We do not knowingly collect personal information from children. If you believe we have collected information from a child, contact us at [email protected] and we will delete it.

13Cookies and similar technologies

We use the following categories of cookies and similar technologies:

• Strictly necessary, authentication, security, and load balancing. These cannot be disabled.
• Functional, remember preferences such as language and dark mode.
• Analytics, first-party analytics to measure product usage and improve features.
• Marketing, on message.com only, to measure ad effectiveness and personalise content. You can opt out via the cookie banner.

You can also control cookies through your browser settings. Disabling strictly necessary cookies may break the service.

14Third-party links

Our site and product may contain links to third-party websites and integrations. We are not responsible for their privacy practices. Review their privacy policies before sharing information.

15Text message verification

When you request a verification code through an application built on Message.com, we process your phone number to generate and deliver a one-time passcode. We keep verification logs (the number, a timestamp, and delivery status) for fraud prevention and carrier compliance. We do not use your phone number for marketing, we do not sell it, and we do not share it with third parties except the mobile carriers and messaging-infrastructure providers required to deliver your message. Reply STOP to any verification message to opt out. See our SMS Terms for the full program terms.

16Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify Customers by email and post a prominent notice on this page at least 30 days before the changes take effect. The "Last updated" date at the top reflects the latest revision.

17Contact us

If you have questions about this policy or our privacy practices, contact us:

Message.com LLC
Attn: Privacy Team
1946 Private Rd 2485
Uvalde, TX 78801, United States
Phone: (844) 600-8444
Email: [email protected]
Data Protection Officer: [email protected]

For EEA / UK residents, our representative is reachable at the address above.