Privacy Policy

1. Introduction

SoundsWire LLC (“we”, “us”, or “our”), with its address at 30 N Gould St Ste N, Sheridan, WY 82801, US, operates AgenticRelay, the platform available at agenticrelay.app (the “Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our Service. You can reach us about privacy matters at legal@agenticrelay.app.

For the personal data you give us to use AgenticRelay (for example, account and billing details), SoundsWire LLC acts as the data controller. For the content you and your end users generate while operating your AI agents (such as conversation messages and the knowledge base you upload), we act as a data processor on your behalf, and you are the controller of that content. This Privacy Policy describes both roles.

By accessing or using the Service you acknowledge this Privacy Policy. If you do not agree with it, please do not use the Service.

2. Information We Collect

2.1 Information You Provide Directly

• Account profile — name, email address, and avatar, plus your password if you register with email and password
• Workspace data — workspace names, members, roles, and settings
• Agent configuration — the instructions, settings, and behavior you define for your AI agents
• Knowledge base content — files and text you upload so your agents can answer from them
• Connected channels — the WhatsApp business numbers, Facebook Pages, linked Instagram professional accounts, and Telegram bots you connect, their access tokens, and any AI provider API keys you supply. These credentials are stored encrypted
• Billing details — billing contact, selected plan, and usage and credit balances. Payments are handled by our payment processor; we never store full card numbers
• Communications you send to us (support requests, feedback)

2.2 Content Processed Through the Service

• Conversation content — messages exchanged with your agents on WhatsApp, Facebook Messenger, Instagram, Telegram, and your website chat widget, including any images, voice messages, and files people send
• Activity records — records of significant actions taken in your workspace, used for security, accountability, and troubleshooting

2.3 Information Collected Automatically

• Device and request data — IP address, browser type, pages visited, timestamps, and referring URLs, used to deliver the Service, keep it secure, and prevent abuse
• Usage data — features used, usage volumes, performance, and errors
• Cookies and similar technologies (see Section 10)

2.4 Information from Third Parties

• Name, email, and account identifier when you sign in with Google
• Payment confirmations and fraud-prevention signals from our payment processor
• Messages and related metadata from the messaging platforms you connect (WhatsApp, Messenger, Instagram, and Telegram)

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Service
• Create and manage your account
• Process payments and manage subscriptions
• Send transactional communications (account confirmations, invoices, security alerts)
• Respond to support requests and inquiries
• Enforce our Terms of Use and detect abuse, fraud, or security incidents
• Comply with applicable laws and legal obligations
• Send product updates or marketing communications (with your consent where required by law)
• Measure website traffic (with your consent)

We do not sell, rent, or trade your personal data. Providing account and billing details is necessary to enter into our contract with you; without them we cannot provide the Service.

4. Legal Bases for Processing (EEA, UK, and Brazil)

If you are located in the European Economic Area (EEA), the United Kingdom, or Brazil, we rely on the following legal bases under the GDPR, the UK GDPR, and Brazil's General Data Protection Law (LGPD):

• Performance of a contract — to create your account, provide the Service, process payments, and provide support
• Legitimate interests — to secure the Service, prevent abuse and fraud, understand how the Service is used so we can improve it, and communicate with you about the Service
• Legal obligation — to keep tax and accounting records and respond to lawful requests
• Consent — for website analytics cookies and marketing communications, where required. You can withdraw consent at any time

5. How We Share Your Information

We do not sell your personal data. We share it only with service providers that process it on our behalf, under written contracts that require them to protect it and use it only to provide their services to us. The categories of recipients are:

The companies in each category, the data each one processes, and their locations are listed on our Sub-processors page.

We may also disclose personal data:

• To the platforms you connect — messages your agents send through WhatsApp, Messenger, Instagram, or Telegram, and the files you choose in Google services, are handled by those platforms under their own terms (see Sections 7, 8, and 20)
• For legal reasons — when required by law, court order, or governmental authority, or to protect the rights, property, or safety of SoundsWire LLC, our users, or the public
• In a business transfer — in connection with a merger, acquisition, or sale of all or part of our assets, subject to confidentiality obligations

6. Artificial Intelligence Features

AgenticRelay lets you build and deploy AI agents that answer from your knowledge base. To generate a response, we send the content needed for that request (the message, the relevant parts of your knowledge base, and the conversation context) to the AI model provider that serves the model you selected.

On WhatsApp, Telegram, Facebook Messenger, and Instagram, people may send voice messages, images, and files. Voice messages are transcribed by a voice provider so the agent can read them, and images may be sent to the AI model you selected so the agent can interpret them. When you turn on audio replies, the reply text is sent to a voice provider to create the audio.

• Your content is not used to train models. Providers receive your content only to generate the response. We do not permit them to use it to train or improve their models.
• Bring your own key (BYOK). If you supply your own API key for an AI provider, requests made with it are processed under your agreement with that provider.
• No automated decisions with legal effect. AI features generate responses to messages; they do not make decisions that produce legal or similarly significant effects on individuals (see Section 19).

7. WhatsApp and Meta Platform Data

If you connect a WhatsApp business number, you do so through Meta's Embedded Signup flow, which is hosted and controlled by Meta. When you complete it, Meta gives us your WhatsApp Business Account and phone number identifiers and an access token that lets us send and receive messages on that number through the WhatsApp Business Platform. We use the token to register the number, manage its message templates, and send and receive messages on your behalf. The token is stored encrypted.

Meta Platform data — the WhatsApp messages, phone numbers, account identifiers, and access tokens associated with a connected number — is used solely to provide the Service to the workspace that connected that number. We do not sell this data, do not share it with any third party for advertising, and do not use it to train or fine-tune any AI model. Disconnecting a number deletes its access token immediately; conversations are kept as described in Section 9. See our Data Deletion page for how to remove this data.

Meta's own handling of WhatsApp Business Platform data is governed by its terms, including the Meta Platform Terms and the WhatsApp Business Solution Terms.

8. Facebook Messenger and Instagram Data

If you connect Facebook Messenger and Instagram direct messages, you do so through Facebook Login for Business, which is hosted and controlled by Meta. You choose which Facebook Page, and the Instagram professional account linked to it, to grant. We do not use Instagram Login.

8.1 What Meta provides when you connect

• The Facebook Page ID and Page name
• The Instagram account ID and username of the linked professional account
• A Page access token that lets us send and receive messages for that Page and Instagram account, which we store encrypted
• The app-scoped Meta user ID of the person who connected the Page, which lets us find and delete the connection if that person removes AgenticRelay on Meta (Section 8.4)

8.2 What we receive from people who message your Page or Instagram account

• The sender identifier Meta assigns, scoped to your Page (PSID) or Instagram account (IGSID)
• Message content: text, attachments including images, audio and voice messages, and files
• Message timestamps and delivery events

We do not currently retrieve the profile name or profile picture of the people who message your Page or Instagram account.

8.3 How we use this data

We use Messenger and Instagram data only to deliver your AI agent's replies and your human operators' replies to the people who message your Page or Instagram account, and to show you the conversation in your dashboard. We never sell this data, never use it for advertising, and never use it to train or fine-tune any AI model. Voice messages and images are processed as described in Section 6. Businesses can optionally turn on a notice at the start of a conversation that tells the person they are talking to an automated assistant; it is off unless the business enables it. On WhatsApp we honor opt-out keywords by suppressing further business-initiated messages to that contact.

8.4 Retention and removal

The Page access token is kept until you disconnect the Page or Instagram account (it is then deleted immediately) or delete your account. Conversations are kept as described in Section 9. You can also remove AgenticRelay in your Facebook or Instagram settings (Apps and websites) or in Meta Business Settings, which automatically deletes the Messenger and Instagram connections and tokens tied to your Meta account; see our Data Deletion page.

8.5 Meta policies

Use of these channels is subject to Meta's Meta Platform Terms, the Messenger Platform Policy, and the Instagram Platform Policy.

9. Data Retention

We keep personal data only for as long as we need it for the purposes described in this policy, or as long as the law requires. The table below sets out how long we keep each category.

10. Cookies and Similar Technologies

10.1 What we use

We do not use advertising, retargeting, or cross-site tracking cookies. Product usage inside the application is measured without analytics cookies.

10.2 Managing your consent

When you first visit our website, a consent banner is displayed and no analytics cookies are set until you accept them. You can change or withdraw your consent at any time by clicking Cookie Preferences in the footer of any page — as easily as you gave it. Withdrawal does not affect processing carried out before it.

Global Privacy Control (GPC): If your browser sends a GPC signal, we treat it as an opt-out and do not set analytics cookies.

You can also block or delete cookies in your browser settings. Blocking essential cookies may stop the Service from working.

11. Data Security

We use technical and organizational measures to protect your data, including encryption in transit and at rest, encryption of stored credentials, separation of each workspace's data, verification of messages we receive from connected platforms, access controls based on least privilege, and abuse prevention.

No method of transmission over the internet is 100% secure. If you believe your account has been compromised, contact us immediately at support@agenticrelay.app.

12. Account Deletion and Data Erasure

You can permanently delete your account from the Service. When you do, we delete your profile and the workspaces you own, including their agents, knowledge bases, conversations, and connected channels. Account deletion is blocked while a paid subscription is active, so that no further charges occur; cancel it first. Records we must keep by law, such as billing records, are kept only for the periods in Section 9.

You can also request access to or deletion of your personal data by emailing legal@agenticrelay.app. For step-by-step instructions, see our agenticrelay.app/data-deletion page.

13. Your Rights

All users

• Access and export the data associated with your account
• Correct inaccurate personal data
• Delete your account and associated personal data, in the Service (see Section 12) or by request
• Opt out of marketing emails at any time via the unsubscribe link

EEA / UK users (GDPR / UK GDPR)

• Right of access (Article 15 GDPR)
• Right to rectification (Article 16)
• Right to erasure / “right to be forgotten” (Article 17)
• Right to restriction of processing (Article 18)
• Right to data portability (Article 20)
• Right to object to processing based on legitimate interests (Article 21)
• Right to withdraw consent at any time without affecting prior lawful processing

Brazil users (LGPD)

• Confirmation that we process your data, and access to it
• Correction of incomplete, inaccurate, or outdated data
• Anonymization, blocking, or deletion of unnecessary or excessive data, or data processed unlawfully
• Portability of your data to another provider
• Deletion of data processed with your consent, and withdrawal of that consent
• Information about the entities with which we share your data

California users (CCPA / CPRA)

• Right to know what personal information we collect, use, and disclose
• Right to delete personal information
• Right to correct inaccurate personal information
• Right to opt out of the sale or sharing of personal information (we do not sell or share personal information)
• Right to non-discrimination for exercising your rights

You can exercise these rights in the Service (see Section 12) or by contacting us at legal@agenticrelay.app. We will respond within the period required by applicable law (generally one month under the GDPR/UK GDPR, 15 days under the LGPD, and 45 days under the CCPA/CPRA, each extendable where permitted). You also have the right to lodge a complaint with your local data protection authority, including the Brazilian National Data Protection Authority (ANPD).

14. International Data Transfers

SoundsWire LLC is based in the United States, and your data is stored primarily in the United States. To deliver the Service quickly and securely, requests may be handled in data centers close to you, and some providers process data in other countries (see Section 5).

When we transfer personal data from the EEA, the UK, or Brazil to countries without an adequacy decision, we rely on one or more of the following safeguards:

• EU-US Data Privacy Framework — for providers certified under it
• Standard Contractual Clauses — the clauses approved by the European Commission (Implementing Decision (EU) 2021/914)
• UK International Data Transfer Addendum — for transfers from the United Kingdom
• Mechanisms permitted by the LGPD — including the standard contractual clauses approved by the ANPD, for transfers from Brazil

You may request a copy of the applicable safeguards by contacting us at legal@agenticrelay.app.

15. Children's Privacy

The Service is not directed to children under 16 years of age (or 13 in jurisdictions where that age applies). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at legal@agenticrelay.app and we will promptly delete such information.

16. Third-Party Links

Our Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing any personal information.

17. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. For material changes, we will notify you via email or a prominent notice on the Service at least 30 days before the change takes effect. Your continued use of the Service after the effective date constitutes acceptance of the revised policy.

18. Do Not Sell or Share My Personal Information (California Residents)

Under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), California residents have the right to opt out of the “sale” or “sharing” of their personal information.

SoundsWire LLC does not sell your personal information and does not share it for cross-context behavioral advertising. We disclose personal information only to service providers acting on our behalf, for the business purposes described in Section 5. We do not use or disclose sensitive personal information for purposes other than providing the Service, and we have no actual knowledge of selling or sharing the personal information of consumers under 16.

To turn off website analytics, click Cookie Preferences in the footer and select “Decline.” For all other CCPA/CPRA rights (to know, delete, correct, and non-discrimination), contact us at legal@agenticrelay.app.

19. Automated Decision-Making

SoundsWire LLC does not use automated decision-making, including profiling, that produces legal or similarly significant effects on individuals. AI features within the Service generate responses to messages but do not make decisions about people's access, creditworthiness, employment, or similar matters.

20. Google User Data and Limited Use

If you connect a Google account to use Google Docs or Google Sheets with your agents, this section explains what we receive from Google, how we use it, and how you can remove it. It supplements the rest of this Privacy Policy.

What we access. We ask Google only for access to the individual files you choose with the Google Picker (the https://www.googleapis.com/auth/drive.file scope), plus your Google account email to identify the connection. We never ask for access to your whole Google Drive. Google Calendar, if you connect it separately, uses its own calendar permissions.

• How we use it. We store a copy of the Docs and Sheets you pick in your workspace so your agent can answer from them, and keep that copy up to date when the file changes. If you switch on adding or changing rows in a spreadsheet, anyone who chats with that agent can make it write to that spreadsheet, so enable those options only if that is what you want.
• Who receives it. To answer a question, the parts of your Google files that the answer needs are sent to the AI model provider that runs the model you selected. For these requests we use only providers that do not retain the content or train on it. Our providers are listed on the sub-processors page.
• Security. Google access tokens are stored encrypted. Only the user who connected a Google account can choose files with it, and a file can only be used in the workspace it was added to.
• Retention and removal. Remove the spreadsheet from the agent, delete the Google Doc from the knowledge base, or disconnect the Google account, and we delete the copy we hold. A spreadsheet copy is also deleted after 30 days without use. Disconnecting revokes our access with Google unless the same Google account is still connected in another workspace. You can also remove our access at any time from your Google Account permissions page.

Limited Use. AgenticRelay's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide and improve the features you see in the Service that you asked for, such as answering questions from the files you chose.
• We do not transfer Google user data to others except to provide those features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to you.
• We do not allow humans to read Google user data unless you give consent for specific data, it is necessary for security purposes such as investigating abuse, it is required by law, or the data is aggregated and anonymized for internal operations.
• We do not use Google user data for serving advertisements.
• We do not use Google user data to develop, improve or train generalized artificial intelligence or machine learning models.

21. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us. Our privacy contact below also serves as our communication channel with data subjects under the LGPD.