Privacy Policy

Who is responsible.

Reza Karami is accountable for personal information under this policy and under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). Questions and requests go to [email protected].

If you open a workspace, we are responsible for your account information. If a business uses DropAgent to contact you, that business decides why you were contacted and what the message says. We process the contact details so the message can be sent. Ask that business about the campaign. You can still email us, and we will help with information we hold.

Information we collect.

• Account details: name, work email, company, website, use case, expected volume, country, caller ID phone number, and the text you accept at signup.
• Workspace content: contact names, phone numbers, custom fields, consent records (when the person agreed, where, how, and the exact text), opt-outs, internal do-not-call entries, audio, scripts, voice samples, and the record that a cloned voice is used with permission.
• Messages: voicemail delivery results, SMS content, replies, timestamps, and the numbers involved.
• Billing: Stripe processes card payments. We keep billing identifiers and the credit ledger. We do not store full card numbers.
• Service data: a session cookie that keeps you signed in, security and audit events, and basic hosting logs. API keys are stored as hashes.
• Product analytics: the page, referrer, campaign parameters, device, browser, and country when the host provides it. The IP address is stored only as a hash with a salt that changes daily. There is no analytics cookie.

How we use it.

We use personal information to run the workspace, send the voicemail and SMS you request, enforce consent, opt-out, quiet hours, and the workspace do-not-call list, take payment, keep the credit balance, secure the service, understand how the site and API are used, and answer support email.

We do not sell personal information. We do not use it for third-party advertising.

Mobile numbers and SMS consent.

Mobile numbers and SMS opt-in consent data are not shared or sold to third parties or affiliates for marketing. Text messaging originator opt-in data and consent are not shared with any third parties for their own marketing or promotional purposes. DropAgent has no affiliates.

A carrier that transmits a message, and the other subprocessors listed below, receive only what they need to perform the service. They do not receive a contact list so they can market their own products.

Subprocessors.

These providers process information to run DropAgent. They may process it outside Canada, including in the United States.

• Stripe — payments.
• Telnyx — voice and SMS delivery.
• ElevenLabs — voice cloning, when a workspace uses that feature.
• Railway — hosting.

How long we keep it.

Workspace content is not deleted on an automatic calendar. We keep it while the account is open. Raw product-analytics events are deleted after 180 days. Daily totals are kept. Email [email protected] to close a workspace or ask for deletion. We delete or de-identify personal information we no longer need.

• Opt-out and do-not-call entries stay so a STOP or a suppression request continues to be honored.
• Consent records tied to a send may be kept so the consent can be shown if a carrier, a regulator, or the recipient asks.
• Billing and credit records are kept for at least six years, which matches the usual Canadian tax record period.
• Security and audit records are kept while they are useful for abuse investigations and disputes.
• Signup verification links expire after 24 hours.

Your rights.

You can ask for access to personal information we hold about you, for a correction, for a copy, or for deletion. Email [email protected]. We respond within 30 days. We may ask you to confirm that you are the person the information is about. We will not charge you or treat you worse for asking.

That covers the access and correction rights under PIPEDA. We honor the same kinds of requests from California residents under the CCPA (access, correction, deletion, and opt-out of sale or share) and from people in the EEA and the UK in line with GDPR-style rights (access, correction, deletion, a portable copy, restriction, and objection).

We do not sell personal information and we do not share it for cross-context behavioral advertising. You may still email us to opt out of sale or sharing. There is nothing to opt out of.

If a business uploaded your number, we may refer the request to that business, because they control the list. A STOP reply is recorded and further messages from that workspace stop.

PIPEDA complaints can be made to the Office of the Privacy Commissioner of Canada. Write to us first if you can. We are a sole proprietor in Ontario. We do not appoint an EU representative. We still read and answer requests from outside Canada.

Security.

Key storage, webhook signatures, and the audit log are described on the security page. Hosting uses the safeguards of the providers listed above.

Children.

DropAgent is a business product. We do not knowingly collect personal information from children.

Changes.

If this policy changes, we update this page and the date at the top. For a material change to how we use account information, we email the workspace address when we have one.

Contact.

Reza Karami
Etobicoke, Ontario, Canada
[email protected]

Related pages: Terms of Service, SMS terms, and refunds.