Privacy Policy

Last updated: 2026-04-22. Placeholder draft. Not legal advice.

Data we process

Identity: email + Cognito sub.
Clone inputs: writing samples you upload and audio samples you record.
Connected accounts: OAuth refresh tokens for Gmail, Slack, Reddit, Teams, Instagram, Twitter/X, TikTok. Twilio credentials are per-platform application secrets, not per-user.
Message content: inbound + outbound messages across connected channels, stored in DynamoDB and indexed by your user id.
Audit log: every reply the clone drafted, the risk score, and your approve/reject decisions.

OpenAI — reply generation. Messages sent to OpenAI under the API terms (no training on API data).
ElevenLabs — voice cloning + TTS. Audio samples and generated speech.
Twilio — SMS + WhatsApp send/receive, plus outbound voice calls (synthesized audio is played to the recipient; recipient response recorded and transcribed).
Google — Gmail send/receive for users who connect Gmail.
Microsoft — Teams messaging via Graph API.
Meta — Instagram messaging via the Messenger Platform.
X Corp — Twitter/X API.
Reddit — Reddit API.
TikTok / ByteDance — Content Posting + Comments API.
AWS — hosting (Lambda, DynamoDB, S3, SQS, SES, Cognito).
Stripe — billing.

AWS (us-east-1 by default). DynamoDB + S3 encrypted with a customer-managed KMS key. Logs in CloudWatch with 30-day retention on dev, 90 on prod.

Raw uploads (writing samples, voice samples): 365 days, then S3 lifecycle expires them.
Messages + audit log: kept until you delete your account.
Non-current S3 versions: 30 days.
Deleted on account deletion (endpoint: DELETE /v1/account).

Access: Profile → Download my data gives you a JSON export of everything in your DynamoDB partition.
Deletion: Profile → Delete my account wipes DynamoDB, S3, per-user secrets, and the ElevenLabs voice clone in order.
Correction: edit anything from the Profile page.
Object: disconnect any platform to stop processing from that channel.