Privacy Policy

This Privacy Policy explains how EngageIt (“EngageIt,” “we,” “us,” or “our”), operated by [Legal Entity Name], collects, uses, discloses, and protects personal information in connection with our websites (including engageit.ai), our application at app.engageit.ai, and our related products and services (collectively, the “Services”). EngageIt is a customer-data and engagement platform powered by Thinkfleet AI.

1. Information we collect

We collect the following categories of personal information:

Information you provide

• Account & profile data — name, business name, email address, phone number, password, role, and preferences when you create or manage an account.
• Billing data — billing contact, plan, and transaction records. Card and payment details are collected and processed by our payment processor; we do not store full card numbers.
• Support & communications — messages, requests, and other information you send when you contact us or fill out a form.

Information collected automatically

• Usage & device data — IP address, browser and device type, pages and features used, referring URLs, timestamps, and similar log data.
• Cookies & similar technologies — see Section 5.

Information from third parties

• Connected services — when you connect an integration (e.g., a store, POS, or messaging channel), we receive data from that service as authorized by you.
• Partners & providers — analytics, fraud-prevention, and marketing providers may supply us with limited information to operate and improve the Services. This category does not include, and is never combined with, data received from Google APIs.

2. How we use information

Scope of Sections 2–5. These sections describe how we handle personal information generally. They do not govern data we receive from Google APIs. That data is governed exclusively by Section 10, which is used only to provide and improve the features you authorized — never for advertising or marketing, and never to train generalized AI models. Where any part of this Policy could be read to conflict with Section 10 as applied to Google user data, Section 10 controls.

We use personal information to:

• Provide, operate, maintain, and secure the Services;
• Create and manage accounts, authenticate users, and process billing;
• Provide customer support and respond to your requests;
• Personalize and improve the Services, and develop new features;
• Send service, security, and transactional communications;
• Send marketing communications where permitted (you can opt out at any time);
• Monitor, detect, and prevent fraud, abuse, and security incidents;
• Comply with legal obligations and enforce our agreements.

We do not sell personal information, and we do not use the customer data our business customers entrust to us to train general-purpose AI models.

3. Legal bases for processing (EEA/UK)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Contract — to provide the Services you or your organization request;
• Legitimate interests — to secure, improve, and market our Services in a manner balanced against your rights;
• Consent — for certain marketing and cookies, which you may withdraw at any time;
• Legal obligation — to comply with applicable law.

4. How we share information

We share personal information with:

• Service providers / subprocessors — hosting, infrastructure, analytics, payment, email/SMS/RCS delivery, and support vendors who act on our instructions under contract;
• Connected integrations — services you choose to connect, at your direction;
• Professional advisors — auditors, lawyers, and accountants;
• Corporate transactions — in connection with a merger, acquisition, financing, or sale of assets;
• Legal & safety — to comply with law, respond to lawful requests, or protect rights, property, and safety.

We do not share, transfer, or sell data received from Google APIs to any of the recipients above, except where strictly necessary to provide a feature you authorized, to comply with applicable law, or with your explicit consent. We do not share it with analytics or marketing vendors.

5. Cookies and tracking technologies

We and our providers use cookies and similar technologies to keep you signed in, remember preferences, measure traffic, and improve the Services. You can control cookies through your browser settings and, where applicable, through our cookie banner. Some features may not function properly without certain cookies.

6. Data retention

We retain personal information for as long as needed to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. Retention periods vary based on the type of data and the purpose for which it was collected. When data is no longer needed, we delete or de-identify it.

7. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your privacy rights

Depending on where you live, you may have the right to:

• Access, correct, or delete your personal information;
• Port your data to another service;
• Object to or restrict certain processing;
• Withdraw consent where processing is based on consent;
• Opt out of marketing communications and certain targeted advertising;
• Lodge a complaint with a supervisory authority.

To exercise your rights, contact us at privacy@engageit.ai. We will respond as required by applicable law. We will not discriminate against you for exercising your rights. If your personal information is held by EngageIt on behalf of one of our business customers, please direct your request to that business; we will assist them as their processor.

California residents: Under the CCPA/CPRA you have rights to know, delete, correct, and opt out of the “sale” or “sharing” of personal information. EngageIt does not sell personal information. You may submit requests using the contact details above.

9. Data we process on behalf of our customers

When our business customers use EngageIt to manage their own end-customer data — including orders, visits, contacts, messages, and rewards activity — they are the controller of that data and EngageIt acts as their processor (service provider). We process such data only to provide the Services in accordance with our Terms of Service, our customer’s instructions, and any applicable Data Processing Addendum. If you are an end customer of a business that uses EngageIt and wish to exercise privacy rights, please contact that business directly.

10. Google Workspace data and AI

When you connect a Google account, EngageIt’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not use, transfer, or sell Google Workspace data — whether raw, aggregated, or derived — to create, train, or improve any generalized or foundational machine learning or artificial intelligence model.

What we access, and why

We request the narrowest permissions our features need: reading your mail so we can show customer conversations in your EngageIt inbox and thread them to the right contact; sending a reply you have written; saving a suggested reply as a draft for you to review; and reading and creating calendar events for bookings. We do not request permission to delete your mail, change your mail settings, or manage who else can access your mailbox.

How AI features handle your Google data

• Models we run ourselves. The models that generate search embeddings and rank results across your customer history run entirely inside our own private cloud infrastructure. Your data is processed there and is never transmitted to the model’s provider — for training or for any other purpose.
• Third-party models. Where a feature sends content to a third-party AI provider, we use only providers whose terms prohibit training on customer data, and we send only what that feature needs. Features that handle Google Workspace content are technically restricted to that approved set of providers: a provider outside it cannot receive your Google data, even if it is configured for other parts of the product.
• Suggested replies are drafts. A reply generated for you is always presented for a person to review. We never send email on your behalf without that review.

What we leave out

Mail we read is used to display your conversations and thread them to the matching contact. It is not used to build marketing audiences or to target campaigns. Before any message is threaded, we filter out automated and no-reply senders and block messages from banking, healthcare, and legal domains.

You can disconnect a Google account at any time from your EngageIt settings, or revoke access directly in your Google Account permissions.

11. International data transfers

We may process and store information in countries other than where you reside. Where required, we use appropriate safeguards — such as Standard Contractual Clauses — for transfers of personal information across borders.

12. SMS, RCS, and email messaging

The Services enable our business customers to send SMS, RCS, and email messages to their own contacts. Consent for those messages is collected and managed by the sending business. EngageIt honors opt-out requests (e.g., replying STOP to text messages or using the unsubscribe link in emails) and provides tools for our customers to do the same. Message and data rates may apply to messages you receive.

13. Children’s privacy

The Services are not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will take appropriate steps to delete it.

14. Changes to this Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice. Your continued use of the Services after changes take effect constitutes acceptance of the updated Policy.

15. Contact us

If you have questions about this Privacy Policy or our data practices, contact us at:

EngageIt — operated by [Legal Entity Name]
Privacy: privacy@engageit.ai
General: hello@engageit.ai
Mailing address: [Mailing Address]