Privacy Policy

1. Who We Are

This privacy policy applies to CommStack (the “Service”), an AI-assisted message triage platform operated by OMII Agency (“we,” “us,” “our”).

CommStack is a business tool. Companies and teams (each a “Customer”) sign up, connect their own communication channels — email (Gmail), SMS (via a provisioned phone number), and Instagram Direct Messages — and use CommStack to receive, classify, and respond to inbound messages. When a Customer connects a channel, CommStack processes the messages sent to that channel on the Customer’s behalf, acting as a data processor for that Customer.

This policy explains how CommStack handles data across two groups: Customers (the businesses that operate an account) and senders(people who send a message to a Customer’s connected channel). It is not a consumer-facing product.

2. Information We Collect

When a person sends a message to a Customer’s connected channel (Gmail, SMS number, or Instagram account), we collect the following data in order to process and route the message:

• Message content — the full text of the message as sent.
• Sender identity — email address, phone number (SMS), or Instagram username / user ID, depending on the channel used.
• Timestamp — the date and time the message was received.
• Channel metadata — whether the message arrived via email, SMS, Instagram DM, or Instagram comment; thread or conversation ID where applicable.

From Customers who create an account, we also collect account details (name, email address, and authentication credentials) and billing information processed by our payment provider. We do not collect location data or any sender information beyond what is present in the inbound message and its delivery metadata.

3. How We Use Your Information

Data collected through the Service is used exclusively for the following purposes:

• Message classification — an AI model analyzes the message text to categorize it (for example, positive, informational, or requiring human escalation). This classification is used to route the message to the appropriate response workflow.
• Automated reply generation— for eligible messages, the system may draft a response on behalf of the Customer using the message content and the Customer’s configured criteria. Automated replies are reviewed by the Customer’s team before being sent, except where the Customer has explicitly enabled automatic delivery above a configurable confidence threshold.
• Escalation triage— for messages that require human attention, the system prepares a structured summary for the Customer’s team including sender context and a suggested response approach.
• Audit logging — messages, classifications, and actions are logged to a secure database so the Customer can review, override, or export records at any time.

We do not use message content for advertising, model training, or any purpose beyond the triage and response workflow described above.

4. Google User Data

When a Customer connects a Google account, CommStack requests read access to the account’s Gmail messages (gmail.readonly) in order to classify inbound email, and send access (gmail.send) in order to deliver replies the Customer approves. These are the only Google scopes CommStack requests.

CommStack’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Userequirements. We use Google user data only to provide and improve the message-triage features the Customer enables; we do not sell it, use it for advertising, or allow humans to read it except with the Customer’s consent, for security purposes, to comply with applicable law, or as required to operate the Service.

A Customer may disconnect their Google account at any time, which revokes CommStack’s access, and may request deletion of stored Google data by contacting us using the information in Section 10.

5. Instagram Data

Where a Customer connects an Instagram account, the Service integrates with the Meta Platform (Instagram and Facebook) to receive Direct Messages and public comments sent to that account. This integration is authorized by the account owner (the Customer) and operates under Meta’s Platform Terms of Service.

Instagram data accessed through this integration is used solely for the message triage workflow described in Section 3. It is not shared with third parties except as described in Section 6, and it is not retained beyond the period described in Section 7.

The following Meta Platform permissions are used by this Service:

• instagram_basic — to identify the Instagram account associated with the connected Facebook Page and retrieve basic sender profile information (name, user ID) for display in the triage dashboard.
• instagram_manage_messages— to receive incoming Instagram Direct Messages via webhook and send replies on the Customer’s behalf.
• pages_manage_metadata — to subscribe to webhook events so the Service is notified in real time when new messages or comments arrive.
• pages_messaging— to send messages through the Facebook Page connected to the Customer’s Instagram account.

6. How We Share Your Information

We do not sell, rent, or trade personal information. Message data may be processed by the following third-party services solely in order to operate the triage system:

• Anthropic, PBC— message content is sent to Anthropic’s Claude API for AI classification and response drafting. Anthropic processes this data in accordance with its own Privacy Policy. By default, Anthropic does not use API inputs for model training.
• Supabase, Inc. — message records, classifications, and escalation summaries are stored in a Supabase PostgreSQL database hosted on AWS. Data is stored in encrypted form at rest.
• Twilio Inc.— where SMS is used, inbound and outbound text messages are transmitted through Twilio’s messaging platform to deliver and receive SMS.
• Stripe, Inc. — Customer billing and payment details are processed by Stripe. CommStack does not store full payment card numbers.
• Sentry, Inc.— application error logs may be sent to Sentry for monitoring purposes. Error logs do not include message content. They may include operational identifiers, such as the address of the Customer’s connected mailbox, needed to diagnose a failure.

We do not transfer Google user data to any third party except as necessary to provide the Service (as described above), for security purposes, to comply with applicable law, or as part of a merger or acquisition with appropriate notice. We may disclose information if required to do so by law or in response to a valid legal process.

7. Data Retention

Raw message content (including sender identity and message text) is retained for 90 days from the date we receive it. After 90 days, an automated nightly job permanently removes message bodies and sender details from our database. Non-identifying classification metadata (message counts, classification outcomes, and timestamps) is kept after that point for reporting purposes; it contains no message content and no sender identity.

A Customer may request deletion of specific records, or of all data associated with their account, at any time by contacting us using the information in Section 10.

8. Security

All data in transit is encrypted using TLS. Data at rest is encrypted in the Supabase database. Access to the triage dashboard and underlying data is restricted to authenticated members of the relevant Customer’s team. Webhook endpoints are secured with HMAC signature verification to ensure that only authenticated requests from Meta, Twilio, and other integrated platforms are accepted.

9. Your Rights

If you sent a message to a Customer’s connected channel and would like to:

• Know what data about your message is stored
• Request deletion of your message and associated data
• Correct inaccurate information

Please contact us using the information in Section 10. We will respond within 30 days. Because we process sender messages on behalf of the Customer that operates the channel, we may coordinate with that Customer to fulfill your request.

10. Contact

For privacy-related inquiries, please contact:

11. Changes to This Policy

We may update this privacy policy from time to time. The “Last updated” date at the top of this page reflects when the most recent changes were made. Continued use of the Service after any changes constitutes acceptance of the updated policy.