Privacy Policy

1. Information we collect

• Account information: your email address, name when provided, account identifiers, sign-in information, account settings, subscription or credit balance, and account activity. If you use Google or Microsoft sign-in, we receive the identity information needed to create or authenticate your account.
• Messages and recipients: recipient phone numbers, message text, the selected message type, and images or other supported content you submit. Email-based sending may also involve sender and recipient email addresses, subjects, headers, and attachments.
• Connection information: permissions you grant, identifiers for connected applications, API-key records, and authorization records used to enable, expire, or revoke access.
• Operational information: timestamps, request identifiers, duplicate-prevention records, sending history, message status, provider responses, usage, and errors.
• Website and device information: IP address, browser information, pages visited, referring pages, campaign parameters, and cookie or session identifiers where available.
• Billing and support information: payment and subscription references, transaction status, and information you send when you contact us. Stripe processes checkout payment details; we receive information needed to administer billing.

2. Information received through ChatGPT

When ChatGPT calls text.ly, it sends the tool arguments needed for the request, such as the recipient number, message content, message type, and request identifier. We also receive the authorization credential associated with your connection and ordinary request metadata. The integration does not give us general access to your entire ChatGPT conversation, inbox, contacts, or other connected services. Information included in a tool request, including any conversation content placed in the message, is received by our service.

We return request results to ChatGPT, such as a request identifier, acceptance or queue status, message type, usage information, or an error. OpenAI separately handles information you provide to ChatGPT under its own terms, privacy policy, and your account settings.

3. How we use information

We use information to operate your account; authenticate requests; route and send messages; provide sending history; prevent duplicate requests; enforce plan limits; process billing; troubleshoot problems; answer support requests; understand website use; detect fraud, spam, and abuse; and meet legal obligations.

Automated screening: Some messages are sent to OpenAI's API for classification to help detect prohibited content and select an appropriate sending route. This processing can include the message text and a derived account or sender identifier. Screening can block a message and can make mistakes. Contact support if you believe a message was incorrectly rejected. This screening is distinct from training our own models. OpenAI's handling of API data is governed by the terms and data controls applicable to that service.

4. Who receives information

• Recipients: the people you choose receive the content you send and any sender information presented by the delivery channel. They can retain, copy, or share it.
• Messaging and infrastructure providers: messaging providers, carriers, hosting and infrastructure services, and delivery systems process information needed to run the service. Depending on the route, these may include SimpleTexting, Vibes, other configured SMS providers, and Apple's services for iMessage.
• Account, payment, and screening services: Google or Microsoft for the sign-in method you select, Stripe for payments, and OpenAI for the ChatGPT integration or message screening described above.
• Legal and business purposes: we may disclose information when required by law, to respond to valid legal process, protect people and the service, or investigate misuse. Information may also be transferred in a merger, acquisition, or sale of the relevant business, subject to applicable law and notice requirements.

We do not sell personal information or share it for cross-context behavioral or targeted advertising. A provider or platform may have its own privacy obligations and policies. This policy does not control how recipients or independent third-party services handle information after receiving it.

5. Anonymous public testing

text.email offers an anonymous test separately from the account-connected text.ly plugin. Recent anonymous test activity can appear in a public demonstration log, including message excerpts or subjects, time, status, and partially masked sender and recipient details. Do not put personal, confidential, or sensitive information in an anonymous test. Masking an address does not remove personal information you put in the message itself. Account-connected text.ly sends are not included in that anonymous demonstration log.

6. Cookies and website measurement

Our account pages use cookies and related mechanisms for sign-in, sessions, security, and remembering how visitors reached the service. The text.email website also uses Google Tag Manager to manage website tags and records page visits and referral information. The text.ly landing page and this policy do not load those account-page analytics scripts, but server-side visit logging may still occur.

You can use your browser settings to limit or delete cookies. Blocking essential cookies can prevent sign-in or other account features from working. Clearing cookies does not delete account or message records held by the service.

7. Retention and deletion

We do not currently apply one fixed deletion period to all data. Account, message-history, operational, and billing records may remain after a message has been sent. Retention depends on the record's purpose, the need to provide account history and support, prevent duplicate sending and abuse, resolve disputes, and satisfy legal or accounting obligations.

You can request deletion by contacting us. We assess the request against those needs and applicable law and explain any relevant limitations. Disconnecting ChatGPT, revoking an API key, or allowing an authorization token to expire does not itself delete prior records. Removing records from our systems cannot recall a delivered message or automatically delete copies held by recipients, ChatGPT, carriers, or other providers. Backup copies may persist until overwritten or removed under the applicable backup process.

8. Security

We use safeguards that include HTTPS for API and account-connection traffic, access controls, hashed API keys and OAuth tokens, and encryption for account message-history text. These protections do not mean that all information is encrypted at every stage: message content must be available to systems that screen, queue, and deliver it. text.ly does not provide end-to-end encryption across the complete path from ChatGPT through our systems to a recipient.

No service can guarantee complete security. Keep API keys and account credentials private. Avoid including keys or sensitive message content in URLs, which can be recorded in browser history, server logs, or other systems.

9. Your choices and privacy requests

You can revoke the text.ly account connection or an API key in Settings → API keys. This stops future use of that credential; it does not cancel a request already accepted or queued. You can also disconnect the plugin in ChatGPT.

Depending on where you live and which laws apply, you may have rights to access, correct, delete, or obtain a copy of personal information; restrict or object to certain processing; withdraw consent; or appeal a privacy-request decision. Email us to exercise an applicable right, including if you received a text without having an account. We may need information to verify your identity or authority, and exceptions may apply. We will respond within the time required by applicable law. Where applicable, you can also contact your local privacy regulator.

Where a legal basis is required, we process information to provide the requested service, pursue legitimate interests such as security and service operation, meet legal obligations, or act on consent when required. Withdrawing consent does not affect processing that was lawful before withdrawal.

10. International processing and children

GMass, Inc. is a U.S. business. Our service and providers may process information in countries other than where you live, where privacy laws may differ. Contact us for information about the providers and safeguards relevant to your use.

The service is intended for adults, not children. If you believe a child has provided personal information to us, contact us so we can investigate and address it.

11. Changes to this policy

We may update this policy as the service or our practices change. We will update the date above and provide additional notice or obtain consent when required by applicable law. This policy applies to the services described above, not to unrelated GMass products that have their own policies.

12. Contact

For privacy questions or requests, email ajay.goel@text.email with the subject “text.ly privacy request.” Include the account email or enough information to identify the relevant interaction. Do not send passwords or API keys.