Legal
Privacy Policy
Last updated
Who we are#
Officely AI LLC, a Delaware limited liability company, runs Agentim, a platform businesses use to build chatbots and AI flows for WhatsApp, websites, Zendesk and Intercom. This policy explains how we handle personal data. Contact us at info@agentim.ai.
Our names. Officely AI LLC is the legal company and the data controller. Agentim is its brand; the service was previously called Officely. Wherever you see Agentim or Officely (on our websites, in the app, in emails, on invoices or card statements, or in technical addresses such as api.officely.ai), it means Officely AI LLC.
We handle personal data in two different roles:
| Data | Our role | Whose privacy notice applies |
|---|---|---|
| Your account, billing, support and website data | Controller: we decide how it's used | This policy |
| Data about the people our customers' bots talk to (end users) | Processor: we handle it only on our customer's instructions | The customer's own privacy notice, plus our Data Processing Addendum |
If you chatted with a business's bot on WhatsApp, a website or a help desk, that business controls your data. Please contact the business to use your privacy rights. If you contact us, we'll pass your request on to them.
What we collect#
| Category | Examples | Where it comes from |
|---|---|---|
| Account | Name, business name, email, WhatsApp phone number, profile image, role | You, or Google when you sign in with Google |
| Billing | Plan, invoices, billing address, last 4 digits and expiry of your card | You and our payment processors (Stripe, PayPal). We never see your full card number |
| Workspace content | Chatbots, AI flows, prompts, settings, knowledge files you upload, website pages you ask us to read | You |
| Channel connections | WhatsApp business account and phone number IDs, connection tokens, Zendesk and Intercom app details | You, Meta and the services you connect |
| Google connections | Connected Google account email, name and ID, encrypted access tokens, IDs of the spreadsheets and calendars your steps use (see "Google user data") | You and Google, when you connect a Google account |
| Usage and device | Log-in times, pages and features used, IP address, browser and device type, errors | Collected automatically when you use Agentim |
| Support and communications | Messages to our support team, survey answers, call bookings | You |
| Website and marketing | Pages visited, how you found us (ad campaign tags and ad click IDs), newsletter sign-ups, cookie choices | Collected automatically and from you |
| Analytics and advertising (only with your consent) | Cookie and device IDs, pages and features used, clicks, errors, session recordings with typed text masked, and the sign-up and purchase events described in "Cookies, analytics and advertising" | Collected automatically, by cookies on our website and app and by our servers |
End-user data (the phone numbers, names, profile images, messages and answers of the people our customers' bots talk to) is processed for our customers as described in the DPA, not under this policy.
Why we use it#
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Create and run your account, and provide the service | Account, workspace content, channel connections | Performing our contract with you |
| Bill you and keep tax records | Billing, account | Contract; legal obligation |
| Keep the service secure, prevent fraud and abuse, enforce our terms | Usage and device, account | Legitimate interests: protecting our customers, their end users and Agentim |
| Answer support requests | Support, account | Contract; legitimate interests |
| Improve and fix the service, using aggregated and de-identified statistics | Usage and device | Legitimate interests: making Agentim better |
| Send service and security notices | Account | Contract; legal obligation |
| Send product news and marketing | Account, website and marketing | Consent, or legitimate interests for existing customers, with an opt-out in every email |
| Understand how our website and app are used, and find problems (analytics, session recordings) | Analytics and advertising, usage and device | Consent |
| Measure our ads on Meta and Google, and show them to people likely to be interested | Analytics and advertising, account (email and phone number, hashed) | Consent |
| Comply with law and respond to lawful requests | Any, as required | Legal obligation |
We don't sell personal data for money. Some of our consent-based advertising tools may count as "selling" or "sharing" personal data under California and other US state laws; see "Cookies, analytics and advertising". We don't make decisions about you with legal or similarly significant effects based solely on automated processing.
How we use AI#
Agentim's AI features send the text needed to answer a request (such as a customer's message, the flow's instructions and relevant knowledge snippets) to AI model providers, which return a reply. They process it on our behalf under contracts that limit them to providing the service.
- No training on your data. We don't use your workspace content, or your end users' messages, to train our own or third-party general AI models. Our providers are contractually barred from doing so. We don't use data received through WhatsApp to train or improve AI models.
- Knowledge search. Files and web pages you add to a knowledge base are split into passages and stored as search vectors, so your flows can find relevant answers. They're kept separate for each customer and deleted when you remove them.
- AI disclosure. Conversations run by AI flows show that the end user is talking to AI. This follows the EU AI Act and Israel's Privacy Protection Authority guidance.
- Our own use of AI. We may use AI tools to help answer support requests and analyse aggregated product usage. Personal data in those tools is handled under this policy.
Google user data#
You can connect a Google account to Agentim so your chatbots and AI flows can use Google Sheets, Google Calendar and Gmail. This section explains what we access from Google, why, and how we protect it. It applies only when you choose to connect a Google account.
What we access and why. We ask for each permission only when you first add a step that needs it, and we use it only to run the automations you set up in your chatbots and flows.
| Google data | Permission | What Agentim does with it |
|---|---|---|
| Your Google account's email address, name and account ID | Basic profile (openid, email, profile) | Shows which Google account is connected, so you can tell your accounts apart |
| Google Sheets spreadsheets you pick | drive.file | Reads, adds, updates and clears rows, and adds tabs, only in the spreadsheets you choose with the Google file picker. We can't see any other file in your Google Drive |
| Calendar events | calendar.events | Creates, updates, deletes and finds events, checks free and busy times, suggests free slots, and starts a flow when an event is created or updated, as your flows instruct |
| Your list of calendars | calendar.calendarlist.readonly | Lets you choose which calendar a step uses |
| Sending email | gmail.send | Sends the emails your flows send, and replies in threads your bot started. We can't read, search or delete the emails in your mailbox |
How we store it.
- Your Google access and refresh tokens are encrypted at rest (AES-256-GCM, with keys kept in our secrets store) and are never shown in logs.
- We store only what's needed to run your automations: the connected account's email, name and ID, the permissions you granted, the IDs and tab names of the spreadsheets and the IDs of the calendars your steps use, sync markers that tell us which rows or events are new, and the IDs of emails your bot sent.
- Spreadsheet rows, event details and email content stay in your Google account. We process them while a flow runs. We keep only the values you map into flow variables, which appear in that conversation's history like any other bot message.
- Trigger runs (the event fields a triggered flow uses, such as the customer's phone number) are deleted after 30 days.
- Our logs record IDs, counts and status codes, not spreadsheet values, event descriptions, attendee emails or email bodies. An activity log of which Google account and file or calendar each action used (never the content) is kept for up to 400 days for security and audit.
Deletion. When you disconnect a Google account in Agentim, we immediately delete its stored tokens and revoke Agentim's access at Google (unless the same Google account is still connected to another Agentim account). If you delete your Agentim account, all Google connection data is deleted with the rest of your account data, as described in "How long we keep it".
Sharing. We don't sell Google user data, use it for advertising, or use it to decide creditworthiness or lending. We share it only with the service providers needed to run the service (for example, our hosting provider and, when your flow sends Google data to an AI step, the AI model provider, under contracts that bar it from training on that data), when the law requires, or as part of a merger or sale with your prior consent. Agentim staff don't read your Google data unless you ask us to for a specific support request, or when needed for security or to comply with the law.
No AI training. We don't use Google user data to develop, improve or train generalized AI or machine learning models, and our AI model providers are contractually barred from doing so.
Security. Google data is sent only over encrypted connections, tokens are encrypted at rest, only the account owner or an admin can disconnect a Google account, and every Google action is recorded in the activity log.
How to revoke access. Disconnect the account in Agentim under Settings > Google accounts, or remove Agentim at any time at myaccount.google.com/permissions. Steps that use that account then stop until you reconnect.
Limited Use. Agentim's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Who we share it with#
We share personal data only with service providers that help us run Agentim, under contracts that require them to protect it and use it only for us. The full list of providers that process end-user data, with their locations, is in our sub-processor list.
| Service | Provider | Location |
|---|---|---|
| Hosting, databases and file storage | Amazon Web Services | Ireland (EU) |
| Conversation database | MongoDB Atlas | Ireland (EU) |
| Knowledge search | Pinecone | United States |
| AI models | OpenAI, Anthropic, Google, and other model providers listed in the sub-processor list | United States and EU |
| AI routing | Name to be added to the sub-processor list | To confirm |
| WhatsApp messaging | Meta Platforms Ireland (official API); Green API, only for customers who connect a number by QR code | Ireland; Green API to confirm |
| Payments | Stripe, PayPal | United States and EU |
| Sign-in | United States | |
| Support chat | Intercom | United States |
| Internal alerts and automations | Make | EU |
| Product analytics and session recordings (only with your consent) | PostHog | United States |
We also share data:
- with the services you choose to connect, such as Zendesk or Intercom, on your instructions;
- with Meta when its platform terms require it for WhatsApp connections;
- with Meta and Google, only with your consent, to measure our ads, as described in "Cookies, analytics and advertising". They use it under their own terms and privacy policies;
- when the law requires it, or to protect the rights and safety of our users, the public or Agentim;
- with a buyer or successor if Agentim is involved in a merger or sale, under this policy.
Where data is stored and transferred#
Agentim is a US company. Our main infrastructure runs in Amazon Web Services' Ireland region (EU), so most personal data is stored in the EU.
Some providers, including AI model providers, process data in the United States. For those transfers we rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses with additional safeguards. Transfers out of Israel follow Israel's Privacy Protection (Transfer of Data to Databases Abroad) Regulations. You can ask us for a copy of the safeguards we use.
How long we keep it#
| Data | How long |
|---|---|
| Account and workspace content | While your account is open, plus 30 days to let you export it, then deleted within 90 days |
| Billing records and invoices | 7 years, as Israeli tax law requires |
| Support conversations | 3 years after the request closes |
| Security and system logs | Up to 90 days, longer only while investigating an incident |
| Backups | Overwritten on a rolling cycle of up to 35 days |
| Marketing preferences | Until you unsubscribe, then kept only as a do-not-contact record |
| Cookie choice | 180 days in your browser, then we ask again. If you're signed in, your latest choice is also saved on your account |
| Meta cookie IDs, IP address and browser details kept for ad measurement (only with your consent) | While your account is open. Choosing "Only necessary" while signed in removes them. Meta and Google keep what they receive under their own terms |
| Record of the ad events we sent to Meta (event name, time and ID) | While your account is open |
| Analytics and session recordings (PostHog) | Deleted after the retention period of our analytics provider, PostHog. Choosing "Only necessary" stops new collection and clears the PostHog IDs in your browser |
| Google connection tokens and IDs | Until you disconnect the Google account or delete your Agentim account; trigger runs 30 days; Google activity log up to 400 days |
| End-user data in customer bots | As our customer sets in Agentim and the DPA describes |
Security#
We protect data with encryption in transit, access controls and multi-factor authentication for our staff, network isolation of our databases, activity logging, and regular reviews. No system is perfectly secure. If a breach affects your personal data, we'll tell you and the relevant authorities as the law requires.
Your rights#
Depending on where you live, you can ask to access, correct, delete or export your personal data, object to or restrict how we use it, and withdraw consent at any time. Email info@agentim.ai and we'll answer within 30 days. We may need to confirm your identity first.
- EU and UK: you can also complain to your local data protection authority.
- Israel: you have rights to review and correct your information under the Privacy Protection Law, and you can complain to the Privacy Protection Authority.
- California and other US states: you have the rights to know, delete and correct your personal data, to opt out of its "sale" or "sharing" (including for cross-context behavioural advertising and targeted advertising), to limit use of sensitive personal information, and not to be discriminated against for using them. See "Your choices under California law" under "Cookies, analytics and advertising".
Cookies, analytics and advertising#
Essential cookies. We use cookies and similar browser storage that Agentim needs to work: to keep you signed in, keep the service secure and remember your cookie choice. These are always on. Services we need for sign-in and payments, such as Google sign-in and Stripe, may set their own cookies for those purposes.
Everything else needs your consent. The first time you visit, a cookie notice asks you to choose "Accept" or "Only necessary". One choice covers our website agentim.ai and the app at app.agentim.ai. The app at app.officely.ai is on a different domain, so it asks separately. Your choice is stored in a first-party cookie for 180 days. Until you choose, and if you choose "Only necessary", none of the tools below run and nothing about you is sent to Meta or Google for advertising. If your browser sends a Global Privacy Control (GPC) signal, we treat it as "Only necessary", even if you chose "Accept" before.
Without consent, we still keep a few first-party records on our own servers, never shared for advertising: how you found us (the campaign tags and Google ad click ID in the link you arrived from), the main steps of sign-up and setup, and the errors you see in the app (an error code, the page and your account ID, kept for 90 days, never message text), so we can fix problems.
If you choose "Accept":
| Tool | Where it runs | What it does | What it collects |
|---|---|---|---|
| Meta Pixel | Our website and the app | Measures which Meta ads bring visitors and sign-ups, and helps Meta show our ads to people likely to be interested | Pages viewed, clicks on sign-up buttons, sign-ups and first paid plans, Meta cookie IDs (_fbp, _fbc), the ad click ID, IP address and browser details |
| Meta Conversions API | Our servers | Tells Meta when your account signs up, publishes its first bot, gets its first customer message or starts a paid plan (with the plan price), so these events are measured even when a browser blocks the Pixel | Your email address and phone number, hashed (SHA-256) before they leave our servers, a hashed account ID, the event name, time and ID, the Meta cookie IDs, IP address and browser user agent. The browser and our servers send the same event ID, so Meta counts each event once |
| PostHog (product analytics and session recordings) | The app | Shows how people use the app, so we can fix problems and improve it | Pages and features used, clicks, errors, device and browser details, and recordings of your sessions. In recordings every typed value is masked, and all other text is masked except buttons, menus, labels and headings; conversations, bot messages and previews are always masked. Email, phone number and name are removed from events. Signed-in people are identified by a pseudonymous ID, never by name, email or phone number |
| Google Analytics and Google Ads (through Google Tag Manager) | The app | Measures how the app is used and which Google ads bring sign-ups | Pages viewed, sign-ups, Google cookie IDs, the ad click ID, IP address and browser details |
Meta and Google use this data to measure our ads and, where they're allowed to, for their own purposes, such as improving how ads are delivered. Their own privacy policies apply (Meta, Google). Hashing replaces your email address and phone number with a code, which Meta compares with the codes of its own users to match an event to a Meta account.
How to change your choice or opt out.
- Open the cookie settings (also in the footer of our website) and choose "Only necessary". The tools above stop in that browser and the Meta cookies are removed. If you're signed in to the app when you choose, our servers also stop sending your account's events to Meta.
- Turn on Global Privacy Control in your browser or with a browser extension.
- Manage your ad preferences in your Meta ad settings and Google ad settings, or opt out of Google Analytics with the Google Analytics opt-out add-on.
- Block or delete cookies in your browser settings.
Your choices under California law. In the last 12 months, we made identifiers (such as cookie IDs, IP address, and hashed email address and phone number) and internet activity (such as pages viewed, sign-ups and purchases) available to Meta and Google for advertising, through the tools described above. Under the California Consumer Privacy Act, this may count as "selling" or "sharing" personal data for cross-context behavioural advertising. We don't sell personal data for money, and we don't knowingly sell or share the personal data of anyone under 16. Do Not Sell or Share My Personal Information: choose "Only necessary" in the cookie settings, or turn on Global Privacy Control; we treat either as your opt-out for that browser, and for your account too if you're signed in to the app. To opt out for your account on every device, email info@agentim.ai. We don't use sensitive personal information to infer characteristics about you.
Children#
Agentim is a business service and isn't directed at anyone under 18. We don't knowingly collect children's data.
Changes#
We'll update the date at the top when this policy changes, and tell you in advance by email or in the product about material changes.
Contact#
Officely AI LLC · info@agentim.ai
See also: Terms of Use