Privacy Policy

1. Who we are and our role

AgentRally is operated by VStream Technology Limited, a Hong Kong company. We handle account and service administration data for our own operations. For content and conversations managed by a workspace, we process data to carry out that workspace’s instructions. Workspace owners are responsible for informing their audiences and obtaining any required permissions.

2. Information we collect

Account and workspace information includes your email, display name, login identity, password verification data, workspace membership and permission settings. Billing information may include a legal name, contact details, billing address, tax information, subscription and transaction records.

Connected platform information depends on the permissions you grant and features you use. It may include account and Page identifiers, profiles, authorization credentials, posts, media, comments, replies, conversations, message text and attachments, audience interactions and insights. Meta Ads features may also process ad accounts, campaigns, budgets, audience settings, reports and operation records.

We also process uploaded media, keyword rules, scheduled tasks, AI inputs and outputs, support correspondence, service usage, IP addresses, browser information and security or error records needed to operate the service. Required information is identified in the relevant form or authorization flow; without it, the corresponding feature may not work.

3. How we use information

We use information to authenticate users, isolate workspace access, connect authorized accounts, publish and schedule content, run keyword activities, manage replies and conversations, produce requested insights and AI results, process billing, provide support and protect the service against abuse. We do not sell personal data or Meta platform data.

4. AI tools and your instructions

When you request built-in AI analysis or drafting, relevant conversation text, timestamps, attachment descriptions, public post content or brand instructions may be sent to OpenAI. Removing platform identifiers does not make message text anonymous. Provider processing and retention are subject to the applicable provider terms and settings.

An external AI tool authorized with a workspace API token, or a callback destination configured by a workspace, can receive data within the granted scope. Choose trusted tools, limit permissions and avoid submitting unnecessary sensitive information. Revoking access prevents future authorized requests but does not erase copies already held by those recipients.

5. Who receives information

Workspace members can access data allowed by their roles. Service providers process information needed for their functions: Meta for connected social features, Google/Firebase for Google sign-in, SendGrid for service email, Stripe for payments, Cloudflare R2 for media storage, OpenAI for requested AI features, and hosting and infrastructure providers for service delivery. Payment card details are handled by Stripe; AgentRally does not store full card numbers or security codes.

Data may be processed outside your country, including in locations used by our providers. Uploaded media may use publicly accessible delivery URLs so social platforms can retrieve it; do not upload confidential files for publishing. We may disclose necessary information to meet a valid legal requirement, protect rights or investigate misuse.

6. Cookies and browser storage

We use session and security cookies for sign-in and request protection, a language cookie to remember your preference, and temporary browser storage for task progress. Blocking required cookies may prevent sign-in or other essential functions. Connected third-party services operate under their own cookie and privacy policies.

7. How we protect information

We use workspace access controls, encrypted storage for platform access credentials and verification of supported platform callbacks. Access is limited according to service responsibilities. No system is completely secure; protect your passwords and API tokens and contact us if you suspect unauthorized access. Never send passwords or access tokens with a support or privacy request.

8. How long we keep information

We retain information for as long as needed to provide the requested service and meet applicable billing, legal, dispute resolution and security needs. Retention depends on the data category and purpose; disconnecting an account does not immediately erase every historical record. Where retention is necessary after a deletion request, we limit it to that purpose and explain the applicable reason. Backup copies may remain until the relevant backup retention cycle ends.

9. Disconnect accounts and request deletion

You can also open Account settings → Delete account to review the deletion scope and verify your identity. The dedicated Data deletion instructions page explains this process and provides a contact option for people without an AgentRally login.

A workspace manager can disconnect a social account from its platform settings in AgentRally, or revoke the app’s access in the social platform’s settings. Disconnecting clears the local authorization and disables related operations, but is different from requesting deletion of stored data. It does not automatically remove posts or messages already sent on Facebook, Instagram or Threads.

To request deletion of your AgentRally account, workspace data or data received from Meta, email the privacy contact below with the subject “Data deletion request”. Include your registration email, the workspace or connected account name if known, and the data you want deleted. You can also contact us if you interacted with a connected account without having an AgentRally login.

We verify the requester’s identity and authority before deleting data, then communicate the outcome and any legally required retention. For requests concerning a workspace’s audience data, we may coordinate with its owner. Removing data from AgentRally does not erase independent copies held by Meta or other recipients; contact them separately where needed. This email process is available without signing in.

10. Access, correction and other requests

You can contact us to request access to or correction of your personal data, deletion, withdrawal of consent or other rights available under applicable law. We may need sufficient information to verify your identity, but do not require your password or access tokens. We respond within applicable legal time limits and explain if a request cannot be fulfilled. You may also raise a concern with your relevant privacy authority.

11. Policy updates and contact

The effective date identifies this version of the policy. We publish updates here and communicate material changes through appropriate service notices. If a new use requires consent, we obtain it before that use. Contact our privacy support team using the email below with questions or requests.