Legal
Privacy Policy
Who this covers
Text Drift is software that businesses put on their own websites to answer questions from their visitors and to receive leads by text message. That means two different groups of people have data here, and our responsibilities to each are different.
- Businesses that use Text Drift — our customers. We decide how their account data is handled, so for that data we are the controller.
- Visitors to those businesses' websites — people who use a chat, form or booking widget. That data belongs to the business whose site it appeared on. We hold and process it on their behalf, under their instructions. For that data the business is the controller and we are the processor.
If you spoke to a widget on a company's website and want your data removed, the fastest route is to ask that company directly. You can also contact us and we will pass the request to them and act on their instruction.
What we collect
From website visitors
- What you type into a chat, form or booking widget, including the full message history of a conversation.
- Contact details you provide — typically a name and a phone number, and depending on the widget an email address or a postal address.
- Appointment details where you book a time slot, and the outcome of any review request sent to you.
- Text messages you exchange with the business through Text Drift, including their content and delivery status.
- Technical information needed to run and protect the service — the page the widget was loaded on, a session identifier, and request metadata used for rate limiting and abuse prevention.
From businesses using Text Drift
- Account and company details: name, email address, password (stored only as a hash), business name, phone numbers for lead alerts, and any logo or avatar uploaded.
- Configuration you enter, including the plain-text knowledge base you write for the assistant.
- Billing information, handled by our payment providers — we never see or store full card numbers.
How the AI works, and what is sent where
This is the part most worth reading. When a visitor talks to a chat widget, the conversation is sent to Anthropic's Claude API so that a reply can be generated. What is sent is: the visitor's messages, the assistant's previous replies in that conversation, and the business's knowledge base. Claude is also used to write the short summary that goes out in a lead alert text.
Anthropic processes this as our sub-processor in order to return a response. Under Anthropic's commercial API terms, our inputs and outputs are not used to train Anthropic's models, and Anthropic deletes API inputs and outputs from its systems within 30 days.
If a business turns the assistant off, or sets a widget to capture details only, no conversation content is sent to Anthropic at all.
Reading a customer's website
When a business connects their site, we fetch and store the text of its public pages so the assistant can answer from it — following links up to three levels deep and up to fifty pages. We only read pages that are publicly reachable, we obey the exclusions a business configures, and we do not attempt to access anything behind a login.
Text messages
Lead alerts, appointment confirmations and reminders, replies and review requests are delivered by SMS through Twilio. Consent, message frequency and how to stop messages are covered separately in our messaging policy.
Connecting a Google account
Some features work with a business's own Google account. Connecting is optional, each feature asks for its own consent on Google's permission screen, and we request only the permissions that feature needs:
- Google Calendar (appointment booking). We list your calendars so you can choose one, read that calendar's free/busy times so the booking widget only offers open slots, and create, update and delete the calendar events for appointments booked through Text Drift. We do not read the contents of your other events.
- Google Search Console and Google Analytics (the marketing report). Read-only access to aggregate statistics about the business's own website: clicks, impressions, sessions and similar totals by day, page or search query. We do not read individual visitor records.
- Google Business Profile (optional, separate consent). Performance statistics for the business's own listing. Google's only Business Profile permission also allows editing listings; we ask for it only when a business chooses to connect Business Profile, and we never use it to change anything.
What we keep is the sign-in tokens Google issues (stored encrypted), the calendar you chose, the identifiers of appointment events we created, and the aggregate statistics we retrieved. That data is shown only in the business's own dashboard and in the marketing report the business can choose to share. We use Google data only to provide and improve these features. We do not use it for advertising, we do not sell it, we do not send it to Anthropic or use it to develop, improve or train AI or machine-learning models, and no person at Text Drift reads it except with your permission for support, to investigate security or abuse, or where the law requires. We do not obtain access to Gmail, Drive, contacts or any other Google service.
Text Drift's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
The connection can be revoked at any time from Settings in the dashboard or from your Google account's security settings. Revoking it stops all further access immediately; disconnecting from the dashboard also revokes the grant at Google and deletes the stored tokens. Retrieved statistics are removed when the business closes its account.
Who else processes data
We use a small number of service providers, each only for the purpose listed:
- Anthropic — generating assistant replies and lead summaries.
- Twilio — sending and receiving text messages.
- Stripe and Shopify — subscription billing.
- Resend — transactional email such as notifications and password resets.
- Railway — application hosting and databases, in Railway's Europe West region (Amsterdam, the Netherlands). This is where account data, conversations, contacts and message history are stored.
- Google — only where a business has connected their own Google account, as described above.
We do not sell personal information, and we do not share it with advertisers or data brokers. We may disclose information where we are legally required to, or to protect the service and its users from abuse.
Cookies and browser storage
The dashboard uses a session cookie to keep you signed in — it is strictly necessary and cannot be turned off while you are logged in. The widget stores a short-lived session identifier in your browser's sessionStorage so that a conversation holds together across page loads; it is cleared when you close the tab. We do not use advertising or cross-site tracking cookies. The marketing site at textdrift.com runs no analytics or tracking scripts.
How long we keep things
Account data is kept for as long as the account is open. Conversations, contacts, appointments and message history are kept for the life of the account so that businesses can refer back to them. A business can delete individual conversations and contacts at any time, and everything is deleted when the account is closed. We do not currently apply an automatic maximum retention period to this data.
Deletion and your rights
Depending on where you live you may have the right to access, correct, export or delete your personal information, and to object to certain processing. To exercise any of these, contact us.
When a business closes its account we remove its data across every table it is held in, including conversations, contacts, appointments, reviews, message history and any connected-account credentials. Deleted data can persist in encrypted database backups for up to 90 days before those backups expire.
California residents
Text Drift is offered to businesses in the United States. Under the California Consumer Privacy Act, as amended by the CPRA, California residents have the right to know what personal information we collect and how it is used, to request that it be corrected or deleted, and not to be treated differently for exercising those rights. We do not sell personal information, and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of. To make a request, email support@textdrift.com; we will verify it and respond within 45 days. If you provided your information to a business through one of its widgets, we will forward your request to that business, which controls that data, and act on its instruction.
We do not currently offer Text Drift to businesses in the European Economic Area or the United Kingdom, and we do not provide a Data Processing Addendum.
Shopify merchants
For businesses who installed Text Drift through the Shopify App Store, Shopify forwards data requests and deletion requests to us through its mandatory privacy endpoints. We receive and record each request, and a member of our team completes it manually: for a customer data request we provide the data we hold, and for a customer or shop erasure request we delete the relevant records. We complete these within 30 days of receiving the request from Shopify.
Security
Traffic is encrypted in transit. Passwords are stored only as hashes and are never recoverable. Access to production systems is limited to people who need it. Inbound webhooks are signature-verified, and widget traffic is rate limited. No system is perfectly secure, but we will tell affected users promptly if a breach puts their data at risk.
Children
Text Drift is a business tool and is not directed at children. We do not knowingly collect personal information from children under 13. If you believe a child has provided information through one of our widgets, contact us and we will remove it.
Changes
If we change this policy we will update the date at the top, and we will tell account holders directly about any change that materially affects them.
Contact
Questions about this policy, or a request about your data: email support@textdrift.com or use our contact page. Text Drift is operated by Intrakit LLC.