Privacy Policy

1. Introduction

This Privacy Policy explains how OnMessage (“we,” “our,” or “us”), a product of Backstory Branding, collects, uses, shares, and protects information when you use our AI-powered brand messaging platform (the “Service”). By creating an account or using the Service, you agree to the practices described here. This policy should be read together with our Terms and Conditions.

2. Information We Collect

We collect the following categories of information:

• Account information. Your name, email address, and password (or Google sign-in identity), and the organization or agency you belong to.
• Content you provide. Brand information, messaging, audiences, offerings, documents, websites, and other source material you upload or enter, along with the content you generate using the Service.
• Billing information. Subscription tier and payment records. Card details are collected and processed by our payment processor (Stripe) and are not stored on our servers.
• Usage and device data. Log data, feature usage, approximate location derived from IP address, browser and device type, and diagnostic information used to operate, secure, and improve the Service.
• Voice and interview data. If you use voice or discovery-interview features, audio and transcripts you submit for processing.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service and its AI features
• Generate, analyze, and manage messaging and content at your direction
• Authenticate you, secure accounts, and prevent fraud and abuse
• Process payments, manage subscriptions, and send billing and service notices
• Respond to support requests and communicate about your account
• Send product and lifecycle emails, which you can opt out of at any time
• Comply with legal obligations and enforce our Terms

4. AI Processing

The Service uses third-party AI providers (such as Anthropic, OpenAI, Google, and Perplexity) to process the content you submit and generate outputs. To do this, the relevant inputs (such as your prompts, brand data, and selected source material) are transmitted to these providers on your behalf, exclusively through their commercial API services. Under those providers’ API terms, your inputs and outputs are not used to train, improve, or fine-tune their AI models, and are not retained by them beyond the scope of generating a response. We also do not use your content to train our own models, and we do not sell your content.

5. How We Share Information

We do not sell your personal information. We share information only as needed to operate the Service, with the following categories of service providers (“subprocessors”):

• Hosting & database: Supabase (application hosting, authentication, database, and file storage)
• Payments: Stripe (subscription and payment processing)
• AI providers: Anthropic, OpenAI, Google, and Perplexity (content generation and analysis)
• Voice: ElevenLabs (voice features and transcription)
• Website analysis: Firecrawl (retrieving public web pages you ask us to analyze)
• Email & CRM: GoHighLevel (transactional and lifecycle email, contact management)
• Analytics: Google Analytics / Google Tag Manager (usage analytics)
• Error monitoring: Sentry (diagnostics and crash reporting)
• Session replay: Microsoft Clarity (records how the Service is used, including page views, clicks and scrolling, so we can find and fix problems). Text you type into form fields is never captured, and we mask the content areas of the Service so your messages, drafts, saved content, voice transcripts and chat titles are not recorded
• Cookie consent: Cookiebot, operated by Usercentrics A/S (shows the consent banner and stores the record of the choice you made)

We may also disclose information to comply with law, respond to lawful requests, protect our rights and users, or in connection with a merger, acquisition, or sale of assets, in which case we will require the recipient to honor this policy.

6. Cookies and Tracking

We use cookies and similar technologies for three things: keeping you signed in, remembering your preferences, and understanding how the Service is used. The first two are necessary. You cannot turn them off, because without them you cannot sign in or stay signed in.

The third is optional, and how we ask depends on where you are. Where the law requires your permission first, a consent banner appears on your first visit and nothing in the statistics category runs until you accept: Google Analytics and Google Tag Manager stay in a restricted mode that sets no cookies, and Microsoft Clarity does not record your session. Where the law does not require us to ask first, those run by default.

Either way you can turn the optional categories off at any time, wherever you are. On this website, use the Cookie settings link in the footer. In the OnMessage app, open Settings and choose My Profile, then Cookie settings. Withdrawing takes effect immediately and is no harder than giving it, and declining does not affect how the Service works. We keep a record of the choice you made, including the date and the categories.

The website and the app use separate consent banners, so a choice you make in one does not carry to the other.

7. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. We retain and use information as necessary to comply with legal obligations, resolve disputes, and enforce our agreements. When you delete your account, we delete or de-identify your personal information, subject to limited records we are legally required to keep (for example, billing records).

8. Security

We use administrative, technical, and organizational safeguards to protect your information, including encryption in transit, encrypted secret storage, access controls, and tenant isolation between organizations. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

9. Your Rights and Choices

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing. These include rights under the EU/UK GDPR and the California Consumer Privacy Act (CCPA/CPRA). We do not discriminate against you for exercising these rights.

• Delete your account. You can permanently delete your account and associated personal data from Settings, or by contacting us.
• Access or export. Request a copy of the personal information we hold about you by contacting us.
• Email preferences. Opt out of product and lifecycle emails using the unsubscribe link in those emails.

To exercise any of these rights, email us at the address below. We will respond within the timeframe required by applicable law.

10. International Data Transfers

We and our service providers may process and store information in the United States and other countries. Where required, we rely on appropriate safeguards for cross-border transfers of personal information.

11. Children’s Privacy

The Service is intended for business use by individuals who are at least 18 years old. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, provide additional notice. Your continued use of the Service after an update indicates your acceptance of the revised policy.

13. Contact Us

If you have questions about this Privacy Policy or how we handle your information, contact us at contact@onmessage.app.