Privacy Policy

The short version

• We use your data to run Agent CALM for you - not to advertise to you, and we never sell it.
• Your workspace’s data stays in your workspace. It isn’t shared with other customers or used to answer for anyone else.
• We only access the ad accounts and pages you choose to connect, and you can disconnect them at any time.
• Our AI provider processes your requests to generate answers and does not use them to train its models.

What we collect

Account information

• Your name, email address and workspace details.
• Sign-in data: one-time codes (short-lived) and sign-in activity.
• Your settings, such as communication style and agent behaviour preferences.

What you put into Agent CALM

• Chats with Agent CALM, projects, workspace memory and business context you add.
• Files you upload or attach to a chat (images, PDFs, CSVs, documents). These are stored in your workspace’s private storage.
• Work Agent CALM saves for you: audits, reports, plans, ad copy, avatars and creative.
• Web pages you ask Agent CALM to review. Page captures are saved to your workspace’s Assets.

Connected Meta (Facebook/Instagram) accounts

• An access token for the ad accounts and pages you connect, stored encrypted.
• Ad account data Agent CALM needs for a task: campaign structure, ads and creative, audiences, spend, results and conversion events, plus basic details of connected pages.

We don’t access your personal Facebook profile, friends, messages or posts, or any account you haven’t connected. Ad data is fetched when a task needs it; what Agent CALM saves for you (like an audit) is kept in your workspace.

Billing and usage

• Your plan, subscription status and invoices. Card details are collected and held by Stripe - we never see or store your full card number.
• Credit usage and a record of the actions Agent CALM takes, so you can see where credits went and what was changed.
• Technical data such as IP address, browser and error logs, used for security and to fix problems.

How we use it

• To provide the Service: sign you in, run Agent CALM’s analysis and actions, and keep your projects and memory.
• Billing and credits: take payments, manage your plan and track credit usage.
• Communication: sign-in codes, account and billing notices (such as a failed payment), and important service updates. If you opt in to marketing emails, you can unsubscribe at any time.
• Security: detect and prevent fraud, abuse and unauthorised access.
• Support and improvement: help you when you contact us, and understand how features are used so we can improve them.

We process personal data to perform our contract with you, for our legitimate interests in running and securing the Service, to meet legal obligations, and with your consent where required.

Who processes your data

We share data only with providers that help us run the Service, under agreements that require them to protect it:

• Supabase - database, sign-in and file storage.
• Anthropic - the AI models that power Agent CALM. Requests are processed to generate responses and are not used to train their models.
• Stripe - payments, subscriptions and invoices.
• Resend - email delivery.
• Meta - access to the ad accounts and pages you connect, through Meta’s official APIs.
• Brave Search - web searches Agent CALM runs for you (only the search query is sent).
• ScreenshotOne - rendering public web pages you ask Agent CALM to review.
• Our own systems - the AdSignals ad-operations engine that connects to Meta, and our customer messaging system for account and billing emails. Both are operated by The BPM Method Inc..

We may also disclose information if required by law, or to protect the safety, rights or security of our users, the public or us. If our business is sold or merged, your data may transfer to the new owner under this policy.

How we protect it

• Data is encrypted in transit and at rest, and Meta access tokens are encrypted separately.
• Workspace data is isolated, with database rules that limit each account to its own data.
• Changes Agent CALM makes to ad accounts require your approval and are logged.
• Access to production systems is limited to people who need it.

How long we keep it

• Account and workspace data is kept while your account is active.
• Meta tokens are kept until you disconnect the account or close your workspace.
• Sign-in codes and short-lived session data are deleted automatically.
• When you ask us to delete your account, we delete your workspace data, except records we must keep for legal, tax or accounting reasons (such as invoices).

Your rights and choices

Depending on where you live (including under the GDPR, UK GDPR, Canada’s PIPEDA and California’s CCPA), you can ask us to:

• access or get a copy of your personal data;
• correct it;
• delete it;
• restrict or object to how we use it.

You can also disconnect Meta accounts and update your profile in Settings at any time. Email hello@agentcalm.co to make a request - we respond within 30 days. We don’t sell personal information, and we won’t treat you differently for exercising your rights. You can also complain to your local data protection authority.

Cookies

We use only the cookies and browser storage the Service needs to work: keeping you signed in, completing checkout, and remembering preferences such as layout. We don’t use advertising cookies or allow third-party tracking on Agent CALM.

International transfers

We’re based in Canada and our providers may process data in the United States, the EU and other countries. Where data moves across borders, we rely on appropriate safeguards such as standard contractual clauses.

Children

Agent CALM is a business service for people aged 18 and over. We don’t knowingly collect data from anyone younger. If you think a child has given us personal data, contact us and we’ll delete it.

Data breaches

If a breach affects your personal data, we’ll notify you promptly and as required by law. We’ll explain what happened, what data was involved, what we’re doing about it and what you can do.

Changes to this policy

We’ll post any changes here and update the date above. For significant changes, we’ll also tell you by email or in the app.

Contact

Questions about privacy or your data: hello@agentcalm.co, or write to The BPM Method Inc., Alberta, Canada.