Legal

Privacy Policy

Effective date: August 4, 2026 Last updated: August 4, 2026

1. Who we are

Ellipsend, Inc., a Delaware corporation ("Ellipsend," "we," "us"), operates the Ellipsend platform (the "Service") at ellipsend.com and through our web application. This policy explains what personal information we collect, why, how we use it, and the choices you have.

This policy applies to:

Data controller: Ellipsend, Inc., a Delaware corporation, is the controller of the personal data it collects for its own relationship with Customers and site visitors. Where Ellipsend processes Contact data on a Customer's behalf, the Customer is the controller and Ellipsend is the processor, as set out in our Data Processing Addendum. Registered agent address: 8 The Green, Ste B, Dover, DE 19901 (c/o Northwest Registered Agent Service, Inc.).

2. Information we collect

From Customers directly: account details (name, email, phone, password); billing details processed by our payment processor, Stripe — we don't store full card numbers; business information you provide to configure the Service (links and FAQ answers).

Through your connected Instagram/Facebook account (Meta Platform Data): comments and DMs sent to your account; contact profile information Meta makes available (name, handle, profile photo); post and engagement metrics tied to your content.

From Contacts: message and comment content; any contact details a Contact chooses to share in conversation (email, phone), if the Customer's setup requests them.

Automatically, through the website and app: device/browser information, IP address, pages visited, referral source; cookies and similar technologies — see our Cookie Policy.

3. How we use information

We use the information above to operate the Service (run the Inbox, run keyword- and rule-based automations, attribute sales to posts, generate reports); bill Customers and prevent fraud; provide support; improve the Service via aggregated/anonymized analytics; and meet legal, security, and Meta Platform Terms obligations.

Comments on a Customer's posts are analyzed by automated classification provided by third-party AI processors, so the Service can apply the Customer's keyword and rule settings. This processing is limited to that Customer's own account data. It stays siloed to that Customer's account — it is never pooled into a shared or general model used across other customers. The AI processors we use are named in our Subprocessors List.

We do not sell personal information, and we do not use Meta Platform Data for advertising, profiling, surveillance, or eligibility decisions (employment, credit, housing, insurance), consistent with Meta's Platform Terms.

4. How we share information

We share information with the following categories of recipients: service providers who process data on our behalf under contract, covering payment processing, hosting and infrastructure, customer support tooling, analytics, and AI processing used for comment classification; our support tooling may process Contact personal data as well as Customer account data; Meta, as required to operate Instagram/Facebook integrations; law enforcement or regulators where required by law; and a successor, if Ellipsend is acquired, subject to this policy continuing to apply. See our Subprocessors List for the full, current list of the subprocessors we use, including their names. We never share Meta Platform Data with data brokers or third parties for their own marketing purposes.

5. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, and to object to or restrict certain processing, or withdraw consent where processing relies on it. To exercise these rights, email privacy@ellipsend.com. We'll respond within 30 days. For complex requests, we may extend that period as permitted by applicable law, and we'll tell you if we do.

California residents: you have rights under the CCPA/CPRA, including to know, delete, correct, and opt out of sale/sharing of personal information. We do not sell or share personal information as those terms are defined by the CCPA.

EU/UK and international residents: Our legal bases for processing are contract necessity, legitimate interest, and consent where applicable. You have the right to lodge a complaint with your local data protection authority. See Section 8 for how we handle international data transfers.

6. Data retention

We retain personal information for as long as a Customer's account is active, plus 30 days afterward, then delete it — except billing records, which we retain for 7 years to meet standard tax and accounting obligations. Contact data is retained per the Customer's account settings and deleted on request per our Meta Platform Data Deletion Instructions. Meta Platform Data is deleted sooner in one case: when a Customer disconnects the Instagram or Facebook integration, the associated Meta Platform Data is deleted automatically.

7. Security

We use industry-standard safeguards, including encryption in transit and at rest and access controls, to protect personal information, and we limit access to Customer and Contact data to personnel who need it to operate and support the Service. No system is 100% secure; we'll notify affected users as required by law if a breach occurs.

8. International transfers

Ellipsend serves Customers and Contacts around the world, including the EU and UK. Our infrastructure is hosted on Amazon Web Services in the United States (US West, Oregon), and we rely on Standard Contractual Clauses (SCCs) as the transfer mechanism for data leaving the EU/UK or similar regions. Some of our service providers process data outside the United States; where they do, we rely on Standard Contractual Clauses or other appropriate safeguards.

9. Children's privacy

The Service is not directed to anyone under 18, and we don't knowingly collect personal information from children. If you believe a child has provided us information, contact us and we'll delete it.

10. Changes to this policy

We'll post changes here and update the "Last updated" date. Material changes take effect 30 days after they are posted; non-material changes take effect when posted. Continued use of the Service after changes take effect means you accept the updated policy.

11. Contact us

Questions about this policy: privacy@ellipsend.com, or write to Ellipsend, Inc., 8 The Green, Ste B, Dover, DE 19901 (c/o Northwest Registered Agent Service, Inc.).