Privacy Policy

• Account: email address, hashed password, display name, and the date you accepted our terms.
• Subscription: plan, billing cycle, renewal date, and payment records (amount, currency and status).
• Connected accounts: the access tokens each platform gives us, plus the page/account id, username, display name and profile picture.
• Automation config: the rules, keywords, messages and links you create.
• Interactions: the text of the comments and direct messages your connected accounts receive, and the sender's id on that platform and username.
• Orders: if a customer lets the AI take orders, the buyer's name, phone number and delivery address, the items, the amounts, when it was ordered, and — once shipped — the tracking number and delivery status.
• Email: if a customer connects a business inbox, the emails forwarded to it — the sender's address and name, the subject and text, and the names and sizes of any attachments (the files themselves stay with our email provider) — and the replies sent back.
• Email lists: if a customer sends email campaigns, the list they build — email address, name, labels, where the permission came from and when, and whether the person is subscribed — and, for each campaign, whether each person opened it or clicked a link in it.

• Cloud hosting and database — the servers the service runs on and the database that holds its data (United States). The analytics for this website run there too: they are cookieless and count page views and loading speed; they do not identify you, follow you between sites, or build a profile
• Meta Platforms — the Instagram, Facebook and WhatsApp APIs the service operates through
• Telegram — the Telegram Bot API, when you connect a Telegram bot
• TikTok — the TikTok Accounts API, when you connect a TikTok account (see section 13)
• Sign-in provider — sign-in and account security; receives your email address and sign-in activity, and holds your password, which never reaches us
• Speedy Text AI — runs on a language model from an AI provider we contract with. Only if you switch the AI on. When you do, the text of the message being answered and the notes you wrote for it are sent to be turned into a draft. Nothing is sent for accounts with the AI switched off, and the provider does not train on it.
• Card payment processors — one for Egyptian pounds and one for US dollars; they receive your name, email and the amount. Your card details go to them directly and never reach us
• Email delivery provider — sending the emails this service sends you (receipts, renewal reminders, failure alerts, and the notifications you choose to receive); receives your email address and the contents of those emails. If you connect an inbox or send campaigns, it also receives the emails forwarded to you and sends your replies and campaigns, so it receives their contents and your subscribers' addresses
• Google — only if you connect a calendar or a spreadsheet. See sections 10 and 11
• Bosta — only if you connect your own Bosta account to ship orders. For each order you ship, the buyer's name, phone number, delivery address, the contents and the cash-on-delivery amount are sent to your Bosta account, because that is what a courier needs to deliver it. Bosta then tells us the parcel's status
• Vondera — only if you connect your own Vondera store. We read its products, and for each order a customer confirms in the chat, the buyer's name, phone number, delivery address and the items are sent to your Vondera store, so the order appears in your Vondera dashboard
• Aramex, Mylerz, ShipBlu, FedEx and DHL Express — only if you connect your own account with that courier. For each order you ship with it, the buyer's name, phone number, delivery address, the contents and any cash-on-delivery amount (and the declared value, for an international parcel) are sent to your account with that courier, and we then ask it for the parcel's status. Your login details for the courier are stored encrypted and never shown again

Each of these companies uses providers of its own to run its service, and each publishes its current list. We are told before those lists change and may object; if a change ever meant your data went somewhere we were not willing to send it, we would move off that provider rather than accept it quietly. The infrastructure, AI, payment and email providers are described here by what they do rather than by name; a business customer who needs their names for its own records can ask us for them.

Comments, messages and who sent them — along with the sender's id and username — are automatically deleted after 90 days. The same applies to the contact record we keep for somebody, counted from the last time they were in touch.

Answers submitted through a form are treated differently. When one of our customers asks a question in their automation — a delivery address, a size, a phone number — and somebody answers it, that answer is a record of an order placed with that business. It is kept for as long as our customer keeps it, because deleting a business's order history on a timer would destroy something they rely on. Our customer can delete any of it at any time, deleting their account removes all of it, and we will action a deletion request about a specific person on their behalf — see Your rights below.

Orders are kept the same way and for the same reason: they are a business's sales record, and the buyer's address is what the parcel was sent to. They stay for as long as our customer keeps their account, deleting the account removes all of them, and we will delete a specific person's orders on request. A copy our customer has written to their own Google Sheet is in their Drive, not ours.

Emails that reach a connected inbox, and the files attached to them, follow the same 90-day rule as comments and messages. Email lists are different: a subscriber is kept for as long as they stay subscribed and our customer keeps them. When somebody unsubscribes, an email to them bounces or they mark one as spam, only the address and that fact are kept — so that they are never emailed again from that account. Our customer can delete a subscriber at any time.

Account, subscription and payment records are kept while your account is open and for as long as tax and accounting rules require afterwards. Deleting your account removes your connected accounts, rules, contacts and interaction history.

• Free/busy (calendar.freebusy) — we ask Google which intervals you are already committed during, so the times offered to your customer are genuinely free. Google returns busy blocks only. We never receive the title, description, guests or location of any event in your calendar, and we do not ask for a permission that would let us.
• Events (calendar.events) — we create one event when a customer accepts a time you offered. We do not list, read, alter or delete events we did not create.

What we store is the token Google gives us to keep the connection alive, encrypted at rest, plus the appointments made through Speedy Text — the time, the person who booked it and which of your accounts it came from. Nothing from your calendar is used for advertising, sold, or shared with anyone, and it is never used to train a model.

You can disconnect at any time from Settings → Booking, which deletes the token, or revoke it from your Google account permissions. Appointments already in your calendar stay there — they are commitments real people made, and they are yours.

Speedy Text's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Files this app creates (drive.file) — we create one spreadsheet in your Google Drive and write one row per order into it, updating the row as the order moves. This permission only reaches files Speedy Text itself created. We cannot see, open, list or change anything else in your Drive.

What we store is the token Google gives us to keep the connection alive, encrypted at rest, and the id of that one spreadsheet. What goes into it is your own orders and nothing else. None of it is used for advertising, sold, or shared with anyone, and it is never used to train a model.

You can disconnect at any time from the Orders page, which deletes the token, or revoke it from your Google account permissions. The spreadsheet stays in your Drive — it is yours. The same Google API Services User Data Policy and Limited Use requirements quoted in section 10 apply here.

• Your catalogue — products, descriptions, choices, prices, availability and collections, copied so the AI offers only what you sell, at your prices, and can explain it.
• Your store's name, currency and published policies (shipping and refunds) — so the chat answers delivery and returns questions in your own words.

Connected this way, Speedy Text has no access to your Shopify admin, your orders or your customers, and cannot change anything in your store. When a buyer is ready, the chat sends them to your own checkout with their cart filled; the checkout and the payment happen in your Shopify store, and no customer money passes through Speedy Text.

If we set up a dedicated Shopify app for your store at your request, it asks Shopify for two read-only permissions: read_products (the same catalogue) and read_orders — only to tell the buyer in the chat that their order arrived and its tracking number. We then keep that order's number, its Shopify id and the tracking number, never your customers' names, emails, phone numbers or addresses; the app's token is encrypted at rest, and Shopify's own data-deletion requests are honoured when they arrive.

None of this is used for advertising, sold, shared, or used to train a model. Disconnecting from the Store page deletes the copy of your catalogue and policies (and uninstalls the app, where there is one).

• Your profile (user.info.basic, user.info.username, user.info.profile, user.info.stats, user.account.type) — we keep your handle, display name and photo, so the account shows as yours in the app. The rest of what these permissions allow is not stored.
• Your videos (video.list, video.insights) — the list of your public videos with their captions and thumbnails, read when you pick a video for a rule, and a video's caption when the AI answers a comment under it. Video insights are not read or stored.
• Comments (comment.list, comment.list.manage) — the comments under your public videos, read as TikTok reports them, and the public replies your rules or the AI write under them. We keep a comment's text, the commenter's TikTok username, display name and TikTok's id for them, for the same 90 days as any other comment.

The biz.brand.insights permission comes with TikTok's package; we do not read or store brand insights. We cannot read or send your TikTok direct messages. The access TikTok gives us is stored encrypted. If you turned the AI on, a comment and its video's caption are sent to Speedy Text AI to draft the reply, as described in section 5.

None of this is used for advertising, sold, shared, or used to train a model. Disconnecting the account in Speedy Text deletes its tokens; you can also remove Speedy Text from the apps listed under security and permissions in TikTok's settings.

What you share with that app is handled by its provider under its own privacy policy. We keep a record of each connection (the app's name and when it was connected and last used) and of each change it made, with what it replaced, so you can undo it. You can disconnect an app at any time from Settings → AI apps, which stops it at once. None of this is used for advertising, sold, or used to train a model.