← Back to Agency OS

Privacy Policy

Last updated: July 28, 2026

This Privacy Policy describes how Licensing Unlimited LLC ("we," "us," or "our"), operating Agency OS, collects, uses, and protects information about you when you use our platform at aos.agencythinktank.com ("the Service").

1. Information We Collect

We collect the following types of information:

  • Account information: Your name, email address, and agency name when you create an account.
  • Financial data: Revenue, expense, and invoice data pulled from connected accounting platforms (QuickBooks, Xero) at your direction.
  • Content data: Social media content you generate, edit, and approve within the platform.
  • Integration data: Data from third-party services you connect, including Xero, QuickBooks, Slack, Shopify, Stripe, Klaviyo, Facebook, Instagram, LinkedIn, Threads, and YouTube.
  • Email marketing data: If you connect a Klaviyo account, we retrieve read-only email marketing performance metrics (such as emails delivered, opens, clicks, unsubscribes, and email-attributed orders and revenue) and published customer reviews. Published reviews may include the reviewer's name and review content. We retrieve this data solely to display reporting and generate content for the account owner who authorized the connection — we do not send emails, create campaigns, or write any data back to Klaviyo.
  • Advertising and analytics performance data: If you connect advertising or analytics accounts, we retrieve read-only performance metrics (such as impressions, clicks, spend, conversions, and sessions) from Google Ads, Google Analytics 4, and Meta (Facebook/Instagram) ad accounts that you authorize via OAuth. We retrieve aggregated campaign metrics only — never ad account login credentials, audience lists, or end-customer personal information.
  • Usage data: How you interact with the Service, including pages visited, features used, and actions taken.
  • Communications: Messages and notifications sent through the Service.

2. How We Use Your Information

We use the information we collect to:

  • Provide, operate, and improve the Service
  • Generate AI-powered content based on your preferences and voice samples
  • Display financial analytics and insights from your connected accounting platforms
  • Display advertising and analytics reporting from ad and analytics accounts you connect
  • Send notifications and communications related to your account and content
  • Authenticate your identity and maintain account security
  • Respond to your support requests
  • Comply with legal obligations

3. Third-Party Services

We integrate with and share data with the following third-party services to operate the platform:

  • Supabase — Database and authentication (hosted on AWS)
  • Anthropic — AI content generation
  • Resend — Email delivery
  • Xero — Accounting data integration
  • QuickBooks (Intuit) — Accounting data integration
  • Slack — Notification delivery
  • Facebook / Instagram (Meta) — Social media integration
  • LinkedIn — Social media integration
  • Threads (Meta) — Social media integration
  • YouTube (Google) — Social media integration
  • Google Ads (Google) — Read-only advertising performance reporting
  • Google Analytics 4 (Google) — Read-only website analytics reporting
  • Meta Marketing API (Meta) — Read-only advertising performance reporting
  • Shopify — Store sales reporting (aggregate totals only)
  • Faire — Read-only wholesale sales history and product inventory for demand planning
  • Klaviyo — Read-only email marketing performance reporting and published customer reviews
  • Stripe — Subscription billing
  • Vercel — Application hosting and content delivery (United States)
  • Sentry — Error and performance monitoring (diagnostic data only; personal data, request contents, and credentials are removed before transmission, and user sessions are not recorded)

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Data retrieved from Google or Meta advertising and analytics APIs is used solely to display reporting to the account owner who authorized the connection. It is never sold, never shared across customer accounts, never used for advertising targeting, and never used to train AI models.

We only share data with these services as necessary to provide the features you use. We do not sell your data to third parties.

3a. Connected Sales Channels (Product Planning)

If you connect a sales channel to Product Planning, we act as a service provider to you, the account holder. We process that data only to produce the forecasts, stock alerts and purchase recommendations you asked for. Specifically:

  • What we read. Completed and pending orders, and your product or listing records including quantities available. Access is read-only — we never create, edit, or delete anything in your store.
  • What we keep. Only aggregate figures per product per day: item identifier, date, units sold, and unit price. Alongside these, product names and images are stored so the planner is readable.
  • What we never keep. We do not store your customers’ names, email addresses, shipping addresses, payment details, or account identifiers. Buyer information is discarded as orders are processed and is never written to our database.
  • Where it is stored and how it is secured. In our Supabase database on AWS, encrypted in transit and at rest, isolated per account. The access tokens for your connection are encrypted at rest and never exposed to your browser.
  • Who it is disclosed to. Nobody. Channel data is never sold, never shared between accounts, never used for advertising, and never used to train AI models.
  • Your control. You may disconnect a channel at any time from the integrations settings, which immediately ends our access. You can also revoke access directly from the channel’s own security settings. On request we will delete the imported history — see “Your Rights and Data Deletion” below.

4. Data Storage and Security

Your data is stored securely using Supabase, hosted on Amazon Web Services (AWS), and the Service is delivered through Vercel. We implement industry-standard security measures including encryption in transit and at rest, row-level security policies, and access controls. OAuth tokens for connected platforms are encrypted at rest and are never exposed to your browser. We use Sentry for error monitoring; diagnostic events are scrubbed of personal data, request contents, and credentials before they are transmitted, and we do not record user sessions. However, no method of transmission over the internet is 100% secure.

5. International Data Transfers

Our Service and our sub-processors store and process data primarily in the United States. If you access the Service from outside the United States — including the United Kingdom, the European Economic Area, Australia, or New Zealand — your information will be transferred to and processed in the United States. Where required, these transfers are governed by Data Processing Agreements incorporating Standard Contractual Clauses (or equivalent safeguards). We process personal data in accordance with applicable data protection laws, including the UK GDPR, the EU GDPR, and the Australian Privacy Act 1988.

6. Legal Bases for Processing (UK/EU GDPR)

Where the UK GDPR or EU GDPR applies, we rely on the following legal bases under Article 6(1) to process personal data:

  • Contract (Art. 6(1)(b)): to provide the Service under our Terms — creating and maintaining your account, operating the integrations you enable, and delivering the reporting and features you request.
  • Consent (Art. 6(1)(a)): when you connect a third-party account via OAuth, you consent to our read-only access to that data for the purposes described here. You may withdraw consent at any time by disconnecting the integration.
  • Legitimate interests (Art. 6(1)(f)): to secure, maintain, and improve the Service, prevent fraud and abuse, and communicate with you about your account — balanced against your rights and freedoms.
  • Legal obligation (Art. 6(1)(c)): where processing is necessary to comply with applicable law.

7. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you the right to know what personal information we collect and how it is used, to access or delete your personal information, to correct inaccurate information, and not to be discriminated against for exercising these rights. We do not sell or share your personal information as those terms are defined under the CCPA/CPRA, and we do not use sensitive personal information beyond what is necessary to provide the Service. To exercise any of these rights, contact us at support@agencythinktank.com.

8. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. If you close your account, we will delete your data within 30 days, except where we are required to retain it by law.

9. Your Rights and Data Deletion

You have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data
  • Disconnect any third-party integrations at any time
  • Export your data in a portable format

To exercise any of these rights, contact us at support@agencythinktank.com.

Deleting connected platform data: To delete data we have retrieved from a connected platform (including Google Ads, Google Analytics, or Meta), go to Settings → Integrations in Agency OS and disconnect the integration — this immediately revokes our access and deletes stored tokens — or email support@agencythinktank.com with the subject "Data Deletion Request." We delete all associated platform data within 30 days and will confirm when complete.

10. Cookies

We use cookies and similar technologies to maintain your session and preferences. We do not use cookies for advertising or tracking across third-party websites.

11. Children's Privacy

The Service is not directed to children under 18. We do not knowingly collect personal information from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice within the Service. Your continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy, please contact us at:

Licensing Unlimited LLC
Operating as Agency OS
Maryland, United States
support@agencythinktank.com

© 2026 Licensing Unlimited LLC · Terms of Service