Privacy Policy

Last updated: October 27, 2026

This Privacy Policy describes how Licensing Unlimited LLC ("we," "us," or "our"), operating Agency OS, collects, uses, and protects information about you when you use our platform at aos.agencythinktank.com ("the Service").

1. Information We Collect

We collect the following types of information:

• Account information: Your name, email address, and agency name when you create an account.
• Financial data: Revenue, expense, and invoice data pulled from connected accounting platforms (QuickBooks, Xero, Wave) at your direction. If you connect your agency’s own Stripe account, we also read your payments and the name and email address of each customer who paid, so payments can be matched to your clients.
• Content data: Social media content you generate, edit, and approve within the platform.
• Client context: Notes you and your team write about your clients and the people who work there — who does what, how they prefer to work, how the relationship is going — together with summaries Agency OS assembles from records you already hold in the platform (work logged, updates sent, performance events). Some of this describes identifiable individuals, including your opinions about them. You decide what is recorded; Agency OS never writes it for you.
• Integration data: Data from third-party services you connect, including Xero, QuickBooks, Wave, Slack, Shopify, Recharge, Faire, Etsy, Amazon (Seller Central and Amazon Ads), TikTok Ads, Stripe, Klaviyo, Figma, HighLevel, BrightLocal, Ahrefs, Moz, Microsoft Clarity, Google (Analytics 4, Google Ads, Search Console, Calendar, Gmail, Drive and Sheets), Microsoft Outlook, monday.com, ClickUp, Hubstaff, Fathom, Fireflies, the Agency OS plugin for Obsidian, Facebook, Instagram, LinkedIn, Threads, and YouTube, and Otter.ai meeting notes you share with us. What we read from each is described below.
• Email marketing data: If you connect a Klaviyo account, we retrieve read-only email marketing performance metrics (such as emails delivered, opens, clicks, unsubscribes, and email-attributed orders and revenue) and published customer reviews. Published reviews may include the reviewer's name and review content. We retrieve this data solely to display reporting and generate content for the account owner who authorized the connection. We never send emails. If you separately give Agency OS deploy access to a Klaviyo account, then when you choose to deploy or push, Email Engine creates draft flows, draft campaigns, the email templates inside them and any list a flow needs to start, and copies the emails’ images into that account’s image library. Flows and campaigns are created as drafts: nothing is sent, scheduled or switched on by us. When you create a flow again, we delete the earlier copies of its email templates that we made in that account; the draft flows and campaigns themselves stay in Klaviyo for you to keep or delete. With deploy access we can also read an account’s flows and their emails when you save one as a template, and the names of its lists, segments and coupons so you can choose them.
• Design files (Figma): If you connect a Figma account, we read the connected account’s name, handle, email address and profile image, and the design files you link to Agency OS (frame names, sizes, colors and fonts). We store image copies of the frames you choose to use in emails, the colors and fonts read from them, and the names and links of the files you have linked. We only open files you link, we never edit your Figma files, and Figma content is never sent to AI models or used to train them. Agency OS, not Figma, is responsible for this data and how we use it.
• Advertising and analytics performance data: If you connect advertising or analytics accounts, we retrieve performance metrics (such as impressions, clicks, spend, conversions, and sessions) from Google Ads, Google Analytics 4, Google Search Console, Meta (Facebook/Instagram), Amazon Ads and TikTok Ads accounts that you authorize via OAuth, and, for Meta and TikTok, the text and images of the ads themselves. We retrieve aggregated metrics only (by account, campaign, ad and day, and for Search Console the search terms and pages people found the site through) — never ad account login credentials, audience lists, lead form responses, or end-customer personal information. This access is read-only, except for Meta as described next.
• Meta Pages, Instagram and ads: If you connect Meta, we also read the insights and posts of your Facebook Pages and their linked Instagram accounts. When you choose to, Agency OS publishes a post you approved to a Facebook Page or Instagram account, straight away or at the time you schedule, and creates a new ad from ad copy you push, always paused and in the same ad set as an existing ad, for a person to switch on in Ads Manager. We keep a record of what we published. We never switch an ad on or change its budget or targeting.
• Store data (Shopify and Recharge): If you connect a Shopify store, we read its orders, products and reports; we never change anything in the store. For each order we keep its date, totals, taxes, discounts and refunds, its line items (product, variant, SKU, title, quantity and price), its sales channel and tags, the landing page path, utm_ tags and referring site of the visit that led to it, and the customer’s order count. We do not store customers’ names, email addresses, addresses or payment details. In their place, each order carries a pseudonymous customer key, a keyed hash of the store’s customer ID, used to count new and returning customers. The key cannot be turned back into a person without a secret kept outside our database, but it is still personal data under the GDPR, so when Shopify sends us a customer’s erasure request we remove the key from that customer’s orders. If you connect Recharge, we keep daily subscription totals: recurring and one-time revenue, and new, canceled and active subscriptions.
• Your clients’ own Stripe accounts: If you connect a client’s Stripe account as one of their stores, we read its successful charges, refunds and invoice line items, and keep each charge’s amount, date, currency, description, Stripe customer ID and the products on it, to report that client’s revenue and repeat purchases. We do not store their customers’ names, email addresses or card details.
• Search and local data (Ahrefs, Moz, BrightLocal, Microsoft Clarity): With the API key you give us, we read Ahrefs backlinks, keyword rankings, organic traffic estimates and site audits; Moz domain authority, spam score and link metrics; and BrightLocal local rankings, ranking grids, citation listings, reports and published reviews (which may include the reviewer’s name). With a client’s Microsoft Clarity project token, we read daily website behavior totals by page and channel, such as scroll depth, rage and dead clicks, and quick-backs; we do not read session recordings.
• CRM data (HighLevel): If you connect HighLevel, we read, for each sub-account you switch on, its contacts, deals and pipeline stages, calendar bookings, form submissions, contracts, payments, subscriptions, invoices, email campaign results, conversations and messages, tags, custom fields, workflows and team members. We keep daily totals (leads by stage and source, booked and attended calls, email campaign results, payments) and each payment’s amount, date and HighLevel contact ID, without names or email addresses. Contacts, conversations, messages and form submissions are read live when you, an AI assistant or an instruction you set up needs them; we do not keep a copy of your contact list. HighLevel also notifies us as things happen, such as a new contact, and a notification can include that contact’s name, email address and phone number; we act only on notifications signed by HighLevel, and keep notifications for 30 days, then delete them. Each time you confirm it, Agency OS can add tags, notes and field values to a contact, add a contact to a workflow, move a deal or mark it won or lost, and book, move or cancel a calendar booking; each change can be undone. We never send SMS or email from HighLevel.
• Calendars (Google Calendar and Microsoft Outlook): If you connect a calendar, we read your events (such as title, time, location, description and attendees’ email addresses) to show your meetings in your planner and Time Tracker and to match meetings to your clients. Agency OS adds or changes an event on your Google Calendar only when you ask and confirm. We do not change your Outlook calendar.
• Work and time tools (ClickUp, monday.com, Hubstaff): From ClickUp, we read your tasks to show them in your planner and on the client work you link; we do not change anything in ClickUp. From monday.com, we read your boards and the items assigned to your team; Agency OS creates an item on a board you choose when an alert you set up is triggered, and changes an item’s status, due date or name only when you ask and confirm. From Hubstaff, we read your organization’s people, projects and tracked time, and bring the time into the Time Tracker.
• Call recordings (Fathom, Fireflies and Otter.ai): Each person can connect their own Fathom or Fireflies account. We read the calls it recorded and save each call’s summary, action items and transcript on the matching client, or privately for that person when no client matches. Otter.ai meeting notes reach us only when they are posted in a Slack channel the Agency OS app is in, or when you use the Gmail add-on on an Otter.ai email; we save them as a call record in the same way.
• Slack: When your agency connects Slack, Agency OS posts alerts and digests to the channels you choose and answers questions people send to the Agency OS app. It also reads messages in public channels the app is in: a message about time off, a deadline or a commitment becomes a short note for your planner, and Otter.ai meeting notes become a call record. To make a note, the message text is sent to our AI provider, Anthropic; we keep only the note. If you also connect your own Slack account, AI assistants can search the Slack messages and files you can see, with your own access, when you ask.
• Google Sheets: When you add a Google Sheet for your AI assistants, you pick it in Google’s own file picker, and Agency OS can open only the files you picked. We keep the sheet’s name and link, and read its contents when an assistant needs them to answer you; we do not store the contents.
• Obsidian (the Agency OS plugin): If you install our plugin in your Obsidian vault and give it an Agency OS API key, it sends the notes from your clients’ folders to Agency OS, where they become dated client-context records, and writes the summaries Agency OS produces back into your vault. Your agency chooses which way it runs; set to pull only, your notes are never read.
• Gmail (sending): If you turn on “Send from this Gmail”, Agency OS can send email from your Google account, and only when you press Send on an email you have reviewed, to the recipients you confirmed. Sending does not let us read, search, change or delete your mail. We keep a record of each email sent through Agency OS (from, to, cc, subject, time and Gmail’s message ID) so your agency can see what was sent; the email itself stays in your Gmail Sent folder. You can turn sending off in Settings at any time.
• Gmail (reading, only if you turn it on): If you turn on “Read my Gmail for client email”, Agency OS reads your own Gmail to tell you when you last heard from each of your clients, which client emails are still unanswered, and to find an email from a client when you ask for it. Once a day it reads the sender, recipients, date and subject of messages from the last 30 days that are to or from your clients’ email addresses and domains; messages from anyone else are never read, except that it also looks for messages from or to your clients’ names, only to ask you whether an address belongs to that client; nothing is added unless you say yes. When you ask about a specific client email, it reads that message’s text, and the names of any attachments, to answer you; it does not open attachments. We keep, for each client, the date of your last email in and out, and, for each unanswered client email, its sender, subject and date. We do not keep the text of your emails or any attachments.
  
  Other email is read only if you choose it. Under “Other email” in Settings you can keep reading to client email only (the default), add people you have written to, or add only the senders and domains you list. The same rules apply: once a day we read the sender, recipients, date and subject of those messages from the last 30 days, never newsletters or automated mail, and we read an email’s text only when you ask about that one email. We keep only the emails still waiting on your reply (sender, subject and date) and the choices you made; we do not keep a list of the people you write to. You can also list senders, domains and Gmail labels we must never read; nothing on that list is read, client email included. Choosing client email only deletes what we kept from other email straight away.
  
  Only you and the AI assistants answering you see this; other members of your agency do not. Turning it on is separate from sending: Agency OS still never sends an email without you pressing Send. You can turn reading off in Settings at any time.
• Google Drive (search, only if you turn it on): If you turn on “Search my Google Drive”, Agency OS can search the files in your own Google Drive and read one when you ask an AI assistant about it (for example, a client’s brand guide or onboarding form). It reads only when you ask, only to answer you: the names of matching files, and the text of the one file you ask about (Google Docs, Sheets and Slides; other files are listed by name only). We do not store anything from your Drive, and we never change, move, share or delete your files. Only you see the answers; other members of your agency do not. You can turn it off in Settings at any time.
• Gmail add-on (only if you install it): When you open an email and use the Agency OS panel in Gmail, Agency OS reads that one email (sender, recipients, subject and text) to do what you ask: draft a reply, which goes into a Gmail draft for you to review and send yourself; suggest a task, a calendar block or something to remember, added only when you press Add; or, for an Otter.ai meeting-notes email, save the notes as a call record for the matching client. When the sender’s address looks like one of your clients but is not on that client yet, the panel asks whether it belongs to them; the address is added only if you say yes. The email’s text is sent to our AI provider, Anthropic, only to produce that answer. We do not read any other email, never send email from the add-on, and keep only what you choose to add. You can remove the add-on in Gmail at any time.
• Usage data: How you interact with the Service, including pages visited, features used, and actions taken.
• Communications: Messages and notifications sent through the Service.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Service
• Generate AI-powered content based on your preferences and voice samples
• Display financial analytics and insights from your connected accounting platforms
• Display advertising and analytics reporting from ad and analytics accounts you connect
• Make the drafts, posts and changes you ask for in tools you connect, as described above
• Send notifications and communications related to your account and content
• Authenticate your identity and maintain account security
• Respond to your support requests
• Comply with legal obligations

3. Third-Party Services

We integrate with and share data with the following third-party services to operate the platform:

• Supabase — Database and authentication (hosted on AWS)
• Anthropic — AI content generation. When you ask about a client email, the text of that email is sent to Anthropic only to write your answer; Anthropic does not use it to train its models, and we do not use it to train any model.
• ElevenLabs — Voice: reading AI team updates aloud when you choose to hear them, and turning voice notes sent to the Agency OS app in Slack into text. The audio or text is sent only for that request.
• Google (Gemini) — Image generation for ad, social and email artwork and AI team avatars, from the prompts and reference images you provide.
• Resend — Email delivery
• Xero — Accounting data integration
• QuickBooks (Intuit) — Accounting data integration
• Wave — Accounting data integration
• Slack — Notification delivery; answering questions sent to the Agency OS app; notes from channel messages and Otter.ai meeting notes; and, if you connect your own account, searching your Slack when you ask
• Facebook / Instagram (Meta) — Social media integration
• LinkedIn — Social media integration
• Threads (Meta) — Social media integration
• YouTube (Google) — Social media integration
• Google Ads (Google) — Read-only advertising performance reporting
• Google Analytics 4 (Google) — Read-only website analytics reporting
• Google Search Console (Google) — Read-only search performance reporting
• Google Calendar (Google) — Your meetings in the planner and Time Tracker; events added or changed only when you confirm
• Google Sheets (Google) — Reading the sheets you pick for your AI assistants
• Microsoft Outlook — Read-only calendar, for your meetings in the planner
• Meta Marketing API (Meta) — Advertising performance reporting, and creating new ads, always paused, from ad copy you push
• Shopify — Read-only store orders, products and sales reporting (order details with a pseudonymous customer key; no customer names or contact details)
• Recharge — Subscription reporting (daily totals)
• Faire — Read-only wholesale sales history and product inventory for demand planning
• Amazon Seller Central (Selling Partner API) — Read-only sales history, Fulfillment by Amazon inventory and catalog records for demand planning. We request no access to buyer names, addresses or contact details.
• Amazon Ads — Read-only advertising performance reporting
• TikTok Ads — Read-only advertising performance reporting for the TikTok ad accounts you choose when you connect
• Klaviyo — Email marketing performance reporting and published customer reviews (read-only); and, only with deploy access you grant, creating draft flows, draft campaigns, email templates, lists and images in that account
• Figma — Read-only access to design files you link, to use your own design in emails you build
• HighLevel — CRM reporting and AI-assistant access to the sub-accounts you switch on; changes to contacts, deals and bookings only when you confirm
• BrightLocal, Ahrefs and Moz — Read-only SEO and local search reporting
• Microsoft Clarity — Read-only website behavior totals
• monday.com — Your team’s assigned items in their planners; alert items on a board you choose; item changes only when you confirm
• ClickUp — Read-only tasks in your planner
• Hubstaff — Read-only tracked time for the Time Tracker
• Fathom and Fireflies — Call summaries and transcripts from the accounts people connect (for Fathom, we add a webhook to the person’s account so new calls reach us, and remove it when they disconnect)
• Otter.ai — Meeting notes you share with us through Slack or the Gmail add-on (we do not connect to your Otter.ai account)
• Obsidian (Agency OS plugin) — Syncing client notes and summaries between your vault and Agency OS, run by the plugin on your computer
• Stripe — Subscription billing; your agency’s own revenue reporting; and your clients’ revenue reporting, from Stripe accounts you connect
• Intercom — Support chat and help articles. When you are signed in, the Intercom Messenger loads with your name, email address, user ID and agency name, and Intercom keeps the conversations you have with our support team.
• Vercel — Application hosting and content delivery (United States)
• Sentry — Error and performance monitoring (diagnostic data only; personal data, request contents, and credentials are removed before transmission, and user sessions are not recorded)

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Data retrieved from Google or Meta advertising and analytics APIs is used solely to display reporting to the account owner who authorized the connection, Gmail access is used solely to send the emails you choose to send and, if you turn on reading, to show you your own client email activity, and any other email you chose to include, as described above, and, if you turn on Drive search, to find and read the files you ask about. Google Calendar access is used only to show your meetings and to add or change an event when you confirm it, and Google Sheets access only to read the sheets you pick. We do not allow humans to read your Gmail or Drive data unless you ask us to for support and give your consent, it is needed for security purposes such as investigating abuse, it is needed to comply with applicable law, or the data is aggregated and anonymized for internal operations. It is never sold, never shared across customer accounts, never used for advertising targeting, and never used to train AI models.

We only share data with these services as necessary to provide the features you use. We do not sell your data to third parties.

3a. Connected Sales Channels (Product Planning)

If you connect a sales channel to Product Planning, we act as a service provider to you, the account holder. We process that data only to produce the forecasts, stock alerts and purchase recommendations you asked for. Specifically:

• What we read. Completed and pending orders, and your product or listing records including quantities available. Access is read-only — we never create, edit, or delete anything in your store.
• What we keep. Only aggregate figures per product per day: item identifier, date, units sold, and unit price. Alongside these, product names and images are stored so the planner is readable. Shopify is the exception: we keep each order’s details, with a pseudonymous customer key in place of the customer, as described under “Store data” in section 1.
• What we never keep. We do not store your customers’ names, email addresses, shipping addresses, payment details, or account identifiers. Buyer information is discarded as orders are processed and is never written to our database; for Shopify, the only values we keep that come from the customer are the pseudonymous customer key and the customer’s order count.
• Where it is stored and how it is secured. In our Supabase database on AWS, encrypted in transit and at rest, isolated per account. The access tokens for your connection are encrypted at rest and never exposed to your browser.
• Who it is disclosed to. Only the service providers that run Agency OS for you: Supabase and Vercel (storage and hosting) and, when you ask the Product Planning assistant a question, Anthropic, whose AI model answers it. Your data is not used to train AI models — not by Anthropic, whose commercial terms prohibit training on it, and not by us. Channel data is never sold, never shared between accounts, and never used for advertising.
• Your control. You may disconnect a channel at any time from the integrations settings, which immediately ends our access. You can also revoke access directly from the channel’s own security settings. On request we will delete the imported history — see “Your Rights and Data Deletion” below.

4. Data Storage and Security

Your data is stored securely using Supabase, hosted on Amazon Web Services (AWS), and the Service is delivered through Vercel. We implement industry-standard security measures including encryption in transit and at rest, row-level security policies, and access controls. OAuth tokens for connected platforms are encrypted at rest and are never exposed to your browser. We use Sentry for error monitoring; diagnostic events are scrubbed of personal data, request contents, and credentials before they are transmitted, and we do not record user sessions. However, no method of transmission over the internet is 100% secure.

5. International Data Transfers

Our Service and our sub-processors store and process data primarily in the United States. If you access the Service from outside the United States — including the United Kingdom, the European Economic Area, Australia, or New Zealand — your information will be transferred to and processed in the United States. Where required, these transfers are governed by Data Processing Agreements incorporating Standard Contractual Clauses (or equivalent safeguards). We process personal data in accordance with applicable data protection laws, including the UK GDPR, the EU GDPR, and the Australian Privacy Act 1988.

6. Legal Bases for Processing (UK/EU GDPR)

Where the UK GDPR or EU GDPR applies, we rely on the following legal bases under Article 6(1) to process personal data:

• Contract (Art. 6(1)(b)): to provide the Service under our Terms — creating and maintaining your account, operating the integrations you enable, and delivering the reporting and features you request.
• Consent (Art. 6(1)(a)): when you connect a third-party account via OAuth, you consent to our access to that data for the purposes described here. You may withdraw consent at any time by disconnecting the integration.
• Legitimate interests (Art. 6(1)(f)): to secure, maintain, and improve the Service, prevent fraud and abuse, and communicate with you about your account — balanced against your rights and freedoms.
• Legal obligation (Art. 6(1)(c)): where processing is necessary to comply with applicable law.

7. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you the right to know what personal information we collect and how it is used, to access or delete your personal information, to correct inaccurate information, and not to be discriminated against for exercising these rights. We do not sell or share your personal information as those terms are defined under the CCPA/CPRA, and we do not use sensitive personal information beyond what is necessary to provide the Service. To exercise any of these rights, contact us at support@agencythinktank.com.

8. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. If you close your account, we will delete your data within 30 days, except where we are required to retain it by law.

Client context retention. You choose how long Agency OS keeps raw client-context material — uploaded files, transcripts, synced history, superseded versions of assembled documents, and the stored copy of the context used for each AI generation. The default is to keep everything until you delete it. If you set a window in Settings → Profile, material older than the window is deleted when someone who can manage your agency’s settings reviews it there and presses Delete; Agency OS shows what will be removed first. This deletion does not run automatically on a schedule. Client profiles, protected notes, the relationship history and current-state summaries are not deleted by age, and neither is your record of what your team wrote or sent.

Legal hold. You can place a client under legal hold. While a hold is in place, that client’s context is excluded from retention deletion and from erasure requests, because information needed to establish, exercise or defend a legal claim is exempt from the right to erasure (UK/EU GDPR Article 17(3)(e); CCPA §1798.105(d)).

HighLevel notifications. Notifications HighLevel sends us as things happen, such as a new contact, are kept for 30 days and then deleted automatically.

9. Your Rights and Data Deletion

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Disconnect any third-party integrations at any time
• Export your data in a portable format

Client context: you are the controller. For the notes and summaries your agency keeps about your own clients, you decide what is collected and why, and Agency OS processes it on your instructions. If someone at one of your clients asks what you hold about them, or asks you to delete it, the tools are in the product: each client’s Profile tab has an export, and an erasure step that lists every section, marks which ones describe an identifiable person, and lets you choose exactly what to remove. Sections describing the company and the engagement — what you sold, what was agreed, the commercial terms, and the updates you sent — are not personal data about an individual and are kept unless you choose otherwise.

Information being personal data does not by itself require its deletion: the right to erasure applies in defined circumstances and is subject to exemptions, including information needed to defend a legal claim. Agency OS presents that choice rather than making it for you.

To exercise any of these rights, contact us at support@agencythinktank.com.

Deleting connected platform data: Disconnecting an integration in Settings → Integrations deletes our stored login for it straight away and, except as listed below, the data we synced from it (for example from Google Ads, Google Analytics, Search Console, Meta, Amazon Ads, TikTok Ads, Klaviyo, HighLevel, BrightLocal, Ahrefs, Moz, Microsoft Clarity and Recharge). For many platforms we also cancel our access at the platform itself; we do not when the same login is still connected elsewhere in Agency OS, such as in another agency or as a person’s calendar, because canceling it would disconnect that too. You can always remove Agency OS in the platform’s own settings as well. We keep your agency’s own setup for the platform, meaning which client each account belongs to and which accounts were switched on, so that reconnecting the same account restores it. Switching off a single account pauses it and keeps its history; deleting that history is a separate step in Settings. To delete anything we still hold, including what is listed below as kept, email support@agencythinktank.com with the subject “Data Deletion Request.” We delete it within 30 days and will confirm when complete.

• Accounting (Xero, QuickBooks, Wave, and your agency’s own Stripe): when you disconnect, we ask whether to keep the clients and expenses the connection created, as your own entries, or delete them. The financial data we synced is deleted. For your agency’s own Stripe, the same choice also covers your payment records, the monthly revenue built from them, and your paying customers’ names and email addresses: keep them, or delete them.
• Shopify and your clients’ own Stripe accounts: disconnecting ends our access but keeps the sales figures and order details already imported, because they are your clients’ trading record.
• Etsy and Faire: disconnecting ends our access but keeps the sales history already imported for Product Planning (see section 3a).
• Microsoft Clarity: removing one client’s Clarity token keeps that client’s history, because Clarity provides only the last few days and it could not be fetched again; disconnecting Clarity for your whole agency deletes it all.
• Meta: posts still scheduled to publish are canceled, and our record of posts already published is kept.
• Klaviyo: drafts already created in your Klaviyo account stay there, and your Email Engine work in Agency OS is kept.
• Hubstaff: the time already brought into your Time Tracker, and which Hubstaff people and projects match yours, are kept as your agency’s record of hours worked.
• Fathom and Fireflies: each person disconnects their own account and chooses whether to keep or delete the calls it brought in.
• Google Calendar and Outlook: each person disconnects their own calendar. Meetings already in your planner and matched to clients stay as part of your planner and client history. Disconnecting a Google calendar also deletes what we kept from that account’s Gmail (see Gmail below).
• monday.com and ClickUp: disconnecting your agency’s monday.com connection also deletes the items and people we copied from it; a personal monday.com or ClickUp disconnect deletes only that person’s login.
• Slack: disconnecting your workspace deletes the notes we made from channel messages and the assistant’s Slack conversations; call records made from Otter.ai notes are client context and follow the client-context rules above.
• Obsidian: revoking the plugin’s API key in Settings stops syncing. Notes already sent stay as client-context records, which follow your retention window and can be erased per client.

Figma: Disconnecting Figma deletes our stored access token, so Agency OS can no longer read your Figma files. Figma does not let apps cancel access on your behalf, so to remove Agency OS from your Figma account entirely, also remove it under Settings → Connected apps in Figma. Images already imported from Figma are copies used in your emails; when you disconnect, you can choose to delete them and your list of linked Figma files at the same time, or ask us to delete them using the request above.

Gmail: Turning off “Read my Gmail for client email” in Settings stops our reading and deletes every record we made from your Gmail straight away, except your own choices: your never-read list, the other email you chose to include, and addresses you said are not a client, kept so we do not ask again; you can remove them in Settings or with a deletion request. Google’s permission stays on your connected Google login until you disconnect it in Agency OS or remove Agency OS in your Google account, because Google removes a login’s permissions together (your calendar connection too); we no longer use it. You can also remove Agency OS from your Google account (myaccount.google.com › Security › Third-party apps and services); we then delete those records at our next daily check. Records of emails you sent through Agency OS are kept as part of your agency’s history unless you ask us to delete them using the request above.

Google Drive: Turning off “Search my Google Drive” stops our access straight away. We keep nothing from your Drive, so there is nothing to delete.

10. Cookies

We use cookies and similar technologies to maintain your session and preferences. We do not use cookies for advertising or tracking across third-party websites.

11. Children's Privacy

The Service is not directed to children under 18. We do not knowingly collect personal information from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice within the Service. Your continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy, please contact us at:

Licensing Unlimited LLC
Operating as Agency OS
Maryland, United States
support@agencythinktank.com