Privacy Policy

Shop users (owners, admins, reps) sign in to run campaigns. Merchants receive texts and may upload bank statements or connect an account through a collection link. This policy covers both, with the notes below where they differ.

Account and shop data. Name, email, password hash, shop name, role, notification preferences, and the phone numbers and agent configuration your shop stores in Bullpen.

Merchant and campaign data. Contact lists you import (name, business, phone, tags, consent notes), thread history, offers and terms your team enters, suppressions, and audit events.

Statements. When a merchant uploads PDFs or connects a bank through our statements provider (currently Plaid in production when configured), we store the files or tokens needed to parse them and keep a redacted underwriting summary for the shop. Raw statement files are stored in object storage, not in the conversation body.

Message metadata. Delivery status, channel (iMessage / SMS), line health, and provider ids from our messaging vendors. We do not sell message content.

Technical data. IP address, device/browser, request ids, and coarse location inferred from IP for security, rate limits, and quiet-hours. If you enable error monitoring, crash reports may include truncated request context with secrets redacted.

We use this information to:

• Operate the workspace, agents, and messaging you configure
• Authenticate users, enforce shop isolation, and prevent abuse
• Collect statements, summarize them for underwriting, and surface deals that need terms
• Send product emails or SMS you opt into (invites, identity holds, needs-terms alerts)
• Debug outages and improve reliability

We do not sell personal information. We do not use merchant statement contents to train foundation models.

We use vendors to run the product. Depending on your environment that can include hosting and edge (Vercel), database (Neon / Postgres), object storage for statements, email, SMS/iMessage providers (Sendblue, Blooio, or a mock in development), bank linking (Plaid), and the LLM used to draft agent replies (Anthropic, reached directly or through Vercel AI Gateway). Those vendors see only what they need to perform that job, under their own terms.

Your shop is the sender of merchant outreach. You are responsible for having a lawful basis (including TCPA consent where it applies) before a number is texted. Bullpen stores the consent fields you import and honors STOP / opt-out on the lines we operate. We do not buy or append consumer lists for you.

Shop data stays until you delete the shop or ask us to erase it, except records we keep for security, billing disputes, or legal holds. Opt-out / suppression rows are kept so we do not text that number again. Statement objects follow the retention of the shop unless you delete the prospect or file.

Shop users can update profile and notification settings in the app, export shop audit evidence, and request deletion of an account through their shop owner. Merchants can opt out of texts by replying STOP on the thread. California and similar-state residents can request access, deletion, or correction of personal information we hold through their shop owner. We will not discriminate for exercising those rights.

Access is session-based, scoped to the shops you belong to. Secrets stay in environment configuration, not in git. We redact tokens and statement payloads in application logs. No method of transmission is perfectly secure; report issues through your shop owner.

Bullpen is a B2B product for MCA shops. It is not directed at children under 16, and we do not knowingly collect their data.

If we change this policy in a material way we will update the date above and, when the change is significant, notify shop owners by email or in the product.

Questions about this policy: bullpen@aegisos.cc.