Privacy Policy
Privacy
DavidAgents is operated by JDMTECHSOLUTIONS LLC dba DavidAgents. This policy describes how we collect, use, and protect your data across our public site, apps, and services. Last updated October 12, 2026.
What we collect. We collect user data — specifically: contact and account information you provide (name, organization, email, phone); the content of communications you have with us or with our AI agents (messages, emails, call recordings and transcripts where enabled); files and documents you upload or share with the service; usage and device information (pages visited, actions taken, IP address, browser type); and payment records processed by our payment provider (we never store card numbers). We collect it when you submit a form, sign up, communicate with us on any channel, or use the products. We use it to provide and improve the service, follow up on your inquiries, keep consent and compliance records, and meet legal obligations — and for nothing else without asking.
Lead forms collect the information a visitor chooses to submit, such as name, organization, email, phone, preferred contact method, and automation request. Submissions route to governed internal systems for sales follow-up, delivery planning, consent records, and service improvement.
When you request access to AgentsFast, we also keep the name of the website that linked you to us (the site's name only, never the page you were on) and any campaign labels in the link you followed, so we can learn where owners hear about us. We use browser storage for the current tab session, rather than cookies, to carry these labels to your access request.
How we use AI. Our products are built on artificial intelligence: AI agents read and write messages, answer and place phone calls, draft documents, and act on your requests. That means data you share with us — messages, call audio and transcripts, documents, account context — is processed by AI systems to produce the service you asked for. Some of that processing happens on AI models hosted by third-party providers under the terms below; some happens on models we run on our own infrastructure. We do not use your data to train AI models. Our AI model providers (Anthropic, OpenAI and Cerebras) do not use API content for training by default, and we have turned off ElevenLabs' use of our content for training. Telnyx's terms do not allow it to use call content to train AI models for others, except in de-identified form. Telnyx keeps the conversation records of calls to our company and demo lines for up to 30 days, then we delete them. On the Ultra Accurate plan, Telnyx keeps no conversation records; your callers' conversations stay only in your own records with us. If your agents browse the web, we keep a recording of what they see (screenshots and page addresses) in your own files for 3 days, unless you choose to keep it. A short record of each session (its first page address and title) stays with us for 90 days. Where an AI agent takes an action with real-world effect, it operates inside a policy-and-compliance gate with an auditable record.
Third-party processors. We send data to third-party processors only as needed to run the service: Cloudflare (network delivery, storage), Anthropic (AI models), OpenAI (realtime voice and AI models) and Cerebras (AI models), for agent reasoning over the content you send, Telnyx (telephone calls and text messages, and Telnyx's AI voice service: speech recognition with Deepgram's or OpenAI's Whisper speech model, run by Telnyx on its own servers, and Telnyx's own voice, which answers calls to our own company line and calls on our Ultra Accurate voice plan), Stripe (payments), and ElevenLabs (speech recognition and voice). Each receives only what its function requires, under its own data-processing terms, and none may use your data for their own marketing. When you use the features that need them, we also send what the feature requires to fal.ai (image and video generation), Dropbox, Telegram, Dynadot (domain registration), and, for online stores, Printify, ShipEngine, 17TRACK, and Google Merchant Center. Google (Gmail) also receives copies of the email sent to several of our addresses, including our support, contact, abuse and copyright (DMCA) addresses. Everything else runs on infrastructure we operate ourselves.
SMS consent is not combined with email or phone-call consent. SMS opt-in is collected only through an explicit checkbox, and SMS sends remain governed by consent, approved-recipient proof rules, 10DLC campaign controls, and STOP/HELP handling. Mobile opt-in data will not be sold, rented, or shared for third-party marketing.
Call recording & transcription. When call recording is enabled for a contact, phone calls between you and DavidAgents (whether placed by a human team member or by one of our AI voice agents) are recorded as mp3 audio files and transcribed to text. The recording and transcript are stored on your record in our CRM and are visible to our team and to AI agents that have been authorized for your account. Recording is used for service quality, training, dispute resolution, and to help our team and AI agents remember the context of prior conversations so you don't have to repeat yourself.
Recording is optional and configurable. We capture your consent at sign-up, on your tokenized preferences page (linked in every email and SMS we send), and verbally when you take an AI-driven call (we disclose at the start of the call when we don't already have your consent on file). You can change your mind at any time by saying so on a call, replying to an SMS or email, or visiting your preferences page. If you decline, calls still happen — we just don't record them. Recordings are retained for as long as the related CRM record is active and are not sold, rented, or shared for third-party marketing.
How we protect your data. We apply layered safeguards to all personal data, and additional care to sensitive data — including authentication credentials, OAuth tokens and API keys, call recordings and transcripts, message content, and any personal data we receive from platforms such as Google or Meta. In transit: our websites redirect every visit to an encrypted connection (HTTPS), and all data moving between you, our services, and third-party APIs is encrypted with TLS (HTTPS); internal service-to-service traffic runs over private, access-controlled networks. At rest: data is stored on infrastructure we operate ourselves, except files kept with Cloudflare and the copies of email that Google receives, as listed under Third-party processors; platform secrets — credentials, API keys, and signing keys — are managed in a dedicated encrypted secrets vault and are never committed to source code. Access tokens for social accounts you connect to our publishing tools (for example YouTube or TikTok) are stored in that feature's database on encrypted, access-controlled storage we operate. Access controls: access to systems and data requires authenticated identity through our single-sign-on provider and is granted on a least-privilege basis; each customer's data is isolated so one customer can never read another's; automated agents operate under scoped, per-agent credentials that limit what each can reach. Operational safeguards: outbound actions and messages pass a policy-and-compliance gate before they execute, sensitive values are redacted from logs and agent outputs, and access is auditable. Retention & deletion: we keep personal and sensitive data only as long as needed to provide the service or meet a legal or billing obligation, and delete it on request as described under Data deletion. No method of transmission or storage is perfectly secure, but these measures are designed to protect your data against unauthorized access, disclosure, alteration, and loss.
Google user data (YouTube connections). If you connect a YouTube channel to our social publishing tools, we request only the narrow Google permissions needed to operate the feature: your basic profile and email address (to identify the connecting account), read-only access to your channel and video metadata (to show your channel name, picture, and the status of posts we published), permission to upload videos and set thumbnails (to publish the content you schedule), and read-only YouTube Analytics (to show you how your own posts performed). Access: we access your channel identity, the metadata of videos we publish for you, and per-video/per-channel analytics metrics. Use: this data is used solely to provide the publishing and reporting features you see in the product — connecting your channel, publishing the posts you schedule, and displaying your own post performance back to you. Transfer: we do not sell or rent Google user data or share it for advertising. We store it on infrastructure we operate, except a copy of your channel picture kept in our Cloudflare file storage, and send it to Google's own APIs to perform the actions you request. When you ask an AI employee to work with your YouTube channel, the channel details and your own performance figures that request needs are sent to the AI model provider that runs it, to carry out that request; How we use AI explains how those providers handle it. Protection: OAuth tokens are stored encrypted on access-controlled servers we operate, transmitted only over TLS, and are never exposed to other customers. Retention & deletion: tokens and cached channel data are kept only while your channel remains connected; disconnecting the channel in the product, requesting deletion (see below), or revoking access in your Google security settings removes our access, and we delete stored tokens and cached Google data within 30 days. AI/ML: we do not use Google user data to develop, improve, or train AI or machine-learning models. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
TikTok connections
If you connect a TikTok account to our social publishing tools, you approve the requested permissions on TikTok's own screen.
Access and purpose. We read your account identifier, display name, username and profile picture to show which account is connected. We read account and video engagement counts for analytics. The Connect Post feature lists recent public videos and their cover images so you can match a video to a post in the product. Publishing permissions let us send the photos or videos you review and approve, with the caption, settings and schedule you choose. The inbox-upload option sends a draft to TikTok for you to finish there.
Stored information. We save the connected account's identifier, display name and username; a copy of its profile picture in our Cloudflare file storage; and its access and refresh tokens in the social publishing database on encrypted, access-controlled storage we operate. We also save the posts you create, their media and chosen settings, publishing request and post identifiers, links, delivery status, and provider error responses needed to troubleshoot failed attempts. Uploaded social media files are kept in our Cloudflare file storage.
Analytics and AI features. The publishing feature temporarily caches analytics figures for up to an hour. Figures may also be included in chats or reports you request or configure; those follow the retention rules for that content. When you use or configure an AI employee to work with your social accounts, the account profile details, post content and performance figures needed for that work may be processed by the AI systems and providers described under How we use AI. We do not sell TikTok data, share it for third-party marketing, or use it to train AI models.
Disconnecting and deletion. Removing the channel in the product disables further publishing through that connection and erases the access and refresh tokens from its connection record. Routine maintenance then removes its profile details, any stored profile-picture copy that is no longer in use, its analytics caches, and provider-returned post identifiers, links and failure details held with its publishing records. Failed cleanup operations are retried. Posts, media, chats and reports you created follow their own lifecycle; you can request their deletion through the routes under Data deletion. Removing the channel in our product does not revoke the permission on TikTok's side; you can revoke that in your TikTok account settings.
Government & public authority data requests. Requests from government or public authorities for personal data — including data we receive from platforms such as Meta or Google — are governed by our Government Data Request Policy: every request undergoes a required legality review before any response; we narrow or challenge requests that are unlawful or overbroad; when disclosure is lawfully compelled we disclose only the minimum data necessary; and we document every request, our legal reasoning, and our response. Where lawful, we notify affected users before disclosure. To date we have received zero such requests, including national security requests.
Retention. We keep your data while your account or engagement is active, and delete it on request as described below. Some records we keep even after an account closes or a deletion request, and we use them only for the reason we keep them: the record of your acceptance of our Terms and this Privacy Policy (which version, when, and the IP address and browser it came from) and any signing authorization you gave us, while your account is open and for six years after it closes; billing and tax records, as long as tax law requires; and content and account records we hold, remove, or report, or are asked by law to preserve (see “Preservation” in our Terms), for as long as the law requires or allows, and for any investigation, dispute, or legal proceeding, even where a deletion request would otherwise remove them. We do not have to tell you before we make a report or disclosure, and the law may forbid us from telling you. The six-year period applies to acceptance records created on or after October 9, 2026; records created before then keep the deletion terms of the version of this policy in force when they were created, unless you agree otherwise.
Data deletion. You can request deletion of your personal data at any time — including data collected through our website, lead forms, calls, SMS, or social platform integrations (such as Facebook or Instagram lead forms and logins). To request deletion, email privacy@davidagents.ai from the address on file, reply DELETE to any SMS from us, or say so on any call — an agent or team member will confirm and process it. An account owner can also request deletion of the account and its data at agentsfast.ai/delete-account. We delete your CRM record and the associated recordings and transcripts within 30 days. We keep the records described under Retention, and a minimal record of any consent you gave us or any request not to be contacted, for as long as we may need to prove it and so that we never contact you against your wishes. We keep other data longer only where a legal or billing obligation requires it, and we tell you if so, except as described under Retention. Facebook/Instagram users: this page is our data deletion instructions URL — the request routes are the same.