Privacy Policy

Introduction

InboundOS ("we," "us," "our," or "Company") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our services, and interact with us across all channels.

InboundOS provides AI system installation, automation building, and consulting services for solo digital agency owners. We are operated by Micko Cruz, based in the Philippines, with global service availability.

Please read this policy carefully. If you do not agree with our practices, do not use our services.

Information We Collect

Application & Inquiry Forms:

• Full name, business name, email address, phone number
• Current monthly revenue and business stage
• Description of business model, pain points, and goals
• Preferred contact methods and availability

Payment & Billing Information:

• Name, billing address, email address
• Payment method details (processed securely via Stripe; we do not store full card numbers)
• Invoice records and transaction history

SMS & Communication Opt-Ins:

• Phone number and explicit consent timestamp for SMS messaging
• Email preferences for newsletters, updates, and promotional content
• Instagram DM interaction history (when you reply to our Hermes agent)

Instagram Direct Messages:

• Conversation content when you initiate or reply to Instagram DMs from @inboundOS
• Public profile information visible to followers (name, profile photo, bio)
• Your Instagram ID and username

Website Analytics & Usage Data:

• IP address, browser type, operating system, and device information
• Pages visited, time spent, referral source, and click patterns
• Cookies and similar tracking technologies (see Section 9)

Service Delivery & Communication:

• Meeting transcripts, notes, and recordings (if you consent to recording)
• Project details, deliverables, and feedback
• Email correspondence and chat logs with our team

How We Use Your Information

Service Delivery & Support:

• Providing AI system installation, automation setup, and consulting services
• Creating customized workflows, n8n automations, and agent configurations specific to your business
• Responding to inquiries and providing customer support
• Scheduling calls, deliverables, and project milestones

Communication & Outreach:

• Sending service updates, project progress, and delivery confirmations
• Following up on leads via SMS (if opted in), email, or Instagram DM
• Sharing educational content, case studies, and relevant industry insights
• Requesting feedback and testimonials post-engagement

AI Processing & Content Generation:

• Processing your business information with Claude (Anthropic) AI to generate customized scripts, workflows, and automation designs
• Creating email sequences, cold outreach templates, and DM copy tailored to your ICP
• Building n8n automation logic and API integrations based on your operational needs

Analytics & Business Improvement:

• Analyzing website traffic and user behavior to improve site functionality and user experience
• Tracking conversion funnels, form submissions, and inquiry sources
• Measuring the effectiveness of our marketing and service delivery

Fraud Prevention & Legal Compliance:

• Preventing fraud, unauthorized access, and security breaches
• Complying with applicable laws, regulations, and legal requests
• Maintaining records for accounting, tax, and legal purposes

Instagram DM Data & Hermes Agent

How It Works: When you send a direct message to @inboundOS on Instagram, our Hermes agent (an AI qualification system) reads your message to determine if your business profile and goals align with our service offering.

What We Collect: The content of your DM, your Instagram profile information (publicly visible), and your response patterns.

What We Do With It: Hermes uses your DM content to qualify leads, route inquiries to the appropriate team member, and personalize follow-up communications. Your data is used to assess fit with InboundOS services and determine next steps.

Data Storage: DM conversations are stored in our internal systems for a minimum of 90 days post-engagement for reference, dispute resolution, and analytics. Longer retention may apply if a service agreement is executed.

Third-Party Access: Hermes is an internal system operated by InboundOS. Your DM data is not shared with third parties except as required for payment processing (e.g., Stripe for invoicing) or legal compliance.

Your Control: You can delete DMs at any time from Instagram. To request deletion of stored data from our systems, email mickocruz333@gmail.com.

AI Processing & Claude Integration

How We Use AI: InboundOS uses Claude (an AI model made by Anthropic) to process your business information and generate customized deliverables, including automation workflows, email scripts, cold outreach sequences, and agent configurations.

What Information Is Processed: Your business name, revenue, pain points, goals, target customer profile (ICP), and operational details may be sent to Anthropic's Claude API to generate relevant content.

Anthropic's Privacy Practices: Anthropic operates under its own privacy policy and terms of service. API data sent to Claude may be retained for security, abuse prevention, and service improvement purposes, subject to Anthropic's policies. Review Anthropic's Privacy Policy for details.

Sensitive Data: We do not send your payment information, full name, or personal contact details to Claude unless absolutely necessary for generating a specific deliverable. You can request data not be sent to AI systems by noting this in your service agreement.

Your Consent: By engaging our services, you consent to the processing of your business information with AI systems to deliver customized workflows and content.

SMS Messaging & TCPA Compliance

Opt-In & Consent: We send SMS messages only to numbers where we have received explicit, documented consent. All opt-in timestamps and confirmation records are maintained in our database. Compliance with the Telephone Consumer Protection Act (TCPA) is a legal requirement we strictly follow.

Message Content & Frequency: SMS messages include service updates, project confirmations, lead qualification follow-ups, educational content, and promotional offers related to InboundOS services. Message frequency varies based on your engagement level and preferences.

Opt-Out & STOP: To unsubscribe from all SMS messages, reply "STOP" to any message. We will send a final confirmation within 24 hours and cease all messages. You may re-opt-in at any time by providing explicit written consent.

Support & HELP: Reply "HELP" to any SMS to receive assistance. You can also contact us directly at mickocruz333@gmail.com for SMS support inquiries.

Carrier Rates & Delays: Standard SMS and data rates may apply based on your mobile carrier plan. Carriers are not liable for delayed, undelivered, or incorrectly delivered messages. InboundOS is not responsible for carrier-side failures.

Data Sharing: Your phone number and SMS consent data are not shared with third parties for marketing purposes. SMS providers used for message delivery operate under confidentiality agreements and are strictly limited to message transmission functions.

Third-Party Sharing & Data Processors

We Do NOT Sell Your Data: InboundOS does not sell, rent, trade, or lease your personal information to third parties for marketing purposes under any circumstances.

Permitted Third-Party Sharing:

• Stripe (Payment Processing): Payment information is transmitted securely to Stripe for transaction processing, invoicing, and fraud prevention. Stripe operates under its own privacy policy.
• Supabase (Database): Your application form data, leads, and service records are stored in Supabase, a secure cloud database provider. Supabase is bound by strict data protection and confidentiality agreements.
• Vercel (Web Hosting): Our website and application are hosted on Vercel (US-based). Vercel processes website analytics and usage data; refer to Vercel's privacy policy for details.
• n8n (Automation Platform): If you authorize us to build automations in n8n, your workflows and data mappings may be stored on n8n servers (hosted in the US). n8n is bound by confidentiality agreements.
• Anthropic (Claude API): Business information may be sent to Anthropic's Claude API for content generation (see Section 5).
• SMS Providers: Your phone number is shared with SMS delivery providers solely for message transmission. These providers are bound by service agreements prohibiting use for any other purpose.
• Instagram / Meta: When you interact via Instagram DM, Meta processes this data per Instagram's privacy policy. We do not control Meta's data practices.

Legal & Compliance: We may disclose your information when required by law, court order, government request, or to establish, exercise, or defend legal claims.

Business Transfers: If InboundOS is acquired, merges with another entity, or assets are sold, your information may be transferred as part of that transaction. We will provide notice of such changes and any material modifications to this policy.

Data Security & Storage

Security Measures: InboundOS implements industry-standard security practices, including encryption of sensitive data in transit (HTTPS) and at rest (database encryption), secure access controls, regular security audits, and breach notification protocols.

Data Location: Your data is primarily stored on US-based servers (Supabase, Vercel, Stripe). If you are located in the European Union, UK, or other regions with data protection laws, your data transfer to the US is necessary to provide services. By using InboundOS, you consent to this transfer.

Limitations: While we use commercially acceptable security methods, no transmission over the internet is 100% secure. We cannot guarantee absolute security against unauthorized access, interception, or data loss. You assume some risk by sharing information with us.

Breach Notification: If a security breach occurs that compromises your personal information, we will notify you via email or phone within 30 days, as required by applicable laws.

Cookies & Tracking Technologies

What Are Cookies? Cookies are small files stored on your browser that remember your preferences and behavior. We use cookies to analyze website traffic, remember login information, track user journey, and measure the effectiveness of our marketing and services.

Types of Cookies We Use:

• Functional Cookies: Enable core site functionality (login, form submission, page navigation)
• Analytics Cookies: Track website performance and user behavior (page views, time on site, referral source)
• Marketing Cookies: Track conversion funnels and campaign effectiveness

Third-Party Cookies: We may use third-party analytics providers (e.g., Vercel Analytics) that set cookies on your device to measure site performance.

Your Control: You can disable cookies in your browser settings, but this may limit site functionality. Most browsers allow you to clear cookies and manage cookie preferences at any time.

Data Retention & Deletion

Retention Periods:

• Application & Inquiry Forms: Retained for 90 days after your last engagement (inquiry date, last communication, or service completion). Deleted automatically thereafter unless a service agreement is executed.
• Payment & Billing Records: Retained for 7 years for tax, accounting, and legal compliance (IRS and other regulatory requirements).
• SMS Opt-In Records: Retained for 3 years to document TCPA compliance and consent.
• Email Communications: Retained for 1 year from last communication. Longer if required for legal or service purposes.
• Instagram DM Data: Retained for minimum 90 days post-engagement. Longer if service agreement exists.
• Website Analytics: Raw analytics data retained for 13 months; aggregated insights retained indefinitely.

Right to Deletion: You can request deletion of your personal data at any time by emailing mickocruz333@gmail.com. We will comply within 30 days, except where data retention is required by law (payment records, tax compliance) or is necessary to fulfill service obligations.

Right to Correction: You can request correction of inaccurate information at any time.

Your Privacy Rights & Choices

Access: You have the right to request and receive a copy of all personal data we hold about you.

Correction: You can request we correct or update inaccurate information.

Deletion: You can request deletion of your data, subject to legal retention requirements.

Opt-Out of Communications:

• Email: Unsubscribe link included in every promotional email
• SMS: Reply "STOP" to any message
• Instagram DM: Block @inboundOS or request deletion via email

Do Not Track: If your browser sends a "Do Not Track" signal, we will honor it and limit tracking technologies accordingly.

Exercising Your Rights: To exercise any of these rights, email mickocruz333@gmail.com with "Privacy Request" in the subject line. Include your name, email, and the specific action you request. We will respond within 30 days.

Children's Privacy

InboundOS services are intended for business owners aged 18 and older. We do not knowingly collect data from children under 13. If we become aware that a child under 13 has provided data, we will delete it immediately. If you believe a child has submitted information, contact us at mickocruz333@gmail.com.

Third-Party Links & External Services

Our website may contain links to external websites, social media platforms, and third-party services. This Privacy Policy applies only to information collected by InboundOS. We are not responsible for the privacy practices of external sites. Review the privacy policies of any third-party services you access through our site before providing personal information.

International Users & GDPR

If you are located in the European Union, United Kingdom, or another jurisdiction with data protection laws (e.g., GDPR, CCPA), your data will be processed in accordance with those laws to the extent applicable. However, because our services are primarily operated from the Philippines and data is stored on US servers, your data will be transferred internationally. By using InboundOS, you consent to this transfer.

GDPR Rights (EU/UK Users): If GDPR applies, you have additional rights including data portability and the right to lodge complaints with your local data protection authority.

Changes to This Privacy Policy

InboundOS may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The effective date will be updated at the top of this page. Significant changes will be communicated via email or prominent website notice. Your continued use of our services after any changes constitutes your acceptance of the updated policy.

Contact Us

InboundOS Privacy Team
Email: mickocruz333@gmail.com
Operator: Micko Cruz
Instagram: @inboundOS

For privacy questions, data requests, deletion requests, or complaints, please contact us using the email above. We will respond within 30 days.