Privacy Policy

1. Introduction

Tuco.ai ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website tuco.ai, use our services, or interact with us. Please read this Privacy Policy carefully. If you do not agree with the terms of this Privacy Policy, please do not access or use our services.

2. Who This Policy Covers — Your Role and Ours

This Policy covers two different groups, and the difference matters because it decides who is responsible for what.

2.1 Customers

Businesses and agencies that pay for and use the Service to message their own contacts. For your own account data — your name, email, billing details, usage of our dashboard and website — we are the controller, and this Policy describes what we do with it.

2.2 Message recipients

The people a Customer messages. They never signed up with us. For their data — phone numbers, message content, consent records, anything a Customer imports or syncs — the Customer is the controller and we are the processor, acting on the Customer's instructions. We do not decide who gets messaged, we do not write the messages, and we do not use recipient contact data to market anything of our own. See Section 7.

If you are a recipient trying to stop messages, Section 7 tells you the fastest route.

3. Information We Collect

3.1 Information You Provide to Us

We collect information that you provide directly to us, including:

• Account Information: Name, email address, phone number, company name, and billing information when you create an account or subscribe to our services.
• Contact Information: Email addresses, phone numbers, and other contact details when you communicate with us, request support, or subscribe to our newsletter.
• Payment Information: Credit card details, billing addresses, and payment history processed through our third-party payment processors.
• Content and Messages: Messages, content, and data you send through our iMessage automation platform, including customer contact information and message content.
• Integration Data: Data from third-party services you connect to our platform (e.g., Shopify, CRM systems, email platforms).

3.2 Information We Collect Automatically

When you use our services, we automatically collect certain information, including:

• Usage Data: Information about how you interact with our services, including pages visited, features used, time spent, and actions taken.
• Device Information: IP address, browser type, operating system, device identifiers, and mobile network information.
• Log Data: Server logs, error reports, and diagnostic information.
• Cookies and Tracking Technologies: We use cookies, web beacons, and similar technologies to track activity and store preferences. See our Cookie Policy for more details.

3.3 Sensitive personal information — notice at collection

Some of what we collect is "sensitive personal information" under the California Consumer Privacy Act as amended ("CCPA"). Specifically:

• your account log-in credentials; and
• the contents of the messages sent and received through the Service.

We use sensitive personal information only for the business purposes of providing, maintaining, securing, and supporting the Service, and for abuse prevention. We do not use or disclose it to infer characteristics about anyone. California residents may have the right to limit its use — see Section 20.1.

3.4 Information from Third Parties

We may receive information about you from third-party services you integrate with our platform, such as:

• E-commerce platforms (e.g., Shopify) for order and customer data
• CRM systems for contact and lead information
• Email marketing platforms for subscriber lists
• Social media platforms when you connect your accounts

4. How We Use Your Information

We use the information we collect for the following purposes:

• Service Delivery: To provide, maintain, and improve our iMessage automation services, process transactions, and deliver customer support.
• Communication: To send you service-related notifications, updates, security alerts, and administrative messages.
• Marketing: To send you promotional communications, newsletters, and marketing materials (with your consent, where required by law).
• Analytics: To analyze usage patterns, monitor performance, and improve our services and user experience.
• Security: To detect, prevent, and address fraud, security breaches, and other technical issues.
• Line health and ban diagnosis: To read and review message content, links, attachments, and conversation history in order to protect the health of sending lines, investigate and diagnose bans, junk reports, and delivery problems, and enforce our Terms of Service, as described in Section 6.1.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, and enforce our Terms of Service.
• Business Operations: To manage our business operations, conduct research, and develop new features and services.

5. How We Share Your Information

We may share your information in the following circumstances:

• Service Providers: We share information with third-party service providers who perform services on our behalf, such as payment processing, data storage, analytics, and customer support.
• Business Transfers: In connection with any merger, sale of assets, or acquisition, your information may be transferred to the acquiring entity.
• Legal Requirements: We may disclose information if required by law, court order, or government regulation, or to protect our rights, property, or safety.
• With Your Consent: We may share information with third parties when you explicitly consent to such sharing.
• Aggregated Data: We may share aggregated, anonymized data that cannot identify you individually for research, analytics, or marketing purposes.

We do not sell your personal information to third parties for their marketing purposes.

5.1 Who we actually use

Our current subprocessors and service providers, and what each one touches:

• Apple — transmits iMessage content and holds the Apple ID for each line (Section 6).
• AT&T and other telecommunications carriers and SMS aggregators — carry SMS and provision the eSIM for each line.
• Vercel and Railway — application hosting. Vercel Blob and UploadThing — attachment storage.
• MongoDB Atlas — primary database. Redis — queues and job state.
• Clerk — authentication. Stripe — subscription payments; we never see or store your full card number.
• Anthropic and OpenAI — AI features (Section 13).
• PostHog — product analytics. Grafana Loki — application logs.
• LogRocket and Microsoft Clarity — website session replay and heatmaps. FingerprintJS and Cloudflare Turnstile — bot and abuse prevention. See Section 16.
• Crisp — support chat and help centre.
• CRM and automation platforms you choose to connect — for example HubSpot, GoHighLevel, Zapier, n8n, or Make.com. Those receive data at your direction and under their own policies.

We will provide a current subprocessor list on written request to privacy@tuco.ai.

5.2 SMS and text-messaging opt-in data

We do not sell, rent, or share mobile phone numbers, SMS or text-messaging opt-in information, or messaging consent with any third party or affiliate for their own marketing or promotional purposes.

Text-messaging opt-in data and consent are excluded from every sharing category described above. That information goes only to the carriers, aggregators, and service providers strictly necessary to transmit and deliver the messages, and those providers are contractually barred from using it for their own marketing.

5.3 "Sale" and "sharing" under state law

We do not sell personal information for money. Some of the website analytics and session-replay activity described in Section 16 may nonetheless count as a "sale" or "sharing" for cross-context behavioural advertising under the CCPA and similar state laws. Section 20.1 explains how to opt out. Message content and recipient data are never involved in that activity.

6. Where the Service Runs — Apple Devices and Our Fleet

This is unusual enough that it deserves its own section: the Service does not run purely in a cloud. Every iMessage line is backed by a physical Apple device in a data centre we control.

Each line is a real iPhone or Mac, with its own Apple ID that we provision, and its own carrier eSIM, racked in a Tier 3+ data centre in the United States. That has concrete consequences for your data, and we would rather state them than let you assume otherwise:

• Message content passes through, and is stored on, that physical device as part of normal operation, in the device's own local message database, in addition to our own systems.
• Apple processes your message content. iMessage is Apple's service. Sending an iMessage means Apple transmits it, and Apple's handling of that content is governed by Apple's own terms and privacy policy, not ours. The same applies to the Apple ID associated with a line.
• iMessage is end-to-end encrypted between devices by default, but we cannot promise message privacy. When a recipient reports a conversation as junk, that protection lifts and Apple may review the thread's history. We also store message content ourselves in order to run the dashboard, search, analytics, and abuse prevention.
• Where a message is sent as SMS instead — which happens when a recipient is not reachable on iMessage — it is carried by telecommunications carriers and aggregators in the clear, under their handling, with no end-to-end encryption at all.
• Encryption keys on each device sit in the Apple Secure Enclave. Data at rest in our own systems is encrypted with AES-256, and data in transit with TLS 1.3.

Do not send anything through the Service whose disclosure would be materially harmful. Never send protected health information, payment card data, government identifiers, or credentials.

6.1 We read messages to protect line health and diagnose bans

Tuco reserves the right to access, read, and review any message sent or received through the Service, including its text, links, attachments, voice notes, reactions, conversation history, contact details, delivery and read status, and the related logs on our systems and on the Apple device behind the line. We do this to:

• Protect the health and standing of sending lines, Apple IDs, phone numbers, and our shared infrastructure with Apple and the carriers;
• Investigate and diagnose a ban, restriction, junk or spam report, delivery degradation, or a protection state on a line;
• Detect and prevent spam, abuse, prohibited content, and violations of our Terms of Service;
• Troubleshoot the Service and answer support requests; and
• Comply with law, legal process, or a request from Apple or a carrier.

Review may be automated (for example, classifiers and pattern checks run across message traffic) or carried out by authorised Tuco personnel and contractors who are bound by confidentiality. It may happen proactively, not only after a problem. We may open, follow, and fetch links contained in messages — including following redirects — to check where they lead and whether they are flagged; a link visited this way may register as a click or visit in the link owner's or a tracking tool's analytics.

We are not required to notify you before or after a review. What we find may lead us to pause, slow, or restrict a line, block or remove content or links, or suspend an account, as set out in our Terms of Service. We may use what we learn, in aggregated or de-identified form, to improve the protections that keep lines healthy. We never use message content reviewed this way to market to you or to your recipients, and we do not sell it.

7. Message Recipients

When a Customer sends messages through the Service, we necessarily process information about the people receiving them — phone numbers, message content, delivery and read status, timestamps, attachments, and anything the recipient shares back in the conversation, such as a name. Recipients did not sign up with us.

We process recipient information only to:

• Deliver the messages the Customer sends;
• Give the Customer conversation history, delivery status, and dashboard features;
• Operate, secure, and improve the Service, including detecting and preventing spam and abuse;
• Read and review conversations, including links, to protect line health and diagnose bans and delivery problems (Section 6.1);
• Comply with our legal obligations.

We do not sell recipient data, we do not rent it, and we never use a Customer's recipient list to market our own products to those people.

Each Customer warrants in our Terms of Service that it has the consent or established business relationship required before contacting anyone, and must keep records proving it.

7.1 If you received a message and want it to stop

Reply to the message and say so — STOP, UNSUBSCRIBE, or plain language like "stop texting me". You do not have to use a particular word. When you do, our platform automatically adds your number to a Do-Not-Disturb suppression list and will not send you further messages from that sender, and the sender cannot override or delete that entry. That is enforced by us, not left to the sender's goodwill. The sender is separately obliged under our Terms to suppress you within one business day.

One limit worth knowing: we can only act on an opt-out that passes through our platform. If you asked the sender to stop by phone, email, a web form, or in person, we never saw it — that request is the sender's to honour, and the fastest fix is to also reply STOP to the message itself.

If a sender ignores an opt-out, or you believe messages sent to you break the law or our Terms, report it to legal@tuco.ai and we will investigate. We can suspend a sender's lines. You may also ask us directly to delete information we hold about you by writing to privacy@tuco.ai; where we hold it as a processor on a Customer's behalf, we will route your request to that Customer and tell you we have done so.

8. Your Responsibilities as a Customer

Because you are the controller of your recipients' data (Section 2.2), several obligations are yours and not ours. By using the Service you agree that you will:

• Obtain and document consent — or a lawful established business relationship — before messaging anyone, and keep records that prove it. See Section 11 of our Terms.
• Tell your own contacts what you collect and why. If you need a privacy policy of your own to do that lawfully, publish one. We cannot do this for you, and your recipients will look to you, not to us.
• Honour data-subject requests from your recipients — access, correction, deletion, opt-out — and give them a way to make them.
• Honour every opt-out across every line in your account, within one business day and before your next send.
• Secure your own access. Protect your credentials, API keys, and webhook secrets, and tell us at security@tuco.ai within 24 hours of discovering any compromise.
• Tell us about a breach on your side that affects data processed through the Service, promptly, so we can help contain it, and notify affected individuals and regulators where the law requires you to.
• Comply with messaging law — including the TCPA, CAN-SPAM, state telemarketing and consent statutes, CTIA guidance, and carrier and platform rules. You, not we, determine whether your use is person-to-person, application-to-person, or something else, and you carry the consequences of that determination.
• Never send prohibited categories — above all, no protected health information. See Section 14.

We provide tools, documentation, caps, and safety controls to support compliant use. We do not assume your compliance obligations, and we are not responsible for your data-handling practices toward your own contacts.

9. Data Security

We implement appropriate technical and organizational security measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Regular security assessments and vulnerability testing
• Access controls and authentication mechanisms
• Secure data centers and infrastructure
• Employee training on data protection

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

9.1 Breach notification

If a breach affects your personal information, we will notify you without undue delay and in any event within 72 hours of confirming it, with the information available at that point, and we will cooperate reasonably in your response. Notice goes to the email address on your account, or by another means permitted by law.

Where the affected data is recipient data we process on a Customer's behalf, we notify the Customer, who as controller is responsible for notifying affected individuals and regulators. We will notify individuals directly where applicable law requires us to, including under California Civil Code § 1798.82 and equivalent statutes in other US states. Notification is not an admission of fault.

10. Data Ownership, Retention & Confidentiality

10.1 Data Ownership

You retain full ownership of all contact data, reply data, and other content you provide or generate through our services. Upon account closure or at your request, we will export your data to a portable format (e.g., CSV) and/or push it to your connected CRM or other designated system, subject to technical feasibility.

10.2 Data Retention

We retain information for as long as needed to fulfil the purposes in this Policy, unless a longer period is required or permitted by law. Specifically:

• Message content and metadata — retained while your account is active to power your dashboard, history, search, and analytics. After account closure we retain it for approximately 30 days for reporting and operational purposes, then delete or anonymise it, unless you request extended retention in writing or the law requires longer.
• Account and contract records — up to three (3) years after account closure, for dispute resolution, audit, and record-keeping.
• Billing and tax records — at least seven (7) years, to meet US tax and financial record-keeping requirements.
• Security, access, and application logs — up to 90 days in raw form, longer in aggregated or de-identified form.
• Abuse and compliance records — for as long as needed to investigate and defend against a claim, and to meet messaging-law obligations.
• Aggregated and de-identified data — may be kept indefinitely and used for any lawful purpose. It cannot be used to identify you, any Customer, or any recipient.

You may request deletion of your information at any time by contacting us at privacy@tuco.ai or following the instructions on our Data Deletion page.

10.3 Confidentiality

We treat your proprietary information as confidential. We do not disclose your contact lists, message content, business strategies, or pricing to third parties except as necessary to provide the services (including the review described in Section 6.1), with your consent, or as required by law. We expect the same standard of confidentiality from you regarding our technical infrastructure and proprietary information.

11. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information, including:

• Access: Request access to the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your personal information (subject to legal obligations).
• Portability: Request a copy of your data in a portable format.
• Objection: Object to processing of your information for certain purposes.
• Restriction: Request restriction of processing in certain circumstances.
• Withdraw Consent: Withdraw consent where processing is based on consent.

To exercise these rights, please contact us at privacy@tuco.ai. We will respond to your request within 30 days, or as required by applicable law.

12. International Data Transfers

The Service runs in the United States. All iMessage lines, backing devices, and primary data storage are located in US data centres (Section 6).

Tuco.ai is operated by Foxwell & Pierce, Inc., a Delaware corporation, which is owned by Crewcharge Technologies Private Limited, incorporated in India. Some engineering, support, and operations personnel are located in India and may access data — including message content — where needed to provide, support, and secure the Service. We state this plainly because it is a cross-border transfer and you are entitled to know before you upload anything.

Your information may therefore be transferred to and processed in countries other than your own, whose data-protection laws may differ. Safeguards we apply include:

• Standard contractual clauses approved by data protection authorities
• Compliance with applicable data protection frameworks (e.g., GDPR, CCPA)
• Regular security assessments of our international operations

13. AI Features and Output Accuracy

Parts of the Service use large language models — drafting replies, summarising threads, scoring intent, and similar. To do that, the relevant message content and the context you have configured (such as a knowledge base or lead notes) are sent to our AI providers, currently Anthropic and OpenAI, for processing.

• We use your content to operate and improve the Service, and to produce aggregated and de-identified analytics.
• We do not use your content to train a general-purpose model that we make available to third parties.
• Our AI providers process content under their own enterprise terms as our subprocessors.

AI output can be wrong. Model output is generated from patterns and inputs and may be inaccurate, incomplete, or inappropriate for your situation.

You are responsible for reviewing AI-generated content before it goes to a recipient wherever your configuration allows review, and for the content of every message sent from your account. We make no representation as to the accuracy of AI output and are not liable for errors in it. Where the law requires you to disclose that a person is interacting with an automated system, that disclosure is yours to make.

14. Certifications We Do Not Hold

Stated plainly so you can plan around it rather than discover it in a security review. As of the date above we hold none of the following:

• SOC 2 Type I or Type II — not held, not in audit. We will not claim it before an auditor signs off.
• HIPAA compliance, and no Business Associate Agreement (BAA). Apple will not sign a BAA for iMessage — and never will. That means Tuco AI cannot be HIPAA compliant, ever: there is no plan, no tier, and no workaround that changes it. Protected health information must never be sent through the Service.
• ISO 27001 — not held.
• PCI DSS attestation — not held. We are never in the payment path for your customers' transactions, never receive or transmit cardholder data, and are not a service provider for PCI purposes. Our own subscription billing is handled by Stripe. Never send payment card data through the Service.
• No third-party penetration-test report available for external distribution, and no binding uptime service-level agreement.

If you or your client require SOC 2 Type II, HIPAA, or a BAA, we are not a suitable vendor for that workload. What we do run is described at tuco.ai/security and in Section 6. You must not represent to anyone that we hold a certification listed here as not held.

15. Children's Privacy

The Service is not intended for individuals under the age of 18, and we do not knowingly collect personal information from anyone under 18. We also do not knowingly collect personal information from children under 13; if we learn that we have, we will delete it in accordance with the Children's Online Privacy Protection Act (COPPA, 15 U.S.C. §§ 6501 et seq.). If you believe we have collected information from a child, please contact us immediately at privacy@tuco.ai, and we will take steps to delete such information.

16. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect and store information about your preferences and usage patterns. You can control cookies through your browser settings. However, disabling cookies may limit your ability to use certain features of our services.

For more information about our use of cookies, please contact us at privacy@tuco.ai.

16.1 Analytics and session replay

On our website we use:

• PostHog — product and website analytics, including event and funnel tracking.
• LogRocket and Microsoft Clarity — session replay and heatmaps. These record how you interact with our pages — clicks, scrolling, mouse movement, and page content — so we can find usability problems. Microsoft may also use this data for its own site-optimisation, security, and advertising purposes; see the Microsoft Privacy Statement.
• Crisp — support chat; your chat messages and basic identifiers are processed to answer you.

16.2 Bot and abuse prevention

We use Cloudflare Turnstile and FingerprintJS to tell real visitors apart from automated traffic and to stop abuse of sensitive actions such as sign-up, trial provisioning, and our free iMessage-checker tool. To do that we and these providers process technical and behavioural signals including your IP address, device and browser characteristics, a device fingerprint, interaction signals, and the originating domain. Cloudflare may also process these signals independently to improve Turnstile.

16.3 Do Not Track and Global Privacy Control

There is no industry consensus on how to interpret browser "Do Not Track" (DNT) signals, so we do not currently respond to them. We do honour Global Privacy Control (GPC) signals as a valid opt-out of "sale" and "sharing" to the extent applicable state privacy law requires.

16.4 Not in the product

Session replay and the advertising-adjacent analytics above run on our marketing website. We do not run session replay over your customers' message content.

17. Third-Party Links

Our services may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of any third-party websites you visit.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. For non-material changes — clarifications, typo fixes, and reasonable operational updates — the revised Policy takes effect when posted on this page with an updated "Last updated" date.

For material changes — including a new purpose for using your information, a new category of recipient, or a change to your rights — we will give at least thirty (30) days' advance notice by posting notice on this page and, where we have your email address, by emailing you. Continued use of the Service on or after the effective date constitutes acceptance. If you do not agree, stop using the Service and cancel your subscription before that date.

19. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

20. Regional Privacy Rights

20.1 California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the "CCPA") gives you the following rights:

• Right to know. Request the specific pieces of personal information we hold about you, the categories we collected, the sources, the business or commercial purposes, and the categories of third parties we disclosed them to.
• Right to delete. Request deletion of the personal information we hold about you, subject to legal exceptions.
• Right to correct. Request correction of inaccurate personal information.
• Right to opt out of sale or sharing. Direct us not to "sell" or "share" your personal information, including for cross-context behavioural advertising. See Section 5.3.
• Right to limit use of sensitive personal information. Direct us to use the sensitive categories in Section 3.3 only for purposes the CCPA permits.
• Right to non-discrimination. We will not discriminate against you for exercising any of these rights.

Categories collected and disclosed. In the preceding 12 months we collected the categories listed in Section 3 for the purposes in Section 4, and disclosed them to the categories of recipient in Section 5 — principally identifiers, commercial information, internet and device activity, approximate geolocation derived from IP address, message content, and account credentials. We have not sold personal information for monetary consideration. Some website analytics and session-replay activity (Section 16) may constitute "sharing" under the CCPA.

How to submit a request. Email privacy@tuco.ai with the subject line "California Privacy Request", or, to opt out specifically, with the subject line "Do Not Sell or Share". We respond within 45 days and may extend once by a further 45 days where the CCPA permits, telling you if we do.

Verification and authorised agents. We verify your identity before fulfilling a request by matching what you give us against what we hold; we may ask for more information where a request concerns sensitive data. An authorised agent may act for you if they provide signed written permission, and we may still ask you to verify your identity with us directly. We honour Global Privacy Control (GPC) signals as a valid opt-out of sale and sharing where applicable law requires.

Shine the Light. California Civil Code § 1798.83 lets California residents request a list of third parties to which we disclosed personal information for those third parties' direct-marketing purposes in the preceding calendar year. Write to privacy@tuco.ai. We do not disclose personal information for third-party direct marketing.

If you are a message recipient rather than a Customer, we usually hold your information as a processor for the Customer who messaged you. We will route your request to that Customer, tell you we have done so, and act on our own records. Section 7.1 is the faster route to stop messages.

20.2 Other US State Privacy Rights

If you reside in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland or Indiana — or any other state with a comprehensive privacy law in force — we will honour the equivalent rights that law gives you, including access, correction, deletion, portability, opting out of targeted advertising and of any sale, and appealing a refusal. Write to privacy@tuco.ai.

Appeals. If we decline a request, you may appeal by replying to our decision with the subject line "Privacy Appeal". We will respond within the period your state's law allows and, if we again decline, tell you how to complain to your state Attorney General.

20.3 European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR). For more information, please see our GDPR page.

20.4 Canadian Privacy (CASL)

If you are in Canada, we comply with applicable Canadian privacy laws, including the Canadian Anti-Spam Legislation (CASL) where it applies to our processing. You are responsible for ensuring your own messaging and marketing activities comply with CASL and other Canadian requirements.

20.5 Messaging Compliance

Where the Service sends messages, we process data in line with applicable messaging rules. Compliance for your campaigns — TCPA consent, CAN-SPAM, state telemarketing and consent statutes, CTIA guidance, carrier requirements, A2P 10DLC where you bring your own registered number, and Apple's platform terms — remains your responsibility. We provide tools, caps, and safety controls to support compliant use. We make no regulatory determination on your behalf, including whether your use is person-to-person or application-to-person, and we disclaim liability for that determination. See Section 11 of our Terms of Service.

21. Related Resources

• Security - Learn about infrastructure and data protection measures
• GDPR Compliance - Review your privacy rights under GDPR
• Data Deletion Instructions - Request deletion of your personal data
• Contact - Reach our privacy or support teams