Privacy policy

Agency Agent is an internal workspace operated by Abacus Desk (“we”, “us”), a social media agency based in India. We use it to plan content for the brands we work with, check that content against each brand's rules, and record approvals from our team and our clients.

Agency Agent is not offered to the public. Only Abacus Desk staff can sign in. Our clients use it only through private review links we send them.

From our team

• Account details for each person an admin invites: name, email address and role. Passwords are stored only as a one-way hash, and the authenticator app key is encrypted.
• Work records: plans, captions, uploaded images, comments, approvals and the history of every change, with who made it and when.

From and about our clients

• Brand information: brand guidelines, and contact details (names, roles, work email addresses, WhatsApp numbers) for the people we work with.
• Client communications: emails that are sent to or copied to our agent mailbox, messages in WhatsApp groups our agency number is part of, and transcripts of client meetings joined by our notetaker. Attachments and media in these are stored with them.
• Review decisions: when a client approves or asks for changes through a review link, we record the name they enter, their decision, any comment, and the time.

Automatically

• Security and service logs: sign-in events, IP address and browser type, kept to keep the service secure and working.

We do not use advertising cookies or third-party analytics. The only cookie we set is the session cookie that keeps a team member signed in.

Agency Agent uses Google APIs in these ways only:

• Gmail, read-only, for one mailbox: the agency's own agent mailbox, which our team copies on client emails. We read messages in that mailbox to file them under the right brand and find decisions in them. We never read anyone's personal mailbox, and we never send, delete or change email.
• Google Calendar, on the agent account only: to create client meetings with a Google Meet link and invite the people the account manager chooses.

Agency Agent's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google data only to provide the features described on this page.
• We do not sell Google data, or use or transfer it for advertising, credit decisions or any purpose unrelated to these features.
• We do not use Google data to train or improve general-purpose AI or machine-learning models, ours or anyone else's.
• People do not read Google data except where needed to review a proposal the agent made from it, with the account owner's agreement, for security, or where the law requires it.

• To match client messages to the right brand and propose changes to plans, briefs or guidelines, which a team member then approves or rejects.
• To check captions and images against a brand's rules before they are reviewed.
• To send clients private review links and record their approval of an exact version of the content.
• To publish approved content to the brand's social media accounts.
• To keep an audit trail of who changed or approved what, and to keep the service secure.

Some features send text and images through OpenRouter to the AI model provider selected by us: proposing changes from client messages, and reviewing captions and images against brand rules. OpenRouter and the selected provider process this data on our behalf.

AI output is always a suggestion. A person on our team approves every change to a plan and every piece of content before it is sent to a client or published.

We do not sell personal information. We share it only with service providers that run parts of Agency Agent for us:

• Google: the agent mailbox (Gmail) and client meetings (Calendar with Meet links).
• OpenRouter and selected AI model providers: AI processing, as described above.
• Cloudflare: private storage for uploaded files, emails and media.
• Our hosting and database providers, and our AI tracing service, which records AI requests so we can check their quality.
• Social networks (such as Instagram, Facebook, LinkedIn and YouTube): only the content a client has approved, when we publish it to that client's own account.

We may also disclose information if the law requires it, or to protect our rights or someone's safety.

• Client communications (emails, WhatsApp messages, meeting transcripts) are kept for 24 months, then deleted together with anything derived from them.
• Approvals and the audit trail are kept for as long as we work with the brand and afterwards as our business record of what was agreed.
• Team accounts are kept while the person works with us and removed when they leave.
• Review links stop working after seven days, or sooner if we revoke them.

• All traffic is encrypted in transit (HTTPS). Files are kept in private storage and opened only through short-lived signed links.
• Access is by invitation only. Every sign-in needs a password and a code from an authenticator app (or a one-time recovery code), and repeated wrong attempts pause sign-in. Stored connector credentials are encrypted.
• Review links are stored only as a one-way hash, so a copy of our database cannot be used to open them.

You can ask us to show you, correct or delete personal information we hold about you, or to stop processing it, including under India's Digital Personal Data Protection Act, 2023. Write to privacy@abacusdesk.com and we will reply within 30 days.

A client can ask us not to bring the notetaker into their meetings, and we switch it off for that brand. The agency can remove Agency Agent's access to its agent Google account at any time from Google account permissions.

If we change how we use information, we will update this page and its effective date. Significant changes will be shared with our team and affected clients before they apply. See also our terms of service.