Privacy Policy

Who we are

TextScaleHQ (“TextScaleHQ”, “we”, “us”) is based in Florida, in the United States. This policy explains what personal information we collect, why, who we share it with, how long we keep it and the choices you have.

It covers textscalehq.com, the TextScaleHQ app, and the sign-up pages and the short links on tsqgo.com, our link domain, that we host for the businesses that use TextScaleHQ.

Our customers and the people they text

If you have a TextScaleHQ account (a business owner, a marketer or an agency), we decide how your account information is used, and this whole policy applies to it.

If you joined a business’s text list, that business decides what it sends you and what it does with your information. We hold your information for the business and handle it only on its behalf, as its service provider. The business’s name appears in every text it sends. For questions about your information, contact that business first. To stop its texts, reply STOP.

What we collect from our customers

• Your account: your name, email address and password, plus sign-in settings such as 2-step verification. We store passwords hashed, never in plain text.
• Your businesses: for each business, its name, time zone, website, privacy and terms links, and HELP contact. Agencies can also add a client contact (name, email, phone and notes), which only they see.
• Your carrier connection: the keys to your Twilio or Vonage account, your numbers and their settings. We use the keys only to:
  • send your texts;
  • read delivery results and what your carrier charged;
  • buy numbers when you ask;
  • file the registrations you ask us to file.
• Registration filings: what you enter to register a toll-free number, such as the business’s legal name, tax ID, address, contact person and sample messages. We send it to your carrier through your own account.
• Billing: your plan and invoices. Stripe collects your card. We see only its brand, last four digits and expiry date.
• What you create: campaigns, templates, webforms, tags, AI Promo profiles and plans, contact files you upload and pictures you send.
• Sign-ins and use: when and from where you sign in (IP address and browser), failed sign-in attempts, and which features you use. We record this on our own servers to keep accounts safe and to improve TextScaleHQ.
• Messages with us: what you send to support, and the emails we send you.

What we hold about the people businesses text

Businesses add people to their lists through our sign-up pages, by keyword, by importing a file, through connected apps or by hand. For each person, we may hold:

• their mobile number and, if they gave them, first and last name, email and birthday (month and day only);
• the tags the business uses to group people;
• proof of consent:
  • how and when they joined;
  • the words they agreed to;
  • the page or keyword they used;
  • a shortened IP address, with the last part removed;
• the texts sent to them in the last 6 months and whether each was delivered;
• their STOP, START, HELP and keyword replies, and their opt-outs. We don’t store other replies;
• link taps: when a text includes a link, each person gets their own short link. When it’s opened, we record:
  • who opened it and when;
  • the type of device (for example iPhone or Android);
  • a shortened IP address.

Our sign-up pages also run anti-spam checks, such as how quickly the form was filled in and how many sign-ups come from one network.

Categories, at a glance

Some state privacy laws, such as California’s and Rhode Island’s, ask for this summary. In the last 12 months we haven’t sold personal information or shared it for targeted advertising, and we don’t plan to.

Category	Examples, where they come from, and who receives them
Identifiers	Name, email, phone number, IP address. From you, or from the business whose list someone joined. Received by your carrier, our hosting and email providers, and that business.
Commercial information	Your plan and invoices. From you and Stripe. Received by Stripe.
Internet activity	Sign-ins, features used, link taps, device type. From your browser or phone. Kept on our servers; link taps are shown to the business that sent the text.
Approximate location	A shortened IP address and an area code. From your browser or number. Kept on our servers.
Sensitive information	Account sign-in and password; a business’s tax ID in a toll-free filing. From you. The tax ID goes to your carrier with the filing. Used only for those purposes.
Consent records	How and when someone joined or opted out. From the sign-up page, keyword, file or app. Shown to the business that holds the list.

How we use information

• To run TextScaleHQ:
  • send texts through your carrier when you or your schedule says so;
  • apply opt-outs, quiet hours and our other sending rules;
  • show you results.
• To keep the consent and opt-out records that protect you and the people you text.
• To keep accounts and texts safe:
  • sign-in codes and checks for unusual sign-ins;
  • stopping spam and abuse, including checks on where links lead.
• To bill you and send account emails: sign-in codes, alerts, and trial and payment notices.
• To help you when you ask, and to improve TextScaleHQ.
• To follow the law and enforce our Terms.

We don’t use the contacts businesses keep with us for our own marketing. We don’t sell them, and we don’t let anyone else use them for their own purposes.

AI Promo

AI Promo sends the following to OpenAI, which writes the drafts:

• the business’s brand profile: what it sells, its offers and how it sounds;
• the plan settings;
• any menu or price-list photos you choose to have read.

We don’t send your contacts or their phone numbers. OpenAI says it doesn’t train its models on data sent through its API, and that it deletes that data after 30 days unless the law requires it to keep it.

Who we share information with

We never sell personal information or share it for targeted advertising. We never give anyone the phone numbers or consent records of the people you text for their own marketing.

We share information only with:

• Your carrier (Twilio or Vonage), through your own account: the texts you send, the numbers they go to, and your registration filings. Your carrier’s own privacy policy covers what it handles.
• Companies that run parts of TextScaleHQ for us, under contracts that limit them to that work:
  • Cloudways (hosting);
  • Cloudflare (checking that sign-ups and some sign-ins come from people);
  • Stripe (payments);
  • Postmark (account emails);
  • OpenAI (AI Promo drafts);
  • Google Fonts (the typeface our pages use).
• The business whose list you joined: it sees your details, your consent proof, its texts to you and your link taps.
• Others, when the law requires it, or to protect people, our customers or TextScaleHQ from fraud or harm.
• A new owner, if TextScaleHQ is sold or merged. The new owner must keep the promises in this policy.

Cookies

We use only the cookies TextScaleHQ needs to work:

• sign-in cookies, which keep you signed in for up to 14 days;
• Cloudflare Turnstile, which checks that you’re a person when you sign up and on some sign-ins;
• if Cloudflare’s network protection runs on a page, a short-lived security cookie that tells people from bots.

We don’t use advertising or analytics cookies, and our website doesn’t load tracking scripts from other companies.

We don’t track you across other websites. So there’s nothing for a browser’s Do Not Track or Global Privacy Control signal to switch off, and we treat both the same way.

Our pages load their typeface from Google Fonts, so Google receives your browser’s IP address when a page opens. Google Fonts doesn’t set cookies.

How long we keep information

Information	How long we keep it
Your account and what you create	Until you delete it or your account
Everything else in your account: sign-in records, messages with support, toll-free filing details, pictures you send, AI Promo profiles	Until you delete your account
Texts sent, and who got each campaign	6 months
Campaign and report totals (counts, not people)	As long as your account exists
Link taps: device type and shortened IP	180 days
Link taps: who opened a link, and when	12 months
Logs of contacts sent in by connected apps	180 days. Copies of the requests: 30 to 90 days, as you set
A business you delete	Deleted 7 days after you ask, apart from opt-outs and consent records
Opt-outs and consent records	At least 4 years, even after a business or the whole account is deleted
Invoices and payment records	As long as tax law requires. Stripe also keeps its own records
Your agreement to our Terms and Privacy Policy (your email address, which version, when, and a shortened IP address)	As long as your account exists. After it’s deleted, your email address and which version you agreed to and when, for 2 years

Deleted information can stay in our server backups for a limited time, until those backups are replaced.

Why opt-outs and consent are kept after a delete: under the federal texting law (the TCPA), people can bring a claim for up to 4 years. A business has to be able to show that someone agreed, or that it stopped when they asked.

These records are kept only as evidence, and they’re never used to text anyone. They have one other use: if the same account sends from that number again, the opt-out stays in place.

Security

We protect information like this:

• Everything travels over encrypted connections (HTTPS).
• Passwords are stored hashed.
• A sign-in that looks unusual needs a code we email you. You can turn on 2-step verification so every sign-in needs one.
• Only the people who run and support TextScaleHQ can reach customer data, and only when they need to.

No system is perfectly secure. If a breach affects your information, we’ll tell you as the law requires.

Your choices and rights

If you have an account, you can:

• see and change most of your information in the app;
• export your contacts and reports as CSV files at any time;
• delete your account in Account › Security;
• email us to see, correct or delete anything else.

If you’re on a business’s text list:

• reply STOP to that business’s texts to stop them, or HELP to get its contact details;
• to see, correct or delete your information, contact the business, and we’ll help it answer you;
• if you write to us instead, we’ll pass your request to the business.

State privacy rights. Depending on where you live (for example California, Colorado, Connecticut, Virginia, Texas and several other states), you may have the right to:

• know what personal information we hold about you;
• get a copy of it;
• correct it;
• delete it;
• opt out of its sale or its use for targeted advertising. We do neither.

How to ask:

• Email [email protected]. An authorized agent can ask for you.
• We’ll confirm it’s you first, usually through the email on your account.
• We’ll reply within 45 days.
• We won’t treat you differently for asking.
• If we say no, you can appeal by replying to our answer. If we still say no, you can contact your state’s attorney general.

Even after a deletion request, we keep opt-out and consent records as described above. The law lets us keep records needed to meet legal duties and defend legal claims.

Children

TextScaleHQ is for businesses, and accounts are for people 18 or older. We don’t knowingly collect information from children under 13, and businesses agree not to use TextScaleHQ to do so.

Where information is stored

TextScaleHQ is run from the United States, and our servers are in the United States. If you use it from another country, your information is moved to and handled in the United States.

Changes to this policy

When we change this policy, we update the date at the top. For a change that matters, such as a new use or a new company we share with, we’ll email account holders at least 30 days before it applies.

Contact us

Questions about privacy, or a request about your information: email [email protected]. You can also use our Contact page, which lists what to include with a request.

Read next: Terms of Service