Privacy Policy

1.1 Controller and Processor Roles

Depending on your jurisdiction and usage, privacy laws may distinguish between a "controller/business" and a "processor/service provider."

You (the customer/user) act as the data controller/business with respect to:

• messaging content, recipients, and targeting;
• consent/opt-in/opt-out practices and compliance decisions;
• campaign purpose, messaging cadence, and disclosures;
• connected social-media account activity;
• SMS programs and messaging operations;
• calendar scheduling decisions and event content.

HMS Innovations generally acts as a service provider / processor, processing information solely to provide the Services on your behalf, consistent with your configurations, instructions, and authorizations.

HMS Innovations does not independently determine the purposes of your messaging or scheduling activities, except where we must process data for our own legitimate operational needs (e.g., security, billing, compliance, and product improvement as described below).

For RipDrip-AI, a "User-Connected Messaging Platform" means an independent third-party CRM, SMS, messaging, communications, or automation platform that the customer independently selects, subscribes to, controls, credentials, and affirmatively connects to RipDrip-AI.

The customer generally acts as controller/business with respect to the customer's User-Connected Messaging Platform account, recipients, contact information, conversation content, messaging purposes, consent, initial messages, campaigns, configuration, and decision to disclose information to HMS Innovations.

HMS Innovations generally acts as processor/service provider when it processes identifiable conversation information under the customer's instructions to provide RipDrip-AI.

HMS Innovations may act independently as controller/business for account administration, billing, service security, fraud and abuse prevention, legal compliance, and internal operational information.

The parties' legal roles ultimately depend on the particular processing activity and applicable law.

We collect information from multiple sources, including information you provide, information you authorize us to access through integrations, information generated through your use of the Services, and information provided by third parties involved in delivering the Services (e.g., messaging providers).

2.1 Information You Provide or Authorize

We collect information you voluntarily provide or authorize us to access, including any information reasonably necessary to provide, operate, support, secure, and improve the Services and to meet third-party platform, carrier, messaging-provider, or legal requirements applicable to the Services.

This may include, without limitation:

(a) Account and Profile Information

• name, email address, phone number, username, password (hashed), and account preferences;
• business name and role/authorization details;
• customer support communications and correspondence.

(b) Billing and Transaction Information

• billing contact information;
• payment method tokenization and limited transaction data (typically processed and stored by payment processors, not by us in full);
• invoices, receipts, and account status information.

(c) Business, Entity, and Compliance Information (Including SMS Registration)

We may collect business and legal-entity information needed for messaging registration, vetting, or compliance processes, including information you provide for brand/campaign submissions through intermediaries (including Messaging Providers), such as:

• company legal name and DBA information;
• entity type (e.g., LLC, corporation);
• formation/registration information (where required);
• business address and contact information;
• authorized representative information;
• ownership/control information or attestations (where required);
• website URLs and brand descriptors;
• use case descriptions, sample messages, opt-in language, opt-out language, and disclosures;
• any other information reasonably requested by Messaging Providers, carriers, or registries for approval or remediation workflows.

(d) User Configuration Data (AI Setup / Conversation Logic)

• prompts, decision trees, workflows, rebuttals, FAQs, scripts, rules, tags, filters, and other instructions you configure to influence AI or automation behavior.

(e) Content You Submit Through the Services

• templates, scripts, message drafts, and other content you upload or create;
• any media you upload (subject to product capabilities).

(f) Voice Data

If you use synthetic voice features, we collect voice recordings or samples ("Voice Data") you upload for the purpose of creating and operating a synthetic voice model.

(g) Calendar Authorization Data

If you connect a calendar provider, we collect authorization tokens and related integration metadata required to access the calendar data you permit.

(h) Platform Access Credentials and Connection Information

If you connect RipDrip-AI to a User-Connected Messaging Platform, we may collect and process:

• API keys, private integration tokens, personal integration tokens, OAuth access and refresh tokens, webhook secrets, integration URLs, and similar Platform Access Credentials;
• platform, agency, account, location, sub-account, workspace, and user identifiers;
• granted permission scopes and connection status;
• webhook and API configuration information;
• credential creation, rotation, expiration, revocation, and error information; and
• security and audit information associated with the connection.

We use Platform Access Credentials only as necessary to establish, operate, secure, support, and troubleshoot RipDrip-AI.

You should use the narrowest permissions reasonably available and promptly revoke Platform Access Credentials following suspected compromise, disconnection, or loss of authority.

2.2 Messaging and Channel Data

Depending on which Services you use, we may process messaging content and metadata.

(a) Social Media Messaging (RipDrip-DM)

If you connect a supported social media platform:

• we process inbound messages sent to your connected accounts;
• we process message metadata (timestamps, sender identifiers, conversation identifiers);
• we generate and send AI responses only to inbound messages initiated by third parties, based on your configuration;
• if enabled, we may generate voice responses using your synthetic voice model.

(b) SMS and Messaging Channels (RipDrip-AI)

If you use RipDrip-AI, we may:

• receive or retrieve inbound message content, relevant conversation history, initial outbound message content, telephone numbers, contact identifiers, timestamps, tags, opt-out or do-not-contact indicators, and related metadata from your User-Connected Messaging Platform;
• process User Configuration Data, including prompts, workflows, decision logic, rules, scripts, rebuttals, and instructions;
• use conversation information and User Configuration Data to generate a response;
• identify supported opt-out language and create RipDrip-AI suppression information;
• submit generated response content and an associated API request to your User-Connected Messaging Platform;
• receive API responses, error codes, queue information, connection information, and platform-reported message statuses; and
• maintain security, troubleshooting, suppression, and audit information associated with RipDrip-AI.

A status received from a User-Connected Messaging Platform may indicate only that an API request was received, queued, submitted, or accepted. It may not establish carrier acceptance or delivery to a recipient's device.

The User-Connected Messaging Platform and its downstream providers independently process and retain information under their agreements with you.

2.3 Calendar Data

If you connect Google Calendar or another calendar provider and grant permissions, we may process calendar data that you authorize us to access, which may include:

• event titles, dates, times, locations, and descriptions;
• attendee information (as permitted by the integration);
• scheduling metadata needed to create, update, or manage events;
• calendar settings and availability information (as permitted).

We process calendar data only as needed to provide the calendar-related functionality you enable.

2.4 Automatically Collected Information

We may automatically collect information about your device and usage, including:

• IP address, device identifiers, and approximate location (derived from IP);
• browser type, operating system, and settings;
• log data, crash reports, diagnostics, and error logs;
• feature usage, performance metrics, and interaction data;
• security-related signals (e.g., authentication events, suspicious activity patterns).

2.5 Information From Third Parties

We may receive information from third parties involved in providing the Services, including:

• Messaging Providers, carriers, intermediaries, and vendors (delivery status, filtering/throttling signals, enforcement notices, registration status updates);
• social media platforms (integration metadata and message delivery-related info as permitted);
• calendar providers (integration metadata and authorized calendar data);
• payment processors (payment status and limited transaction confirmation data);
• analytics and security providers (fraud and security signals).
• User-Connected Messaging Platforms, from which we may receive account information, conversation content, contact information, message metadata, opt-out indicators, platform-reported statuses, API responses, and connection information as authorized by the customer.

2.6 Google API Services User Data

If you connect Google Calendar, RipDrip uses information received from Google APIs only to provide and improve the user-facing calendar scheduling features you enable, including availability checks, connected calendar display, booking event creation, booking event updates, and booking event cancellation.

RipDrip's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We do not sell Google user data, use Google user data for advertising, transfer Google user data to data brokers or information resellers, use Google user data for credit-worthiness or lending decisions, or use Google user data to train generalized AI models outside the calendar scheduling features the user enables.

Google user data is not included in Anonymized & Aggregated Usage Data and is not subject to the sale, licensing, commercialization, or resale language in Section 7. If any other section of this Privacy Policy conflicts with this Google API Services User Data section, this section controls for Google user data.

2.7 RipDrip-AI Data Flow

When a customer enables RipDrip-AI:

• the customer selects and controls a User-Connected Messaging Platform;
• the customer supplies or authorizes a Platform Access Credential;
• RipDrip-AI uses that credential to receive or retrieve eligible conversation information;
• RipDrip-AI may process necessary information through artificial-intelligence and infrastructure service providers acting on our behalf;
• RipDrip-AI generates response content based on the customer's configuration;
• RipDrip-AI submits the response content and an associated API request to the User-Connected Messaging Platform; and
• the User-Connected Messaging Platform and its downstream messaging providers and carriers determine whether and how the response is routed, transmitted, filtered, and delivered.

Disconnecting RipDrip-AI does not delete information independently retained by the User-Connected Messaging Platform.

The Services use artificial intelligence and automated systems to generate responses and manage workflows based on User Configuration Data.

You acknowledge that:

• AI-generated outputs may be inaccurate, incomplete, misleading, offensive, or inappropriate;
• AI outputs are probabilistic and depend materially on customer inputs and configuration;
• when unattended automation is enabled, RipDrip-AI may generate response content and submit that content and an associated API request to a User-Connected Messaging Platform without contemporaneous human review; and
• AI-generated messages are generated and processed on the customer's behalf and under the customer's configuration and instructions.

We do not review, approve, or monitor every individual message.

We may implement general system-level guardrails and may make compliance-related adjustments to AI behavior where reasonably necessary to protect security, platform standing, compliance, and integrity.

RipDrip-AI includes controls designed to identify supported opt-out language and suppress subsequent automated RipDrip-AI responses. Automated detection may not identify every possible opt-out or revocation, and RipDrip-AI suppression may not prevent messages sent by customer personnel, other software, other automations, or the User-Connected Messaging Platform itself.

4.1 Voice Data Use

If you enable synthetic voice features, Voice Data is processed solely to:

• create and operate a synthetic voice model for you; and
• generate synthetic voice outputs as part of the Services.

Voice Data is not sold and is not included in Anonymized & Aggregated Usage Data.

4.2 Biometric Disclosure and Consent

Certain jurisdictions regulate biometric identifiers such as voiceprints. By uploading Voice Data, you expressly consent to the collection, processing, storage, and use of Voice Data for the purposes of providing the Services.

We do not use Voice Data for identity verification, surveillance, or authentication.

We use information for the following purposes:

5.1 Provide and Operate the Services

• create and administer accounts;
• provide access to product features you enable;
• deliver messaging and automation functionality;
• provide calendar integration features;
• generate AI responses where enabled and configured.

5.2 Messaging Registration, Vetting, and Deliverability Operations

For a Service or Order that expressly includes messaging registration, connectivity, deliverability, or remediation assistance, we may use information to:

• submit brand or campaign registration or vetting information through Messaging Providers and intermediaries, using data you provide;
• coordinate responses, appeals, and remediation steps with Messaging Providers, carriers, and intermediaries where permitted;
• notify you of issues and guide required user-side changes; and
• implement reasonable AI guardrail adjustments where needed for compliance or platform standing.

Unless an applicable Order expressly states otherwise, these registration, connectivity, carrier-coordination, and carrier-remediation functions are not provided as part of RipDrip-AI.

5.2.1 RipDrip-AI Operations

For RipDrip-AI, we may use information to:

• authenticate and maintain the customer-authorized platform connection;
• retrieve and organize eligible conversation information;
• apply customer prompts, rules, workflows, and instructions;
• generate automated responses;
• submit generated responses and associated API requests to the User-Connected Messaging Platform;
• identify supported opt-out language and maintain RipDrip-AI suppression information;
• detect errors, duplicate events, abuse, and security concerns;
• maintain security and audit records; and
• provide support and troubleshoot platform or API failures.

5.3 Customer Support and Communications

• respond to inquiries and provide support;
• notify you about updates, incidents, changes, and administrative messages.

5.4 Security, Integrity, and Fraud Prevention

• detect and prevent abuse, fraud, or security incidents;
• troubleshoot, debug, and maintain reliability.

5.5 Improve and Develop the Services

• understand usage patterns, improve performance, and develop new features;
• generate internal analytics and insights (including Anonymized & Aggregated Usage Data).

5.6 Legal and Compliance

• comply with applicable laws and lawful requests;
• enforce our agreements and policies.

6.1 Messaging Service Models

For a Service in which RipDrip expressly provides or arranges messaging connectivity, we may route messages through third-party connectivity providers, carriers, aggregators, registries, and intermediaries.

For RipDrip-AI, the customer independently selects, subscribes to, controls, credentials, and connects the User-Connected Messaging Platform.

RipDrip-AI submits generated response content and associated API requests to that platform.

The User-Connected Messaging Platform and its downstream providers perform telecommunications routing, transmission, filtering, and delivery.

Unless expressly included in an applicable Order, RipDrip does not select or provide the customer's telephone numbers, A2P/10DLC registration, carrier connectivity, telecommunications routing, or delivery service for RipDrip-AI.

6.2 Brand/Campaign Registration on Your Behalf

Where required, we may submit brand/campaign registration and vetting information on your behalf using information you provide. You are responsible for ensuring the information you provide is accurate and compliant.

We do not control approval outcomes, which are determined by third parties (Messaging Providers, registries, and carriers).

6.3 Notices and Remediation

If we receive compliance or deliverability-related notices from Messaging Providers, carriers, or intermediaries, we may:

• notify you of the issue;
• assist in remediation and coordinate responses/appeals where permitted;
• adjust AI behavior or guardrails for AI-driven messaging where reasonably necessary.

If the issue relates to user-authored outbound messaging or consent practices, you are responsible for implementing required changes, and we may provide guidance.

6.4 RipDrip-AI Carveout

Sections 6.2 and 6.3 apply to RipDrip-AI only to the extent an applicable Order expressly states that RipDrip will provide or assist with the registration, connectivity, deliverability, or remediation function described in those Sections.

For RipDrip-AI, the customer is responsible for its relationship with the User-Connected Messaging Platform and the platform's downstream messaging providers, carriers, registries, and intermediaries.

7.1 Definition

"Anonymized & Aggregated Usage Data" means analytics, metrics, statistics, trends, patterns, system performance data, model learnings, embeddings, weights, and other derived information generated from operation of the Services in aggregated and irreversibly anonymized form, such that it cannot reasonably be used to identify any individual, account, phone number, calendar event, recipient, or specific message.

7.2 Ownership and Use

• Anonymized & Aggregated Usage Data does not constitute Personal Data.
• It falls outside the scope of GDPR, CCPA/CPRA, and similar privacy laws.
• HMS Innovations exclusively owns such data.

We may use, commercialize, license, sell, transfer, disclose, or otherwise exploit Anonymized & Aggregated Usage Data for any lawful purpose, including analytics, benchmarking, research, product development, and commercial resale.

We do not attempt to re-identify such data or combine it with other datasets for identification.

7.3 RipDrip-AI Data and Credential Carveout

Platform Access Credentials, telephone numbers, identifiable contact records, identifiable conversation content, opt-out information, and legally protected sensitive information are not Anonymized & Aggregated Usage Data unless and until the information has been irreversibly anonymized and otherwise satisfies the definition in Section 7.1.

We do not sell or license Platform Access Credentials.

This Section does not prevent us from processing customer-specific information to provide RipDrip-AI or from using information that validly satisfies the definition of Anonymized & Aggregated Usage Data.

We may share information in the following ways:

8.1 Service Providers

We share information with vendors and service providers that help us operate the Services (e.g., hosting, monitoring, customer support tools, payment processors, security providers), subject to contractual confidentiality and appropriate safeguards.

8.2 User-Connected Messaging Platforms and Messaging Providers

For RipDrip-AI, we exchange information with customer-authorized User-Connected Messaging Platforms as necessary to retrieve conversation information, operate customer-configured automation, identify supported opt-out language, submit generated response content and associated API requests, receive platform-reported statuses, secure the Services, and troubleshoot the connection.

For Services in which RipDrip expressly provides or arranges messaging connectivity, we may also share information with messaging providers, carriers, aggregators, registries, and intermediaries as necessary to register, route, transmit, deliver, and manage messaging services.

For RipDrip-AI, carrier connectivity and delivery are provided through the customer's independently selected User-Connected Messaging Platform and its downstream providers.

8.3 Social Platforms and Integrations

We share and receive information with connected platforms as required to provide the integrations you enable and as permitted by your authorizations.

8.4 Calendar Providers

We share and receive information with calendar providers as required to provide calendar features you enable and as permitted by your authorizations.

8.5 Legal, Safety, and Rights

We may disclose information to comply with law, enforce our agreements, protect rights and safety, investigate fraud, or respond to lawful requests.

8.6 Business Transfers

We may disclose information in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets.

We do not sell Personal Data.

9.1 Inbound Communications

For inbound social-media messages and inbound SMS replies, processing is generally based on your instructions as controller and on the recipient's initiation of communication through your channel.

9.2 Outbound SMS

You are responsible for establishing a lawful basis for outbound SMS messaging, including required consent and opt-out mechanisms, and for compliance with applicable laws and carrier rules.

9.3 Consent Where Required

Where applicable law requires consent for a particular processing activity, we will rely on consent only when it has been obtained through a mechanism satisfying applicable legal requirements. Mere continued use of the Services will not be treated as consent where applicable law requires a clear affirmative action.

This does not affect processing performed on another lawful basis or processing performed on a customer's instructions when HMS Innovations acts as a processor or service provider.

We retain information for as long as necessary to provide the Services, comply with legal obligations, resolve disputes, enforce agreements, and for legitimate business needs.

• Message data may be retained according to your settings, product configuration, and operational needs (including troubleshooting and compliance support).
• Voice Data is retained while your account is active or until deletion is requested, subject to legal and operational requirements.
• Calendar data is retained based on the permissions and features you enable and may be removed upon disconnection.
• Anonymized & Aggregated Usage Data may be retained indefinitely.
• Messaging data — platform disconnection. When you disconnect a connected social-media account, we will delete messaging data associated with that platform from our active production systems within ninety (90) days, subject to (i) ongoing billing reconciliation or dispute resolution (up to 12 months), (ii) fraud investigation, security incident response, or compliance with applicable law (duration as required), and (iii) legal hold or active regulatory proceedings. Anonymized & Aggregated Usage Data derived from your use of the Services prior to disconnection is retained as described in Section 7 and may be retained indefinitely.

Platform Access Credentials are retained while reasonably necessary to maintain the customer-authorized connection and may remain for a limited period in protected backups, security records, or legal records consistent with our retention practices and legal obligations.

When a customer disconnects RipDrip-AI, we stop using the Platform Access Credential for new RipDrip-AI operations and delete, disable, or render the stored credential unusable in accordance with our operational deletion and backup cycles.

Customers should also revoke the Platform Access Credential directly through the User-Connected Messaging Platform when immediate revocation is required.

Identifiable RipDrip-AI conversation information and generated responses are retained according to customer settings, product configuration, support requirements, security needs, dispute-resolution needs, and legal obligations.

Opt-out and suppression information may be retained as reasonably necessary to prevent unwanted RipDrip-AI responses, investigate complaints, resolve disputes, and demonstrate compliance.

Disconnecting RipDrip-AI does not delete information retained independently by the User-Connected Messaging Platform.

We maintain reasonable administrative, technical, and organizational safeguards designed to protect information against unauthorized access, disclosure, alteration, and destruction.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

We apply reasonable access restrictions and safeguards designed to protect Platform Access Credentials.

We may quarantine, disable, or delete a Platform Access Credential when we reasonably suspect compromise, misuse, unauthorized access, loss of authority, or another material security risk.

Customers remain responsible for securing and, where necessary, revoking Platform Access Credentials through the applicable User-Connected Messaging Platform.

12.1 GDPR (EEA/UK)

Depending on your location, you may have rights to access, correct, delete, restrict processing, object to processing, and request portability of your Personal Data.

Because you generally act as controller for messaging data, end-user requests should typically be handled by you. We will assist as required by applicable law and our role.

12.2 CCPA / CPRA (California)

California residents may have rights to know, access, delete, and correct Personal Data, and to limit the use of sensitive Personal Information (as defined by law).

We do not sell Personal Data and generally act as a service provider for our customers.

To submit a request, contact us at the email in Section 17.

If you use the Services in regulated industries (e.g., healthcare, finance, insurance, legal, political communications, telecommunications), you are solely responsible for compliance with applicable laws and regulations. The Services are not designed to ensure regulatory compliance, and we disclaim liability arising from regulated-industry use.

Your information may be processed and stored in countries other than your own. Where required, we implement appropriate safeguards for international transfers.

The Services are not intended for individuals under 18. We do not knowingly collect Personal Data from children.

We may update this Privacy Policy from time to time. We will post the revised Privacy Policy with an updated "Last updated" date and provide any additional notice required by applicable law.

If applicable law requires consent for a new or materially different processing activity, we will obtain the required consent before relying on that consent as the legal basis for the activity.

Contractual amendments to the Terms of Service or EULA, including amendments concerning dispute resolution or attorneys' fees, are governed by those agreements and not by this Section.

HMS Innovations LLC (DBA RipDrip)

Email: support@ripdrip.ai