Privacy Policy — AgentCollect

Two roles, kept separate. For data about your own account and your use of our website, AgentCollect is the controller and this policy applies directly. For the debtor and invoice data you upload to run collections, you are the controller and AgentCollect is your processor — that relationship is governed by our Data Processing Addendum, not this policy.

1. Introduction

Respaid, Inc. (d/b/a AgentCollect) ("AgentCollect," "we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our platform and website. As a software provider, where we process personal data on your behalf as a processor — for example, the debtor data you upload — the Data Processing Addendum governs that processing.

2. Information We Collect

Information you provide

Account registration data (name, email, company name, phone number)
Billing and payment information (processed via Stripe; we do not store full card numbers)
Invoice and accounts receivable data you upload to our platform (processed on your behalf as a processor under the DPA, not this policy; listed here for transparency)
Communications with our support team

Information collected automatically

Device and browser information (IP address, browser type, operating system)
Usage data (pages visited, features used, session duration)
Cookies and similar tracking technologies

Information from third parties

Business contact information that you provide or authorize us to process on your behalf as a processor under the DPA (we do not independently source or enrich debtor data on our own account)
Data from identity verification and compliance providers used to operate and secure our own service

3. How We Use Your Information

We use collected information to:

Provide, operate, and maintain our AI-powered recovery platform
Process transactions and send related information
Send you technical notices, security alerts, and support messages
Respond to your comments, questions, and customer service requests
Monitor and analyze trends, usage, and activities
Detect, investigate, and prevent fraudulent transactions and abuse
Comply with our own legal obligations as a software provider

Legal bases (EEA/UK). Where the GDPR applies, we process controller data on these bases: performance of our contract with you (to provide and bill the Platform); compliance with legal obligations; our legitimate interests (securing, improving, and preventing abuse of the Platform); and your consent where required (for example, non-essential cookies or marketing). You may withdraw consent at any time.

4. How We Share Your Information

We do not sell your personal information. We may share data with:

Subprocessors: Vetted vendors who help us operate the Platform — such as cloud hosting and storage, voice & SMS delivery, AI model inference, and email delivery. Each is bound by data-protection terms; a current list of subprocessors is available to customers on request, as described in our Data Processing Addendum. Your own payment processor (e.g., your Stripe account) is engaged by you, not by us.
Legal compliance: When required by law, regulation, or legal process
Business transfers: In connection with a merger, acquisition, or sale of assets
With your consent: When you have given us explicit permission

SMS consent and mobile information. Phone numbers and SMS opt-in consent collected for text messaging are used solely to deliver the transactional messages the recipient requested (such as a secure payment link confirmed during a live interaction). No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third party. Message and data rates may apply; message frequency varies. Reply STOP to opt out or HELP for help.

5. Data Security

We implement enterprise-grade security measures including encryption in transit (TLS 1.2+) and at rest (AES-256), multi-factor authentication for administrative access, role-based access control on the principle of least privilege, continuous monitoring, and periodic independent security testing. We maintain a SOC 2 Type II report, available under NDA on request to security@agentcollect.com. No method of transmission over the Internet is 100% secure, but we protect your data using commercially reasonable means.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy, comply with legal obligations, resolve disputes, and enforce our agreements. Account data is deleted within 90 days of account closure.

7. Cookies

We use essential cookies to operate our platform and analytics cookies to understand usage patterns. You can control cookie preferences through your browser settings. Disabling certain cookies may limit your ability to use some features of our platform.

8. Your Rights

These rights apply to personal data for which AgentCollect is the controller. For debtor and invoice data you upload — where AgentCollect is your processor — deletion and other requests are handled under the DPA, including automatic deletion within 90 days after the 30-day post-termination export window. To exercise any right, email privacy@agentcollect.com; we will verify your identity before responding, respond within the timeframes required by law, and accept requests from an authorized agent.

For all users

Access the personal data we hold about you
Request correction of inaccurate data
Request deletion of your data (subject to legal retention requirements)
Opt out of marketing communications

CCPA / CPRA rights (California residents)

Right to know what personal information is collected, used, and shared
Right to delete personal information
Right to opt out of the sale or sharing of personal information
Right to non-discrimination for exercising your rights

GDPR rights (EEA/UK residents)

Right of access, rectification, erasure, and data portability
Right to restrict or object to processing
Right to withdraw consent at any time
Right to lodge a complaint with a supervisory authority

9. International Transfers

Your data may be transferred to and processed in the United States, where our servers and certain subprocessors are located. Some AI and communications subprocessors used to deliver outreach and process calls may process data in the United States. For personal data subject to the EU or UK GDPR, these transfers are governed by the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable) under Article 44 et seq., and are limited to what is necessary to provide the service, as detailed in our Data Processing Addendum.

10. Children's Privacy

Our services are not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the effective date, and — where the law requires — we will obtain your consent before using your information for a new purpose.

12. Contact Us

For privacy-related inquiries, data access requests, or complaints:

Email: privacy@agentcollect.com
Respaid, Inc. (d/b/a AgentCollect)
490 Post St, San Francisco, CA