Privacy policy
What TextSend touches when it relays a message, how long it keeps it, and how to ask us to delete it.
1. Who we are
TextSend is a Zendesk Support app that sends and receives SMS/MMS through a customer's own Twilio account, from inside a Zendesk ticket. TextSend is a communications utility, not a compliance service. See the terms of service for what that means for your responsibilities.
TextSend is operated by Ampliat LLC.
2. What we collect
| Data | Why TextSend touches it | Where it ends up |
|---|---|---|
| Message body (SMS/MMS text) | Relayed between your Twilio number and the Zendesk ticket the conversation belongs to | Written to Zendesk as a private ticket comment after a successful send or receive. Held in the processing queue only for the duration of that single processing step. |
| MMS media | Relayed as a Zendesk ticket attachment | Streamed to the Zendesk attachment. Any temporary copy TextSend holds is deleted within 24 hours. |
| Phone numbers (your Twilio numbers and your end customers' numbers) | Needed to route a message to the correct ticket and to address the SMS/MMS correctly | Stored as operational metadata (routing and delivery records), encrypted at rest. After you remove the app, deleted within 30 days after deletion starts (see "Retention and deletion"). |
| Twilio Account SID and Auth Token | Needed to send and receive SMS/MMS, and to check that inbound requests really came from Twilio | Stored only in TextSend's secret store, which nothing in the product reads except the backend. Never returned to the browser. Deleted when deletion starts: usually about a week (7 to 8 days) after the app is removed, always within 30 days of removal (see "Retention and deletion"). |
| Saved SMS templates (text your admins write) | Inserted by agents into messages they compose | Stored with merge fields kept as placeholders, which the agent's browser fills in at insertion. Not checked for personal data, so do not type customer details into a template. Kept until an admin deletes them; after you remove the app, deleted within 30 days after deletion starts. |
| Message status and message/ticket identifiers | Needed to show delivery status and to avoid sending or filing the same message twice | Retained 90 days by default, then aggregated or deleted. |
| Audit events (who did what, when, on which account, conversation, or message) | Needed for security review, incident response, and support diagnosis | Retained 12 months, never including the message body. |
| Zendesk agent identity (from a signed app-identity assertion) | Needed to authorize the request and to enforce role and group restrictions | Not stored as an agent profile. TextSend stores the installation's role and group configuration, not the agent's personal profile. The identifier of the agent who performed an action is recorded in that action's audit event and kept for 12 months as part of that record. |
3. What we do not retain
- No message body is retained by TextSend after the Zendesk write succeeds. A message body exists in only three places, each for a bounded time: the processing queue, for the duration of that processing step; the temporary MMS media copy, for at most 24 hours; and Zendesk itself, permanently, because Zendesk, not TextSend, is the system of record for conversation content. No message body is ever written to TextSend's own database, telemetry, or logs.
- No full media URL is stored or logged. TextSend keeps an opaque media reference and the content type, never the URL Twilio issued for the media item.
- No unredacted phone number appears in logs or telemetry. Phone numbers are redacted in every log line and error message by design, independently of the retention controls on stored data.
- No Twilio or Zendesk credential is ever returned to the browser, logged, or stored outside the secret store.
- TextSend does not access a Zendesk agent's personal profile (name, email, avatar, and similar) beyond the verified identity claims needed for authorization.
4. How we use it
TextSend processes the data above solely to provide the service: routing SMS/MMS between your Twilio number and the correct Zendesk ticket, reporting delivery status, enforcing opt-outs, enforcing your own role, group, and plan restrictions, and verifying your refund requests.
TextSend does not sell personal data, does not share it with any party for that party's own marketing purposes, does not use it for advertising, and does not use it to train any model.
5. How we protect it
- Data in transit is encrypted with TLS 1.2 or later. Data at rest uses the storage platform's own encryption.
- Twilio and Zendesk credentials are held only in the backend's secret store, reachable by the backend alone, and are never logged or returned to the browser.
- Every customer's data is isolated by a tenant identifier applied to every stored record. A read that crosses customers is rejected rather than silently returning another customer's data, and the database checks the same boundary again on its own.
- Every backend request is authorized against a verified installation and agent identity. A Zendesk agent's role, as reported by the browser, is never trusted on its own.
Encryption at rest is provided by the hosting environment, not by TextSend's own software. The controls that do not depend on the host (credentials never leaving the backend, tenant isolation, and redaction) are built into TextSend itself and hold wherever it runs. The security page lists the full set of controls.
6. Retention and deletion
| Data | Retention bound | How it is enforced |
|---|---|---|
| Message body (sensitive customer content) | Duration of processing only; permanent in Zendesk | The queued copy expires, is deleted once processing succeeds, and is scrubbed from the failed-message queue |
| MMS media (sensitive binary content) | 24 hours, plus at most one cleanup interval | Media is streamed to the Zendesk attachment without being written down at all; a scheduled job deletes by age anything that does get written |
| Phone numbers (personal data) | Within 30 days after deletion starts; deletion starts usually about a week (7 to 8 days) after the app is removed, always within 30 days of removal | Encryption at rest supplied by the hosting environment; a scheduled metadata-expiry job |
| Saved SMS templates (your own configuration) | Until an admin deletes them; after you remove the app, within 30 days after deletion starts | Deleted by an admin on the Templates tab; removed by the metadata purge that follows deletion |
| Twilio and Zendesk credentials (secrets) | Deleted when deletion starts: usually about a week (7 to 8 days) after the app is removed, always within 30 days of removal | Deleted from the secret store, in the same step that starts deletion |
| Message status and IDs (operational metadata) | 90 days by default, then aggregated or deleted | Scheduled retention job |
| Audit events (security and operations) | 12 months, without message body | Scheduled retention job |
Backups. TextSend backs up its database so it can recover from a failure. Backups never contain message bodies, MMS media, or your Twilio and Zendesk credentials. Each database snapshot is deleted within 54 hours of being taken, and each database copy within 6 days. Every backup copy of a removed account's metadata is deleted within 30 days after deletion starts. If TextSend ever restores from a backup, it repeats every deletion that started after that backup was taken before the service resumes.
Deletion usually starts about a week (7 to 8 days) after the app is removed, and always within 30 days of removal: TextSend checks daily and starts 7 days after it first sees the app missing. When deletion starts, TextSend deletes your Twilio credentials and stops all processing. The remaining account metadata is purged within 30 days after deletion starts.
- Secrets (Twilio Account SID and Auth Token, and TextSend's Zendesk credentials) are deleted when deletion starts, as part of that step rather than by a scheduled job. If the app is installed again within those 7 days, nothing is deleted.
- Operational metadata (routes, message status and IDs, phone numbers used for routing) is deleted within 30 days after deletion starts, by a scheduled job.
- Backups. If TextSend ever restores from a backup, it repeats every deletion that started after that backup was taken before the service resumes. Every backup copy of a removed account's metadata is deleted within 30 days after deletion starts.
You, or an individual whose data is processed through TextSend, may ask for earlier deletion or for a copy of what is held about them. See "Your rights and how to contact us" below.
7. Sub-processors
TextSend uses a small number of sub-processors to operate the service: Amazon Web Services (hosting, database, and storage) and Zendesk (Marketplace distribution and checkout). TextSend's data is hosted in the United States, in Amazon Web Services' us-east-1 (N. Virginia) region. Payments go through Stripe, which acts as an independent controller of payment data rather than as a TextSend sub-processor (see the sub-processors page).
Twilio is your own contracted vendor, not a TextSend sub-processor. Your messages are sent and received through your own Twilio account, under your own agreement with Twilio.
The full list, with purpose and data categories for each vendor, is on the sub-processors page.
8. Your rights and how to contact us
Requests about this policy, including requests to access, correct, or delete personal data, go to support@textsend.app.
TextSend has not appointed a Data Protection Officer or an EU or UK representative. The address above is the only contact for privacy requests.
9. Changes to this policy
Material changes will be reflected on this page with an updated "Last updated" date.