Privacy Policy

1. Information we collect

• Account & workspace information. Your name, email address, workspace name, and sign-in credentials (managed by our identity provider — we never see your password).
• Business verification information. When you enable business texting, U.S. carriers require a verified business identity. We collect your legal business name, business type, address, website, and an authorized contact. Your EIN is submitted directly to our carrier partner for verification; we retain only the last four digits, and the stored business record is kept in encrypted credential storage.
• Content you and your team share with agents. Messages, documents, images, emails, text messages, and (when voice launches) call audio and transcripts that you send to — or authorize an agent to access on — the Service.
• Connected-service data. When you connect tools (for example Google Workspace, QuickBooks, Todoist), we access only the data those grants permit, to let your agents do the work you've asked for. OAuth tokens are held in an encrypted vault and are never exposed to the agent's model context.
• Usage & device information. Log data, feature usage, and diagnostic telemetry that keep the Service reliable and secure.
• Billing information. Payment details are collected and processed by Stripe; we do not store your full card number.

2. How we use information

• To provide the Service — including having your AI agents read, draft, and act on the content you direct them to, within the autonomy limits you set.
• To route communications (texts, emails, calls) between your team and your agents.
• To verify your business identity with carriers as required for business texting.
• To bill you, support you, secure the Service, and prevent abuse.
• To improve the Service using aggregate, de-identified usage patterns.

We do not train foundation AI models on your data, and we do not sell your personal information. Each workspace is isolated — your data is never visible to another customer's workspace or agents.

3. Text messaging (SMS/MMS)

Roster texting lets members of your team exchange text messages, including photos, with your workspace's AI agents over a dedicated phone number provisioned for your business.

• Consent. Team members are enrolled by the workspace owner or an administrator, who confirms each person has agreed to take part in the workspace's messaging program. Enrollment records (who was added, when, and by whom) are retained as the program's consent evidence. Consent to receive messages is never a condition of purchasing any good or service.
• Opting out. Text STOP at any time to stop receiving messages; text START to rejoin; text HELP or email support@heyroster.ai for help. Opt-outs take effect immediately and are honored automatically.
• Message frequency varies by how your team uses its agents. Message and data rates may apply per your mobile carrier's plan. Carriers are not liable for delayed or undelivered messages.
• No third-party marketing use — ever. We do not share, sell, rent, or otherwise provide your mobile phone number, SMS opt-in status, or any messaging-consent information to third parties or affiliates for their marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third party, excluding the aggregators and providers of the text-message services necessary to deliver your messages.
• Message content is processed by your workspace's agents to do the work you've asked of them (for example, logging a service request from a texted photo) and is retained as part of your workspace's records until you delete it or close your account.

4. Email

When you connect an email account or an agent is given an email address, agents may read, draft, and — subject to the approval settings you control — send email on your behalf. Email content is used solely to provide the Service to your workspace. We do not use your email content or contact lists for advertising, and we do not sell or share them with third parties for marketing purposes. Outbound email sent by agents complies with applicable anti-spam law, including working unsubscribe mechanisms where required.

5. Voice calling

When voice features are enabled for your workspace, your agents may place and answer phone calls on your behalf.

• Recording & transcription. Calls with agents may be recorded and transcribed so the agent can do its work and so you have a record. Where the law requires it, participants are notified at the start of a call. You are responsible for using call recording consistently with the consent laws of your and your callers' jurisdictions.
• AI disclosure. Agents identify themselves and do not impersonate humans.
• Use of call data. Recordings and transcripts belong to your workspace, are used only to provide the Service, and follow the same retention and deletion rules as your other content.
• Emergency services. Roster numbers do not support 911 or other emergency calling.

6. When we share information

We share information only as needed to run the Service:

• Service providers (subprocessors) that operate under contract with us — for example: AI model providers (such as Anthropic) that process content to generate agent responses; Twilio for text and voice delivery and carrier compliance; Stripe for billing; our cloud hosting providers for infrastructure. Providers may use your data only to provide their service to us.
• Services you connect. When you connect a third-party tool, data flows to and from it under your instruction and that provider's own terms.
• Legal. When required by law, to protect the rights and safety of Roster and its users, or in a business transfer (with notice).

We never sell personal information, and — as stated above — mobile numbers and messaging consent are never shared for third-party marketing.

7. Security

Data is encrypted in transit (TLS) and at rest. Credentials, tokens, and business verification records live in an encrypted vault, separated from application data. Workspaces are isolated from one another, and sensitive agent actions are gated by the approval and autonomy controls you set. Read more on our Security page.

8. Retention & your choices

• Workspace content is retained while your account is active. You can delete content, remove team members from the texting allowlist, disconnect services, or close your workspace at any time.
• When you close your workspace, we delete or de-identify your content within a commercially reasonable period, except records we must keep (for example billing records and carrier-mandated consent logs).
• You may request access to, a copy of, or deletion of your personal information at privacy@heyroster.ai. We honor applicable rights under U.S. state privacy laws.

9. Children

The Service is for business use and is not directed to anyone under 18. We do not knowingly collect information from children.

10. Changes to this policy

We'll post updates here and update the date above. For material changes, we'll notify workspace owners by email or in the app.

11. Contact us

Hearn Ventures LLC (Roster)
6688 Nolensville Rd, Ste 108 #2175, Brentwood, TN 37027
privacy@heyroster.ai