textBob Privacy Policy

Effective November 6, 2026.

textBob is controlled by Chitlabs LLC. This policy explains how we handle information when you visit textbob.io, use app.textbob.io, contact us or use the textBob assistant. Contact us about privacy at Justin@textbob.io.

Information we use

We use your phone number and account identifiers to verify sign-in, connect your messaging identity to your account and protect access. We keep workspace membership, roles, connection permissions, language and messaging preferences so that the service can apply your choices.

When you use the assistant, we process your requests, responses, relevant conversation context, attachments and records needed to perform the work you authorize. Task and action records can include proposed changes, approval decisions, external record identifiers, results and delivery status. Website and service providers also process technical information such as IP addresses, browser details, request times and security events to deliver and protect the service.

Connecting an external account is optional. If you connect Google, the permissions you grant can allow textBob to read relevant Gmail messages, find and read accessible Drive files, and create or edit Google Docs and Sheets or send email for your authorized requests. If you connect Jobber, permitted operations can read or change the business records covered by that connection and your textBob permissions. Available operations depend on the provider account, its granted permissions and features enabled for your workspace.

Why we use information

We use information to authenticate you; provide requested answers and actions; apply access and approval rules; maintain task history and truthful action and delivery records; respond to support requests; prevent abuse; recover the service; and meet legal obligations. Relevant request and connected-account content may be processed by AI services to understand your request, produce an answer or prepare an authorized action. AI output can be inaccurate, so review important results and proposed changes.

Personal connections and company information

Your personal connections are available to you in the workspace where you connected them. Connecting your personal Google account does not give coworkers or workspace administrators general access to it. An administrator may separately choose particular Google files or folders as company resources. Authorized members can then use those resources under the chosen policy; a selected folder can include future files and subfolders. Information already delivered to a person cannot be withdrawn by later revoking a grant.

Workspace connections and company resources are shared according to current membership, roles and resource permissions. People authorized to approve an action can see the information needed to review that action. A private conversation does not automatically become company knowledge.

Providers that process information

We use service providers to operate textBob. Clerk handles authentication and verification messages; Supabase stores application records; Vercel hosts the website, application and background execution and routes model requests; OpenAI processes the relevant content in those AI requests; AWS stores and scans supported attachments; Composio brokers authorized external-account connections and operations; Linq carries supported text conversations; and Namecheap Private Email handles email sent to our support address. Each receives the information needed for its function. Google and Jobber also process requests made to accounts you connect under their own terms and policies.

We configure supported AI requests to disallow prompt training and require zero data retention, and use Composio's project-specific zero data retention setting for supported connection operations. These settings do not mean textBob itself stores no data: account information, task history, necessary source evidence, attachments and action records have the purposes and retention described here.

We do not sell connected-account information or use it for advertising. We do not use Google Workspace data to train general-purpose AI models. textBob's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Human access to Google-derived information is restricted to the circumstances that policy permits, such as your specific consent, necessary security investigation or legal requirements.

Storage and retention

We retain account and workspace settings while needed to provide your account. Requests, conversation history and necessary source evidence remain while needed to perform and explain your work. Disconnecting an account stops new use of that connection; it does not undo completed external changes or automatically erase earlier task and action records.

The service has cleanup rules for expired connection and onboarding links, temporary provider-event records, closed attachments, eligible inactive conversations and older security and action receipts. Unresolved tasks, pending delivery, uncertain external effects and required audit or legal records can prevent an item from being eligible for routine cleanup. Deleting data from active systems does not immediately remove protected backup copies; those copies are restricted and removed through the backup lifecycle. Contact us for deletion or a specific retention question.

Your choices and requests

You can disconnect a personal integration in textBob and revoke its access in the provider's account settings. Workspace administrators manage workspace connections and company-resource grants. Disconnecting textBob does not delete original messages, documents or business records at Google, Jobber or another provider.

Email Justin@textbob.io to request access, correction or deletion of your personal information or account. We verify your identity and authority before acting and explain any information that must be retained for security, unresolved effects or legal reasons. For information controlled by your business, its authorized administrator may also need to be involved. Rights and available remedies depend on applicable law.

For supported text conversations, reply STOP to opt out, START to resume or HELP for assistance. Authentication codes and connection approvals remain separate from promotional messaging consent. Essential authentication and security cookies support sign-in; the marketing site does not include an advertising tracker in the current release.

Security and changes

We use access controls, encryption and separate staging and production resources to protect information. No service can guarantee absolute security or uninterrupted availability. We will update this policy when our practices change and provide additional notice or obtain consent when required. The effective date identifies the applicable version.