This policy explains how InEngage LLC, a Wyoming limited liability company in the United States (“InEngage”, “we”), handles personal data. It covers two groups of people:
- Account holders: business owners and team members who sign up to InEngage. For their data we are the controller.
- Customers of a business: people who send a booking request, open a quote or exchange messages with a business that uses InEngage. For their data the business is the controller and we process it on the business’s instructions, under our Data Processing Agreement. If you are a customer, the business you contacted is the first place to ask about your data.
Contact for privacy questions: admin@inengage.com.
1. Data about account holders
What we collect
- Your name, email address and password. These are needed to create an account; without them we cannot create one. We store the password only as a one-way hash.
- If you turn on two-step sign-in: the secret for your authenticator app and your backup codes.
- Your sessions: the IP address and browser of each signed-in device, so you can see and sign out devices.
- Your role in each business you belong to, and invitations you send or receive.
- The business details you enter: name, country, currency, contact email, WhatsApp number, social links, payment-method details you show customers, and your crew members’ WhatsApp numbers.
- When you set up a business: the public details we find about it, from its Google listing (including public reviews) and pages of its website.
- When you create your account: the Terms and Privacy Policy versions you agreed to, and any campaign tags or ad click ID in the link you followed to sign up.
- Your subscription status and the customer reference our billing reseller gives us.
- A record of AI features used and set-up steps completed, so we can keep AI use within your plan’s allowance.
Why, and on what legal basis
- To perform our contract with the business owner: providing the account, the businesses and sign-in, and managing the subscription.
- Our legitimate interests:
- giving accounts to the team members a business invites, so they can work in it;
- keeping the service secure and preventing abuse: sign-in limits, bot checks and records of who changed what;
- sending service emails: verification, password resets, invitations, trial reminders and notices about your customers’ activity;
- counting which of our adverts and campaigns bring sign-ups, from the campaign tags and ad click ID kept with your sign-up.
- Legal obligations: keeping the records the law requires and answering lawful requests.
You can object at any time to processing based on our legitimate interests; email us and we will stop unless we have compelling grounds or need the data to deal with a legal claim. We do not send marketing email.
AI features suggest settings and draft website text for the owner to review. We do not make decisions about anyone by automated means that have legal or similarly significant effects.
2. Data about a business’s customers
When you send a request to a business through its InEngage form, or open the quote it sends you, InEngage stores on the business’s behalf:
- your name, and the phone number and email address you give;
- the details of your request: dates, times, the address of the job (and its map position), your answers to the business’s questions, and any photos you upload;
- the address of the page you came from, and any campaign tags in the link you followed to the form;
- messages between you and the business, and the quote, booking and payment records the business keeps;
- when you first and last opened your quote page, and which messages you have seen, so the business knows you have read them.
Photos have their location, camera and date details removed before they are stored. They are kept in private storage and shown only through viewing links that expire after 24 hours; the photo itself is kept as set out in section 4.
3. Who we share data with
Service providers process data for us, on our instructions. Each receives only what its job needs.
| Provider | What it does | What it receives |
|---|---|---|
| Cloudflare | Hosting, database, file storage, bot checks (Turnstile), custom domains | All stored data; for bot checks, the check token and your IP address |
| Resend | Sending email | Sender, recipient, reply-to address, subject and message text |
| Google (Places, Geocoding) | Finding a business’s listing; turning an address into a map position | A business name or search text; the address typed into a booking form |
| Anthropic | AI research and website drafting | A business’s public listing, its website text and reviews, and the owner’s own words. Customers’ requests, contact details, quotes and messages are not sent. |
| Firecrawl | Reading a business’s website during set-up | The website address |
| Nager.Date | Public holiday dates | A country code and year only |
Companies that use data for their own purposes receive it directly and handle it under their own privacy policies:
| Company | When | What it receives |
|---|---|---|
| Polar | Selling and billing subscriptions, as merchant of record | The plan chosen, the business reference, and the payment and billing details you give at checkout |
| Google Fonts | Only when an admin picks one of the extra typefaces in the app’s appearance menu | The admin’s IP address and browser details |
| CARTO / OpenStreetMap | Map images in the app’s delivery settings | Your IP address, when the map loads |
We do not sell personal data, and we do not send data to advertising platforms. If we start reporting sign-ups from adverts to an advertising platform, we will update this policy first and ask for consent where the law requires it.
International transfers. InEngage LLC is in the United States, and our providers may process data there and in other countries where they operate. For personal data from the EU or UK, we use the European Commission’s standard contractual clauses and the UK addendum, as set out in our Data Processing Agreement, and for our providers their certification under the EU–US Data Privacy Framework or the standard contractual clauses in their data processing terms. You can ask us for a copy of these safeguards.
4. How long we keep data
| Data | How long |
|---|---|
| Set-up research about a business | 30 days, or for as long as the business it helped set up exists |
| Records used to limit repeated requests (these hold an IP address) | 64 days after the last request |
| A demo business | 90 days after its last activity |
| Queued emails | 90 days after they are sent |
| Photos on a request | Until the business removes them, or 24 months after the request ends |
| Photos uploaded but never sent | 7 days |
| Billing event details from Polar | 365 days; a short record that each event arrived is kept so it is never processed twice |
| Your sign-up record (agreed versions, campaign tags, ad click ID) | For as long as your account exists |
| Activity history and payment records | For as long as the business’s records exist, so the history stays complete |
| Accounts, businesses, requests, customers and messages | While the account or business is open |
| A paused business | Kept. We email the owner at least 60 days before we delete a paused business |
| A business or account you ask us to delete | Deleted within 30 days of your request, except what the law requires us to keep |
| A customer the business erases | Their name, contact details, address, answers, messages, notes and photos are removed; amounts, dates and the activity history stay so the business’s books still add up, including any note written on a payment |
Our clean-up runs once a month, so data can be deleted up to a month after the period shown. Deleted data can remain in our database backups for up to 30 days before it is gone.
5. Cookies and storage in your browser
InEngage uses only what it needs to work. We do not use advertising or tracking cookies.
- Sign-in: a session cookie keeps you signed in for up to 7 days, and a short-lived cookie holds the two-step sign-in step.
- App preferences: whether the side menu is open (a cookie), and your theme, colours, font and Inbox layout (stored in your browser).
- Bot checks: Cloudflare Turnstile runs on sign-up and on booking forms and may set its own cookies.
- This website (inengage.com): remembers your light or dark choice in your browser. It sets no cookies and runs no analytics.
- Customer pages (quote, booking and crew pages) set no InEngage cookies. A business’s booking form embedded on its own website may remember its words in that site’s browser storage.
6. Security
Data travels over HTTPS only. The database is encrypted at rest. Passwords, reset links and verification links are stored only in hashed form. Access in the app is checked on our servers by role and business. Two-step sign-in is available to every account. Only InEngage staff who need it to run the service, or to answer a support request, can reach stored data.
If we become aware of a personal data breach, we will assess it and give the notifications the law requires. Where we process personal data for a business, we will notify that business without undue delay, as set out in our Data Processing Agreement.
7. Your rights
Depending on where you live, you can ask to see, correct, delete or export your personal data, to restrict how we use it, and to object to processing based on our legitimate interests. Where we rely on your consent, you can withdraw it at any time. You can also complain to the data protection authority where you live or work.
Account holders: email admin@inengage.com and we will answer within one month. Customers of a business: contact that business first; we help businesses answer these requests.
8. Children
InEngage is for businesses and is not meant for anyone under 18.
9. Changes
We will post any change here with a new version and date, and tell account holders by email or in the app before a material change takes effect.