MessageOS.ai
Effective Date: January 16, 2026 · Last Updated: January 16, 2026
MessageOS ("MessageOS," "we," "us," or "our") is committed to protecting the privacy and security of personal information. This Privacy Policy describes how we collect, use, disclose, retain, and protect information in connection with the MessageOS platform (the "Platform"), including our AI agent technology branded as Ezra, and all messaging services delivered through Rich Communication Services (RCS) and Short Message Service (SMS) channels.
This Privacy Policy applies to:
(a) Business Clients ("Clients") who use the Platform to send and manage messages.
(b) End Users who receive or interact with messages sent through the Platform on behalf of Clients.
(c) Visitors to the MessageOS website at https://messageos.ai.
By using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Privacy Policy, you should not use the Platform.
When Clients register for and use the Platform, we collect:
(a) Account Registration Information. Business name, business address, contact name, email address, phone number, and billing information necessary to create and maintain a Client account.
(b) Agent and Campaign Registration Information. Brand name, logo, business description, industry/vertical, use case descriptions, sample message content, and other information required for RCS agent registration and SMS campaign registration with Carriers and Google.
(c) Authentication Credentials. Usernames, passwords (stored in hashed form), API keys, and other credentials required to access the Platform.
(d) Billing and Payment Information. Payment method details, billing address, invoice history, and transaction records. Payment processing is handled by third-party payment processors, and MessageOS does not store full credit card numbers on its servers.
(e) Usage Data. Information about how Clients interact with the Platform, including login activity, feature usage, API call logs, dashboard interactions, and configuration changes.
In the course of providing messaging services on behalf of Clients, the Platform processes the following End User information:
(a) Mobile Phone Numbers. Phone numbers to which messages are sent or from which messages are received.
(b) Message Content. The content of messages exchanged between Clients and End Users through the Platform, including text, rich media (images, carousels, suggested actions), and AI-generated responses from Ezra. MessageOS processes End User-initiated message content solely for the purposes of message delivery, AI Agent response generation, and platform compliance monitoring, and for no other purpose. See Section 5.4 for details.
(c) Message Metadata. Delivery status, timestamps, session identifiers, message direction (inbound/outbound), channel type (RCS or SMS), Carrier information, and device capability indicators.
(d) Consent and Opt-Out Records. Records of End User opt-in consent, opt-out requests (including the specific Reserved Keyword used), opt-in confirmations, and suppression list entries. These records include audit logs capturing the method of opt-in, timestamp, consent language presented, the specific Campaign, and the originating source (e.g., web form, QR code, keyword opt-in, Click-to-Message entry point).
(e) Interaction Data. End User responses, keyword submissions, suggested action selections (e.g., button taps in RCS), and conversation flow data.
(f) Device and Network Information. Device type, operating system, RCS capability status, and Carrier identity, as provided by the messaging infrastructure. We do not collect device identifiers (IMEI, advertising IDs) or precise geolocation data from End Users.
When visitors access the MessageOS website, we may collect:
(a) Automatically Collected Data. IP address, browser type and version, operating system, referring URL, pages visited, time spent on pages, and other standard web analytics data.
(b) Cookies and Similar Technologies. We use cookies, pixels, and similar technologies for website analytics, functionality, and security purposes. See Section 10 (Cookies) for details.
MessageOS does not knowingly collect: (a) Social Security numbers or government-issued identification numbers; (b) financial account numbers or credit card information (other than through our third-party payment processor); (c) health or medical information; (d) biometric data; (e) precise geolocation data of End Users; or (f) information from children under the age of 16 (see Section 11).
We use the information we collect to:
We use information to:
We may use aggregated, de-identified data to analyze Platform performance, improve AI Agent accuracy and capabilities, develop new features, and conduct internal research. Such aggregated data cannot be used to identify any individual End User.
MessageOS does not sell, rent, lease, trade, or otherwise make available personal information of Clients or End Users to third parties for their own commercial or marketing purposes. We do not sell personal information as defined under the California Consumer Privacy Act (CCPA), the Florida Digital Bill of Rights (FDBR), or any other applicable state or federal privacy law. We do not use End User data for advertising targeting. We do not share personal information for cross-context behavioral advertising. This commitment applies to all categories of personal information we collect, without exception.
Messages sent through the Platform are transmitted over Carrier networks. As a result, message content, sender information, and recipient phone numbers are shared with the applicable Carrier(s) through whose network the messages are delivered. This sharing is inherent to the operation of RCS and SMS messaging services and is governed by the Carrier's own privacy policies and terms of service.
For RCS messaging, MessageOS uses Google's RCS Business Messaging (RBM) infrastructure. By interacting with messages sent through the Platform via RCS, End Users authorize Google LLC to conduct the data processing activities contemplated under Google's RCS for Business Terms of Service, including the following:
(a) Google may access, store, and process End User data in order to provide and improve RCS for Business. Google acts as a data processor and may process, cache, and store data anywhere Google or its affiliates maintain facilities.
(b) Google may process the contents of messages sent via RCS for Business for the purposes of training Google's AI models to improve spam detection and prevention. By using RCS for Business, MessageOS expressly instructs and authorizes Google and its representatives to process such information, and represents that it has the authority to provide such instruction and authorization.
(c) Google may share aggregated data with partners to improve the messaging experience.
(d) Google retains message-level reporting data for up to 28 days, after which only aggregate data is retained. Aggregate data shared externally has a Time-to-Live (TTL) of 63 days.
(e) Google does not use RCS message content for advertising targeting. Google does not have access to the contents of messages sent by End Users to businesses. However, if an End User reports a conversation as spam, the sender's information and recent messages sent by the business will be shared with Google and may be shared with the End User's Carrier.
(f) Google's RBM infrastructure is independently audited on an annual basis and holds ISO 27001, SOC 2, and SOC 3 certifications. Google's processing of RCS data is governed by Google's RCS for Business Terms of Service, Data Processing Addendum, and Privacy Policy.
This Privacy Policy does not conflict with or supersede Google's RCS for Business Terms of Service in any way, as required by Section 3.3(c) thereof.
MessageOS uses authorized messaging aggregators and infrastructure partners to facilitate message delivery across Carrier networks. Such partners are contractually bound to process data only for the purpose of providing messaging transmission services and are subject to confidentiality and data protection obligations. The identity of MessageOS's authorized aggregator partner(s) is available upon request to Carrier compliance teams. Contact compliance@messageos.ai for aggregator partner information.
We may share information with third-party service providers who perform services on our behalf, including cloud hosting, payment processing, analytics, and customer support. These providers are contractually obligated to use the information only for the specific services they provide to MessageOS and are bound by confidentiality and data protection obligations.
We may disclose information when we believe in good faith that such disclosure is necessary to: (a) comply with a legal obligation, subpoena, court order, or governmental request; (b) protect and defend the rights or property of MessageOS; (c) prevent fraud or other illegal activity; (d) protect the personal safety of End Users, Clients, or the public; or (e) cooperate with Carrier or regulatory investigations into messaging abuse.
In the event of a merger, acquisition, reorganization, asset sale, or bankruptcy, Client and End User information may be transferred as part of the transaction. We will provide notice of any such transfer and any choices you may have regarding your information.
MessageOS does not disclose, sell, rent, or otherwise provide End User personal information to any third party for the purpose of: (a) advertising targeting; (b) data brokerage; (c) compiling marketing lists; (d) consumer profiling unrelated to the Platform's messaging services; or (e) any purpose not described in this Privacy Policy.
With respect to End User personal information processed through the Platform on behalf of Clients, MessageOS acts as a data processor. The Client is the data controller and determines the purposes and means of processing End User data through its use of the Platform.
MessageOS acts as a data controller with respect to: (a) Client account and registration information; (b) billing and payment information; (c) website visitor information; and (d) Platform usage data.
Clients are responsible for: (a) obtaining all necessary consents from End Users for the collection and processing of their personal information; (b) providing End Users with their own privacy policy that accurately describes how End User data is collected, used, and shared; (c) ensuring that their privacy policy complies with all applicable laws and does not conflict with or supersede Google's RCS for Business Terms of Service; (d) responding to End User requests regarding their personal information; and (e) ensuring that their use of the Platform complies with all applicable data protection laws.
When an End User sends a message to a Client through the Platform, MessageOS processes the content of that message solely for the purposes of: (a) delivering it to the Client; (b) where applicable, generating an AI Agent response; and (c) platform compliance monitoring (e.g., detecting abuse or fraud). MessageOS does not independently access, review, analyze, mine, or use the content of End User-initiated messages for any purpose beyond these three functions. End User message content is not used for marketing, advertising, profiling, or sale to third parties.
Consent records and opt-out records are retained for a minimum of four (4) years from the date of collection, in accordance with the TCPA statute of limitations and CTIA requirements. Consent records include: the method of opt-in (e.g., web form, QR code scan, keyword reply, Click-to-Message), the date and time consent was obtained, the specific consent language presented to the End User, the Campaign to which the consent applies, and the originating source. Opt-out records include: the date and time of the opt-out request, the specific Reserved Keyword used, the channel (RCS or SMS), and the Campaign(s) from which the End User opted out. Clients may request longer retention periods through their subscription agreement.
Message content is retained for a period of ninety (90) days from the date of transmission for the purposes of delivery confirmation, dispute resolution, and compliance auditing. After the retention period, message content is permanently deleted from MessageOS systems. Clients may configure shorter retention periods through the Platform settings. This retention period is separate from and in addition to any retention conducted by Google or Carriers under their own data processing policies.
Client account information is retained for the duration of the Client's active subscription and for a period of twelve (12) months following account termination, after which it is permanently deleted unless retention is required by law.
Aggregated, de-identified data that cannot be used to identify any individual may be retained indefinitely for analytics, benchmarking, and service improvement purposes.
Upon termination of a Client account, MessageOS will delete or de-identify Client data within ninety (90) days, except for data that must be retained for legal compliance purposes (including consent and opt-out records as described in Section 6.1).
MessageOS implements industry-standard technical security measures, including:
MessageOS maintains organizational security measures, including employee background checks, security awareness training, confidentiality agreements, and incident response procedures.
In the event of a data breach involving personal information, MessageOS will: (a) notify affected Clients without unreasonable delay and in no event later than seventy-two (72) hours after becoming aware of the breach; (b) provide Clients with sufficient information to enable them to meet their own notification obligations under applicable law; and (c) cooperate with Clients and applicable regulatory authorities in the investigation and resolution of the breach. MessageOS will also comply with all applicable state breach notification laws, including the Florida Information Protection Act of 2014.
End Users may exercise the following rights with respect to messaging received through the Platform:
(a) Right to Opt Out. End Users may opt out of receiving messages at any time by replying with any of the following Reserved Keywords: STOP, UNSUBSCRIBE, CANCEL, QUIT, END, or STOPALL. In compliance with FCC regulations effective April 11, 2025, all opt-out requests are processed in real time upon receipt. The FCC permits up to ten (10) business days for opt-out processing; MessageOS processes all opt-outs immediately. A single, non-promotional confirmation message will be sent to the End User acknowledging the opt-out. No further messages of any kind will be sent unless the End User provides new, valid express consent. End Users may also contact the Client directly or use any other reasonable method to communicate their opt-out request.
(b) Right to Information. End Users may request information about the messaging program by replying HELP to any message received through the Platform. The HELP response will include: the Client's program or brand name, customer support contact information, opt-out instructions, a link to the applicable terms and privacy policy, and a "Message and data rates may apply" disclosure.
(c) Right to Re-Subscribe. End Users who have previously opted out may re-subscribe by sending START, YES, or UNSTOP, subject to the original consent framework remaining valid. A confirmation message will be sent acknowledging the re-subscription.
(d) Right to Request Deletion. End Users may contact MessageOS at privacy@messageos.ai to request deletion of their personal information from our systems. We will process deletion requests within thirty (30) days, subject to our legal retention obligations (see Section 6).
(e) Right to File a Complaint. End Users may report unwanted messages to their Carrier by forwarding the message to 7726 (SPAM). 7726 is the industry-standard short code established by CTIA and supported by all major U.S. Carriers (AT&T, Verizon, T-Mobile, US Cellular) for consumer spam reporting. End Users may also contact their Carrier's customer support directly.
Clients may: (a) access, update, and correct their account information through the Platform dashboard; (b) export their data, including consent records, opt-out logs, and audit trails, at any time; (c) request deletion of their account and associated data by contacting privacy@messageos.ai; and (d) configure data retention periods for message content within the Platform settings.
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):
(a) Right to Know. You have the right to request information about the categories and specific pieces of personal information we have collected, the sources of collection, the business or commercial purposes for collection, and the categories of third parties with whom we share your information.
(b) Right to Delete. You have the right to request deletion of personal information we have collected from you, subject to certain legal exceptions.
(c) Right to Correct. You have the right to request correction of inaccurate personal information.
(d) Right to Opt-Out of Sale/Sharing. MessageOS does not sell personal information. MessageOS does not share personal information for cross-context behavioral advertising. Because we do not sell or share personal information as defined by the CCPA/CPRA, there is no need to submit an opt-out request for this purpose; however, we will honor any such request received.
(e) Right to Limit Use of Sensitive Personal Information. MessageOS does not use or disclose sensitive personal information for purposes beyond those permitted under the CCPA/CPRA.
(f) Right to Non-Discrimination. We will not discriminate against you for exercising your CCPA/CPRA rights.
To exercise your rights under the CCPA/CPRA, contact us at privacy@messageos.ai. We will verify your identity before processing your request and will respond within forty-five (45) days.
Residents of Florida may have additional rights under the Florida Digital Bill of Rights (FDBR), effective July 1, 2024, including the right to access, correct, delete, and obtain a copy of personal information, as well as the right to opt out of the processing of personal data for targeted advertising, the sale of personal data, or profiling. MessageOS does not sell personal data, does not process personal data for targeted advertising, and does not engage in profiling that produces legal or similarly significant effects. To exercise any applicable rights under the FDBR, contact us at privacy@messageos.ai. We will respond within forty-five (45) days.
When Ezra generates responses on behalf of a Client, it may process: (a) the End User's inbound message content; (b) conversation history within the active session; (c) the Client's configured knowledge base, response templates, and business rules; and (d) contextual data necessary to generate relevant responses (e.g., appointment availability, service information).
Ezra does not: (a) retain End User personal information between separate conversations unless explicitly configured by the Client and disclosed to the End User; (b) use End User data from one Client's account to train, improve, or inform AI responses for any other Client; (c) access or process End User data for advertising or marketing purposes outside the scope of the Client's configured Campaign; (d) make automated decisions with legal or similarly significant effects on End Users without human oversight; or (e) collect, store, or process sensitive personal information such as Social Security numbers, payment card numbers, health information, or login credentials.
MessageOS may use aggregated, de-identified conversation data to improve Ezra's general capabilities, including natural language understanding, response quality, and safety features. Such data is stripped of all personally identifiable information prior to use and cannot be attributed to any individual End User or Client. Clients may opt out of contributing aggregated data to AI training by contacting support@messageos.ai. Opt-out requests will be processed within thirty (30) days of receipt.
Clients using Ezra must ensure that their End Users are informed that they are interacting with an AI agent. The Platform provides configurable disclosure messages that are delivered to End Users at the initiation of AI-assisted conversations. Clients may not suppress or disable these AI disclosures.
The MessageOS website uses the following categories of cookies:
(a) Strictly Necessary Cookies. Required for the website to function properly, including session management and security features. These cookies cannot be disabled.
(b) Analytics Cookies. Used to understand how visitors interact with the website, including page views, traffic sources, and navigation paths. We use privacy-respecting analytics tools and do not use cookies for advertising targeting or cross-site tracking.
(c) Functional Cookies. Used to remember user preferences and settings to enhance the website experience.
MessageOS does not use third-party advertising cookies, tracking pixels for retargeting, or cross-site tracking technologies on the MessageOS website or within the Platform. We do not participate in advertising networks or real-time bidding exchanges.
You may manage your cookie preferences through your browser settings. Disabling certain cookies may affect website functionality.
The Platform is not directed at, and is not intended for use by, individuals under the age of 16. MessageOS does not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16, we will take immediate steps to delete such information. Clients are responsible for ensuring that their messaging Campaigns are not directed at children under 16 and that they do not collect or process the personal information of children through the Platform.
The Platform is operated from the United States. If you are accessing or using the Platform from outside the United States, your information may be transferred to, stored, and processed in the United States. By using the Platform, you consent to the transfer of your information to the United States. Google may process, cache, and store data anywhere Google or its affiliates maintain facilities, as described in Section 4.2. MessageOS does not currently operate in the European Economic Area (EEA) or process data subject to the General Data Protection Regulation (GDPR) in the ordinary course of business; however, if GDPR-covered data is processed, MessageOS will implement appropriate safeguards in accordance with applicable law, including execution of standard contractual clauses where required.
In compliance with Google's RCS for Business Acceptable Use Policy, MessageOS requires that Clients provide clear disclosure to End Users at every point of entry before the End User initiates a conversation. Points of entry include but are not limited to: Click-to-Message buttons, QR codes, RCS deeplinks, tap-to-chat buttons, website widgets, and printed materials (such as conference badges or signage).
At a minimum, the point-of-entry disclosure must inform the End User of: (a) the type of content and interactions they should expect from the agent (e.g., "You'll start a conversation with Ezra, our AI assistant"); (b) that message and data rates may apply; and (c) how to opt out (e.g., "Reply STOP to opt out at any time").
Clients are solely responsible for ensuring that all points of entry used in connection with their Campaigns comply with these disclosure requirements. MessageOS provides guidance and templates but does not control Clients' external entry points.
The Platform or messages sent through the Platform may contain links to third-party websites, applications, or services. MessageOS is not responsible for the privacy practices of third parties. We encourage you to review the privacy policies of any third-party services you access.
MessageOS reserves the right to update this Privacy Policy at any time. Material changes will be communicated with at least thirty (30) days' prior notice via email (for Clients) or by posting the updated Privacy Policy on our website with a revised "Last Updated" date. Continued use of the Platform after the effective date of any update constitutes acceptance of the updated Privacy Policy.
If you have questions, concerns, or requests regarding this Privacy Policy or MessageOS's data practices, please contact:
MessageOS Privacy Team
MessageOS
Orlando, Florida
Email: Info@messageos.ai
Website: https://messageos.ai
For Carrier compliance inquiries: Info@messageos.ai
For general support: support@messageos.ai
MessageOS
Orlando, Florida