Privacy Policy
Effective 22 October 2026 · Iris AI LLC
This policy explains what Iris AI LLC (“Iris”, “we”, “us”) collects when you use the Iris AI agent platform, why we collect it, who else sees it, and how to get rid of it. It covers the website, the dashboard at agents.irisai.app, the mobile app, the SMS and iMessage interfaces, and any account you connect to Iris.
If something here does not match what you see the product doing, that is a bug in one of the two and we want to know. Write to contact@irisai.app.
What we collect
You give us
- Account details — name, email address, and phone number if you use Iris over SMS or iMessage.
- What you tell your agent — the messages you send, files you upload, and instructions you write. This is the substance of the product, and it is often personal.
- Configuration — agents, workflows, schedules, and the settings that decide what your agent is allowed to do.
- Payment details — handled by Stripe. We never see or store your card number; we store a customer reference, your plan, and your credit balance.
You authorise us to fetch
When you connect a third-party account, we store an access token and use it only to perform the actions you have configured. You choose which accounts to connect, and you can disconnect any of them at any time.
- Email and calendar (Gmail, Outlook, Google Calendar) — messages, threads, and events your agent needs to read or write.
- Messaging and collaboration (Slack, Discord, Teams, Notion, and others) — the channels, documents, and records you point your agent at.
- CRM and business tools (HubSpot, Salesforce, Stripe, and others) — contacts, deals, and records relevant to the task.
- Instagram — described separately below, because the data belongs partly to people who are not our customers.
We record automatically
- Usage and billing — which agent ran, when, how long, and how many tokens it consumed. This is how credits are metered.
- Technical logs — IP address, browser and device type, and error traces. Kept for security and debugging.
We do not use advertising cookies, and we do not track you across other websites.
Instagram data, specifically
If you connect an Instagram professional account, Iris can answer people who comment on your posts. That involves data about your followers, not just about you, so it is worth being exact.
| Permission | What Iris does with it |
|---|---|
instagram_business_basic | Reads your account’s ID and username, so the dashboard can show which account a workflow will act on. |
instagram_business_manage_comments | Receives comments left on your posts — the comment text, the commenter’s username and ID, and which post it was on — and posts public replies you have configured. |
instagram_business_manage_messages | Sends a single private reply to someone who commented, within Instagram’s seven-day window. Iris does not read your existing DM conversations. |
instagram_business_content_publish | Optional. Publishes posts you or your agent have composed. You can decline this permission and still use comment replies. |
What we keep. A record that a given comment was handled — the comment ID and account ID — so we never send a second reply to the same person. The comment text and commenter handle appear in that workflow run’s history, which is visible to you and is deleted with the run. We do not build profiles of the people who comment on your posts, we do not add them to any list, and we do not use their data for anything other than producing the reply you configured.
What we never do. We do not sell this data. We do not use it to train models. We do not share it with other Iris customers. We do not message anyone who has not first commented on your post.
Your Instagram access token is stored encrypted at rest, expires after about 60 days, and is deleted when you disconnect the account. Disconnecting takes effect immediately.
Publishing to Facebook, Threads, TikTok and YouTube
If you connect any of these accounts, Iris can publish the posts and videos your agent drafts. Nothing is published until you approve it — each draft waits in your Approvals inbox until you click Post now or schedule it. Iris only acts on the account you connected, only to publish, and never reads other people’s content on these platforms.
| Platform and permission | What Iris does with it |
|---|---|
Facebook Page — pages_show_list, pages_read_engagement | Lists the Pages you chose during Facebook Login and reads each one’s ID and name, so the dashboard can show which Page is connected. |
Facebook Page — pages_manage_posts | Publishes the posts you approve to that Page. Iris does not edit or delete posts. |
Threads — threads_basic | Reads your Threads profile’s ID and username, to show which profile is connected. |
Threads — threads_content_publish | Publishes the posts you approve to your Threads profile. |
TikTok — user.info.basic | Reads your TikTok display name and ID, to show which account is connected. |
TikTok — video.publish | Publishes the videos you approve to your TikTok account. |
YouTube — openid, email | Reads the email address of the Google account you connect, to show which account Iris will post with. Iris does not read your videos, comments, subscribers or analytics. |
YouTube — youtube.upload | Uploads the Shorts you approve to that account’s YouTube channel. Iris does not edit or delete videos. |
What we keep. The access token for each account (encrypted at rest and readable only by our backend), the account’s ID and display name, and for each post Iris publishes, its ID and link so you can see it in your history. Tokens are deleted when you disconnect the account.
Google user data and YouTube
Iris’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data from your YouTube account is used only to upload the videos you approve and to show which account and channel are connected. It is not used for advertising, not sold, not shared with other Iris customers, not read by people at Iris except with your permission or where required for security or by law, and not used to train AI models.
Iris uses YouTube API Services. By connecting a YouTube channel you agree to be bound by the YouTube Terms of Service, and Google’s handling of your data is described in the Google Privacy Policy.
How we use it
- To run your agents and workflows — the thing you asked for.
- To meter credits and bill you correctly.
- To keep the service secure and to investigate abuse.
- To support you when you ask for help.
- To meet legal obligations.
We do not train AI models on your content. Your messages are sent to our model provider to produce a response and are not used by us to improve any model.
We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under California law.
Who else processes your data
We use a small number of infrastructure providers. Each receives only what it needs, and each is bound by its own contractual obligations to us.
- Google Cloud and Firebase — authentication, database, and hosting.
- Amazon Web Services — the servers your agents run on.
- Google (Gemini) — the language model that generates agent responses.
- Composio — brokers connections to many third-party apps.
- Twilio and LoopMessage — phone calls, SMS, and iMessage.
- Stripe — payments.
- Brevo — transactional email.
We may also disclose data if the law requires it, or to protect our rights or someone’s safety. If Iris is ever acquired, data may transfer with the business; this policy would continue to apply until you were told otherwise.
How long we keep it
- Account and configuration — while your account is open.
- Agent conversations and workflow runs — until you delete them, or your account closes.
- Connected-account tokens — until you disconnect, or the token expires.
- Billing records — as long as tax and accounting law requires, typically seven years.
- Technical logs — up to 90 days.
Deleting your data
You can delete your data at any time, and you do not need to ask us first:
- A single conversation or workflow run — delete it in the dashboard.
- One connected account — disconnect it in Settings → Integrations, or, for Instagram, Facebook, Threads, TikTok and YouTube, with Disconnect on that account’s card in Settings → Agents. The token is deleted immediately and Iris loses all access to that account.
- Everything — Settings → Account → Delete account. This removes your agents, conversations, workflows, and connected-account tokens.
If you would rather we did it, email contact@irisai.app from the address on your account with the subject “Delete my data”. We will confirm within 30 days.
Deletion is permanent. Backups are purged on their own rotation, within 90 days. Records we are legally required to retain — billing history, for example — survive account deletion, and nothing else does.
Removing Iris from Instagram. You can also revoke access from Instagram’s side: Settings → Website permissions → Apps and websites, then remove Iris AI. Doing so stops all access immediately; email us if you also want the stored record of handled comments erased.
Removing Iris from your other accounts. Disconnecting in the agent’s Social media settings deletes the stored token, and for YouTube also revokes Iris’s access at Google. You can also revoke access from each platform’s side at any time: Google at myaccount.google.com/permissions (this covers YouTube); Facebook under Settings → Business integrations; Threads under Settings → Account → Website permissions; TikTok under Settings → Security → Manage app permissions.
Your rights
Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, receive a portable copy, or object to certain processing. Exercise any of these by emailing contact@irisai.app. We will not charge you or treat you differently for asking.
We are based in the United States and process data there. If you are in the EEA or UK, your data is transferred to the US under the appropriate safeguards.
Security
Data is encrypted in transit and at rest. Access tokens are stored separately from application data and are readable only by our backend. Access to production systems is limited and logged. No system is perfectly secure, and we will not pretend otherwise — if a breach affects your data, we will tell you.
Children
Iris is not for anyone under 13, and we do not knowingly collect their data. If you believe a child has given us information, email us and we will delete it.
Changes to this policy
If we change this policy materially, we will update the effective date above and tell account holders by email before the change takes effect.
Contact
Iris AI LLC
14241 Dallas Pkwy, Ste 600
Dallas, TX 75254
United States
contact@irisai.app