Privacy Policy
Effective November 7, 2026
Agapi Media (“Agapi Media”, “we”, “us”) provides a dashboard that marketing agencies and the local businesses they work with, mostly dental practices, use to see where their leads come from, answer them, and run their marketing. This policy explains what information Agapi Media handles, why, who else handles it, and the choices you have. It covers Agapi Media’s dashboard, the Agapi Media tracking script on our customers’ websites, and the ways the dashboard connects to other services.
The short version
- We don’t sell personal information, use it for advertising, or build profiles of people across businesses.
- Patients’ and leads’ contact details are encrypted when stored, every view of them is logged, and they’re never sent to AI services.
- A mailbox connected with “Sign in with Google” or “Sign in with Microsoft” is used only to send emails a person approved and to read the replies to those emails. Nothing else in it is opened.
- You can ask us at support@agapimedia.com to see, correct or delete information about you.
1. Whose information this is
- People who sign in to the dashboard: agency staff, and staff of the businesses the agency works for.
- Visitors, patients and callers of our customers’ businesses: people who visit their websites, send a form or call a tracking number. The business decides how this information is used, and we handle it on the business’s behalf. For healthcare practices, that is under a business associate agreement where HIPAA applies. Questions about it are best sent to that business, and we’ll help it answer.
- People who connect an account to the dashboard: a mailbox, a Facebook or Instagram Page, or a website.
- Businesses and website owners contacted through outreach emails sent from the dashboard.
2. What we collect
Accounts
Name, email address, role and the businesses an account can see. A password, stored only as a salted hash. Sign-in times, and an audit log of who viewed contact details and who changed settings.
Website visits (the tracking script)
When a customer adds Agapi Media’s script to its website, we record the pages visited, the page or site that sent the visitor, campaign tags in the address (such as utm_source), whether an ad click ID was present (not the ID itself), the device type, browser, operating system, language, and the country reported by the network. Visits are tied together with a random ID kept in the browser’s local storage; the script sets no cookies. The visitor’s IP address is used only briefly to block abuse and is not stored. Anyone can turn this off for their browser by opening a page of the website with ?agapi_optout=1 added to its address.
Leads
What a person types into a website form, usually their name, phone number, email address and message, with the visit that led to it. Contact details are encrypted when stored. If the business turns on phone verification, a one-time code is sent to the phone number by text or call. If the person ticks the form’s box to receive texts, they get a text confirming the request arrived.
Calls to tracking numbers
The caller’s number, the time, how long the call lasted and whether it was answered. Calls are not recorded.
Robot check
On forms that use it, Cloudflare Turnstile checks that a person, not a robot, sent the form.
Connected accounts
Access tokens to act for the account (stored encrypted), and the account’s name and email address. Sections 5 and 6 say exactly how they’re used.
Marketing work
The business’s brand profile, social posts, articles, pictures and photos; search data from Google Search Console and DataForSEO; and outreach records: websites found, their public contact addresses, the emails sent and the replies to them.
3. How we use it
- To provide the service the customer uses the dashboard for:
- showing reports;
- alerting the business to new leads;
- publishing what the business approved;
- sending outreach emails a person approved, and reading the replies to them.
- To keep it secure and working: audit logs, limits against abuse, and fixing problems.
- To support our customers when they ask us for help.
We don’t sell personal information, use it for advertising, or combine information about people across different businesses.
4. AI services
The dashboard uses AI services to draft social posts, articles and outreach emails, and to make pictures. These requests carry the business’s own marketing information: its brand profile, public web pages and search terms. They never include lead or patient information.
One exception concerns the agency’s own outreach to other businesses. Replies to those emails may be sent to our AI provider, Anthropic, so it can suggest what kind of reply each one is. Names, email addresses and phone numbers are removed first. Replies to a client business’s emails are never sent to an AI service.
5. Google user data
A person can connect a Gmail or Google Workspace mailbox to the dashboard with “Sign in with Google”. Agapi Media then receives the mailbox’s email address and name, and permission to use the mailbox over IMAP and SMTP. That permission (https://mail.google.com/) is the one Google requires for IMAP and SMTP.
How Agapi Media uses it
- To send outreach emails from that mailbox, one at a time, each one approved by a person.
- To find the replies to those emails. The dashboard only opens messages that answer an email it sent from that mailbox, matched by the email’s message ID. It never searches the mailbox by sender or by content.
- To recognize bounce notices and opt-out requests for those emails, so that nobody who asked not to be contacted is emailed again.
The dashboard reads the mailbox read-only. It never marks, moves or deletes a message, and it doesn’t read, search or keep anything else in the mailbox.
Storage and sharing
- Storage: the access tokens and the text of replies to the dashboard’s emails are stored encrypted on our servers in the United States.
- Who reads replies: only the customer’s own staff, in the dashboard.
- Our own staff: they don’t read Google user data, except with the customer’s permission to help with a support request, when needed for security, or when the law requires it.
- Sharing: Google user data isn’t sold, used for advertising, or shared with anyone else, except:
- our hosting provider, which stores it encrypted;
- the AI step in section 4, which applies only to the agency’s own mailbox, with contact details removed.
- AI training: Google user data is never used to develop, improve or train AI or machine-learning models.
Removing access
- In the dashboard: disconnecting the mailbox deletes the tokens and hands the access back to Google.
- In your Google Account: you can also remove Agapi Media at any time at myaccount.google.com/permissions.
Agapi Media’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6. Microsoft, Facebook and Instagram
- Sign in with Microsoft (Microsoft 365 or Outlook.com mailboxes) works exactly as described for Google in section 5: sending approved emails, and reading only the replies to them. One mailbox works slightly differently. The agency’s own Microsoft 365 mailbox may connect through Microsoft Graph, and then the replies are found within each email’s conversation. You can remove Agapi Media from your Microsoft account’s app permissions at any time.
- Facebook and Instagram: when a person connects a business’s Facebook Page and Instagram account, the dashboard uses them only to publish the posts the business approved, at their scheduled times, and to read the Pages’ names. You can disconnect them in the dashboard or in Facebook’s Business Integrations settings.
7. Who else handles information
We use these service providers to run the dashboard. Each one handles only what its job needs.
| Provider | What for | What it handles |
|---|---|---|
| Amazon Web Services | Hosting, and sending notification emails | The data the dashboard stores, encrypted where noted above |
| Twilio | Tracking phone numbers, call forwarding, texts and verification codes | Phone numbers, call details and the text of those messages |
| Cloudflare | The robot check on forms | A check of the form visitor’s browser |
| Anthropic | AI writing | Business marketing information; replies to the agency’s own outreach, with contact details removed |
| AI pictures, Search Console data, and Sign in with Google | Picture descriptions; search data; the connected mailbox | |
| Microsoft | Sign in with Microsoft | The connected mailbox |
| Meta | Publishing approved posts | The posts and pictures |
| DataForSEO | Search rankings and keyword data | Search terms and public web pages; no personal information |
| GitHub, WordPress | Publishing approved articles to a business’s website | The articles and their pictures |
We may also disclose information when the law requires it, or to protect the safety, rights or property of people or of Agapi Media. If Agapi Media is ever sold or merged, this policy would continue to apply to the information we hold.
8. Security
All traffic uses HTTPS. Contact details of leads, and the tokens of connected accounts, are encrypted when stored. Access depends on each person’s role, and views of contact details are logged. No system is perfectly secure. If we learn of a breach that affects your information, we’ll notify the affected customers, and anyone else the law requires us to notify.
9. How long we keep it
We keep information while the customer uses the dashboard. When a customer stops using the dashboard, or asks us to, we delete its information. Copies in our backups are overwritten within 14 days. Disconnecting an account deletes its tokens straight away.
10. Your choices and rights
- Leads and patients: to see, correct or delete what you sent a business, contact that business. You can also write to us, and we’ll pass your request on and help the business answer it.
- Everyone else: write to support@agapimedia.com to see, correct or delete information about you. We answer within 30 days.
- Website tracking: open a page with
?agapi_optout=1added to its address to stop it in your browser. - Outreach emails: every email has an opt-out. Once you ask, you won’t be emailed again.
- Connected accounts: disconnect them in the dashboard, or remove Agapi Media in your Google, Microsoft or Facebook account settings.
Depending on where you live, you may have more rights under privacy laws such as the CCPA or the Texas Data Privacy and Security Act, and we honor them.
11. Children
Agapi Media’s dashboard isn’t meant for children, and we don’t knowingly collect information from children under 13. If you think a child has given us information, contact us and we’ll delete it.
12. Changes and contact
When we change this policy, we’ll update the date at the top, and we’ll tell our customers about important changes before they take effect. For any question or request, contact Agapi Media at support@agapimedia.com.