Terry Limited LLC, a limited liability company formed under the laws of the Commonwealth of Pennsylvania, United States ("Terry Limited LLC", "we", "us", "our"), operates the Terry service and the website at https://terryai.io.
Effective date: 2 November 2026. Version: 1.4.
This policy covers visitors to our website, the people who use Terry under a Customer's account ("Users") and the people a Customer contacts through Terry ("Contacts"). Section 9 is written for Contacts. Capitalised terms not defined here have the meaning given in the Terry Terms of Service (the "Terms").
1. Who we are and the roles we play
1.1 What Terry does. Terry is a hosted AI sales development service. Businesses ("Customers") use it to draft and send outreach email from their own mailboxes or a mailbox pool, read replies, book meetings and hand warm conversations to their sales reps. Add-ons cover LinkedIn messaging, messaging apps (WhatsApp, Instagram and Telegram), texting and calling, CRM sync, and Terry Call video calls with optional call notes and an optional AI voice.
1.2 For Contact data, the Customer decides and we act. The Customer supplies the Contacts, attests the lawful basis for contacting each one, and tells Terry what to send. For that information the Customer is the controller, and the "business" under the California Consumer Privacy Act and the other state privacy laws that use that term, and Terry Limited LLC is its service provider (the processor). We process Contact data only on the Customer's instructions. Our duties as processor are in the Data Processing Addendum ("DPA").
1.3 For account, billing and website data, we decide. For Users' account details, billing details, website visits, support conversations and our own service email, Terry Limited LLC is the controller.
1.4 Where Terry runs. Terry is hosted by us on Amazon Web Services ("AWS") in region US East (Northern Virginia), us-east-1. Each Customer's data is kept in a database private to that Customer on infrastructure we share across Customers. Dedicated environments are available by Order Form.
1.5 Powered by ContextBus. The AI orchestration behind Terry (prompts, the Customer's rules, knowledge search, metering) is provided by ContextBus, operated by ContextBus LLC, a company under common ownership with Terry Limited LLC. ContextBus LLC is our Sub-processor and is bound by the same restrictions we are, including no training on Customer data.
2. Information we collect
2.1 Contact data (Customer is accountable, we are processor). Name, work email address, company, title, phone number, LinkedIn profile URL, country or region, consent status and basis, the messages sent to the person and their replies, engagement events (delivered, opened, clicked, replied, booked) and suppression status (unsubscribed, STOP, do not contact); the Contact's handle or number on a messaging app, messages and reactions exchanged there, and references to files they send (the files themselves are fetched from the platform when viewed and are not stored by us); for Instagram, public profile counts, account type and links, and, when a Contact shares an Instagram post or reel, the public link to it with its author and a short caption (the image or video is not stored). Source: the Customer, by upload or CRM sync; the Contact, by replying, clicking or booking; or a Connected Account, when a Contact writes to it or a User searches or reads through it.
2.2 Attestation records. Who attested the lawful basis for a list, when, the basis described and which list. Kept as compliance evidence.
2.3 User account data (we are accountable). Name, work email, password hash, multi-factor authentication seed, role, login history and support messages.
2.4 Connected Account credentials. OAuth tokens for Google or Microsoft, SMTP and IMAP credentials for a plain mailbox, tokens for mailboxes and LinkedIn accounts connected through Unipile, and tokens for CRMs, all given by a User when connecting the account. Telephone numbers are not in this list because we buy and run those ourselves. Tokens are encrypted at rest and deleted on disconnect.
2.5 Mailbox and calendar data. Messages Terry sends from a connected mailbox, inbound replies, bounces and unsubscribe requests to those messages, free and busy windows and the meeting events Terry creates. To find replies, Terry looks at recent messages in the mailbox's inbox. It keeps only what this section describes and, where message requests are on, a first message from a person who is not yet in the workspace (section 2.14). It does not keep other mail.
2.6 Data from accounts connected through Unipile (only if used). Unipile connects a User's own accounts: Gmail and Microsoft mailboxes, LinkedIn, WhatsApp, Instagram and Telegram. Where it carries a mailbox, the data is the mail described in 2.5. For LinkedIn it is profile URLs, connection and invitation status, message text, the results of searches the User runs, and the people who reacted to or commented on the User's own posts. For messaging apps it is the conversations with the people who wrote to the account, or to whom a User chose to write, as described in 2.1. For an Instagram business account it also covers the posts an Admin publishes from Terry and the comments people leave on the account's own posts. Finding a person (a search, or a list of people who engaged with a post) is not contacting them: anyone found this way is contacted only through the same consent checks as any other Contact.
2.7 Texting and calling data (only if enabled). Phone numbers, message text, STOP and HELP replies, call metadata and, where a call is recorded with announced consent, the recording. Delivered through Twilio.
2.8 Engagement tracking data. See section 4.
2.9 Billing data. Plan, usage and statements. Payment is taken by Paddle, our merchant of record. We receive the billing name, address, tax details and the card brand and last four digits. Full card numbers never reach us.
2.10 Website data, cookies and browser storage. Server logs (IP address, browser type, time, pages requested) and application logs. Logs do not contain message bodies or verification codes.
The Service sets no cookies on the website or in the dashboard, and uses no analytics, advertising, tag manager or session replay script. It does store a small amount of information in your browser, which is not a cookie but is storage on your device, so we describe it here:
All of it is first party, none of it is shared with anyone, and none of it follows you to another site. Because we do not track visitors across sites, a Do Not Track or Global Privacy Control signal changes nothing about what we collect.
Our checkout page loads Paddle's script so a card can be taken. Paddle may set cookies or storage of its own under its own privacy notice; see section 8.1. The only cookie we set anywhere is a session cookie on an internal staff console that no Customer can reach.
2.11 Research data. On the Customer's instruction, and only for a Contact already in their workspace,
the Service reads publicly available pages about that Contact and their company: the company website,
public professional pages, results from a web search, and the Contact's LinkedIn profile where the
Customer has connected their own account and switched that feature on. Running that search sends the
Contact's name, together with their company or their job title, to ContextBus LLC, which is named in
section 8.1 and which runs the search inside the model call. We never send a Contact's email address or
telephone number to a search provider. We keep
what it found, and for every fact we keep the address of the page it came from, so the Customer can
check it and so we can show where it came from. We also keep the list of pages that were read and the
search terms used.
2.12 What we do not do. We do not scrape, buy or enrich Contact data on our own initiative: research
runs only when a Customer asks for it, about a person that Customer has already entered. We are not a
data broker. We do not sell, licence or share Contact data, we do not combine Contacts across
Customers, and nothing learned about a Contact in one workspace is available in another. We refuse
people search sites, background check sites and contact data vendors as sources. We do not infer or
guess a person's email address or phone number. Any act of scraping or buying data is the Customer's
and is governed by the Acceptable Use Policy.
2.13 Accuracy of research. Research is a best efforts reading of public sources on the day it runs,
and it can be incomplete, out of date or about a different person with the same name. We store the
source of every fact so that it can be checked and corrected. A person who believes we hold something
inaccurate about them can contact us under section 9, and we will act on it with the Customer whose
workspace holds the record.
2.14 Message requests and muted people (only if used). Where a Customer has message requests on, a message from a person who is not yet in the workspace, sent to a connected mailbox or messaging account, is stored and held for the owner of that account. It is not added to a list, drafted for, answered automatically or shown to the rest of the team unless the owner lets it in. The owner may hide it or mute the sender. Bulk mail and mail from the mailbox's own domain are not treated as a request. Each User may keep a personal list of people they have muted, which only that User's notifications follow. A request to stop being contacted is honoured on every channel whatever these settings say.
2.15 Terry Call video calls (only if used). Terry Call is a video call we host on AWS with LiveKit media server software that we run ourselves, so LiveKit is not a separate recipient of anything. Sound and video pass through our media server to the other participants and are not recorded. Background blur and noise suppression run inside the participant's own browser. We keep the room, who joined under which display name and when, the chat messages sent in the call when notes are on (2.16), and each answer a participant gives to the notes and voice notices, with the wording shown, its version, the time and the browser type. Everything the call page runs, including the blur and noise suppression components, is served from our own servers, so no content delivery network or other third party sees who is on a call.
2.16 Terry notes (only if used). Before anything is transcribed, every participant other than the host is asked on their own screen whether they agree. A participant may join without notes or stop notes at any time, and then nobody on that call is transcribed. Notes pause while anyone in the call has not agreed. While notes are on:
The transcript is used for the notes and the suggestions on that call and for nothing else. It is not used to train any model.
2.17 Terry's voice in a call (only if used). Where the host asks Terry to take the call, Terry's lines are turned into speech by Amazon Polly in our AWS account. Polly receives only the words Terry is about to say. Terry's voice is used only when every participant other than the host has agreed to notes and then chosen to continue after a second notice; it always says first that it is an AI assistant, and any participant can ask for the host. What Terry says is kept in the transcript, labelled as Terry.
3. How we use information
3.1 To provide the service: draft messages, send them, deliver our own service email (verification codes, notifications, booking confirmations), receive and classify replies, book meetings, host video calls and, where every participant agreed, transcribe and summarise them, honour unsubscribe and STOP requests and hand conversations to Users. Ask Terry, the in-product assistant, answers how-to questions from our help center at https://terryai.io/help.
3.2 To run the Compliance Gate: record jurisdiction and consent basis per Contact, block sends that fail the CASL or CAN-SPAM checks, and keep a send-audit trail showing which rule set applied to each message.
3.3 To protect deliverability, operate accounts (authentication, billing through Paddle, notifications, support) and keep the service secure and lawful.
3.4 We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use Contact data to build profiles for anyone other than the Customer who supplied it.
4. Open and click tracking in sent email
4.1 Email sent through Terry may include a small tracking image and links rewritten to pass through a Terry address. When a Contact opens the message or clicks a link, Terry records the event, the time, the IP address and the browser type, so the Customer can see engagement, stop sending to people who are not interested and detect problems.
4.2 A Customer may turn open tracking, click tracking or both off in settings. Some mail clients block tracking images, so open data is approximate.
4.3 Tracking data is Contact data. It is kept and deleted on the same terms and is never used for advertising.
5. AI drafting and model providers
5.1 Terry uses large language models to draft messages, classify replies and summarise conversations. Prompt content (the Customer's approved knowledge, the Contact's fields, any reply text and, for call notes, the call transcript) is sent to a model provider to produce the draft, the suggestion or the notes.
5.2 Our managed model is provided today by Anthropic, PBC under Anthropic's commercial terms, which do not permit Anthropic to train on the content. A Customer may instead bring its own API key for a supported provider, in which case that provider's terms govern that use and the provider is the Customer's vendor, not our Sub-processor.
5.3 We do not use Customer content, Contact data or Outputs to train machine learning models, and we do not allow our providers to do so.
6. Google API Services User Data Policy
6.1 Terry's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6.2 What we request. Calendar: calendar.events and calendar.freebusy, to read availability and create meeting events. Gmail (optional, only when a User chooses to send from Gmail): gmail.send and gmail.readonly, to send outreach as the User, to find and read replies, bounces and unsubscribe requests to the messages Terry sent and, where the User has message requests on, to keep a first message from a new sender as described in section 2.14. Identity: openid, email and profile, to identify the connecting account.
6.3 Limited Use commitments. We only use Google user data to provide and improve the user-facing features of Terry. We do not transfer Google user data to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with prior notice. We do not use Google user data to serve advertisements. We do not allow humans to read Google user data unless we have the User's affirmative agreement for specific messages, it is necessary for security purposes such as investigating abuse, it is required by law, or the data has been aggregated and anonymised for internal operations. We do not use Google user data to develop, improve or train generalised artificial intelligence or machine learning models.
6.4 Storage and revocation. Google tokens are encrypted at rest with a key held separately from the data. A User can disconnect Google from the Integrations page, which deletes the token and the mail bodies Terry read through that mailbox, or revoke access at https://myaccount.google.com/permissions.
7. Microsoft account data
If a User connects a Microsoft 365 account, Terry requests Mail.Send, Mail.ReadWrite (to send, and to read replies to the messages Terry sent as described in section 2.5), Calendars.ReadWrite and offline_access. The same use limits as section 6.3 apply. Tokens are encrypted at rest and deleted on disconnect.
8. Sub-processors and other third parties
8.1 Sub-processors we engage. Only the rows marked "always" apply to every Customer. The others apply only when the Customer enables the feature.
8.2 Notice of changes. We give Customers at least 30 days' notice before adding a Sub-processor that will process Contact data. The current list is the one in this section.
8.3 The Customer's own vendors. A CRM the Customer connects, a video provider the Customer chooses other than Terry Call (such as Zoom, Google Meet or Microsoft Teams) and a model provider the Customer supplies its own key for are the Customer's vendors, and their terms govern that data.
8.4 Legal requests. We disclose personal information to authorities when the law requires it, and we notify the Customer where Contact data is involved unless the law forbids it.
8.5 Not recipients. LiveKit is software we run ourselves, not a service that receives data. The certificates for our call server come from Let's Encrypt, which receives the server's name and no personal information.
9. Rights of people who receive messages through Terry
9.1 Stop. Every email carries a working unsubscribe link and every text says "Reply STOP to opt out". Opt-outs take effect immediately and are recorded in a suppression list so the person is not contacted again through Terry by that Customer.
9.2 Access, correction and deletion. A Contact may ask what information a Customer holds about them, ask for it to be corrected or ask for it to be deleted, by writing to privacy@terryai.io or to the Customer named in the message. Because the Customer is accountable for that information, we forward the request within 5 business days and help the Customer answer within the time the law allows (California: 45 days, and the shortest period any other applicable state law allows).
9.3 What deletion means. The person's records and messages are deleted, including call notes, call transcripts and the answers they gave on a call, the send-audit trail is anonymised, and a one-way hash of the email address or number is kept so the person is not re-imported and contacted again.
9.4 Complaints. A person may complain to their state attorney general, and in California to the California Privacy Protection Agency. Write to us first at privacy@terryai.io if you would rather we fixed it.
9.5 On a Terry Call. A participant may join without notes, stop notes at any time, or ask for the host while Terry's voice is speaking. Each of those choices is respected for the rest of the call.
10. Rights of Users and Customers
Users and Customer Admins can view and correct account details, export Customer content in CSV and JSON, disconnect any integration and remove Users from inside the product. A Customer may request deletion of its account at privacy@terryai.io; section 11 explains what is kept. We answer requests from Users within 30 days.
11. Retention
11.1 Contact data, messages and engagement. For the life of the Customer's account, or until the Customer deletes the record or the person is erased under section 9.3. Deleted from live systems within 30 days after the post-termination export window.
11.2 Mail bodies read from a connected mailbox. The text of replies and bounces is scrubbed after a retention period the Customer sets, default 540 days, and when the mailbox is disconnected. The fact that a reply happened, its classification and its time are kept as engagement history without the text.
11.3 Suppression list. Kept for as long as the Customer's account exists and, after erasure, as a one-way hash only, so the person is never contacted again. A suppression record is kept indefinitely on purpose: forgetting that someone asked not to be contacted is how they get contacted again.
11.4 Send-audit records and attestations: 7 years, with Contact fields anonymised after erasure. Call recordings: until the retention horizon recorded on the consent event. Credentials and tokens: until disconnect or account deletion. Application logs: 30 days. Backups: daily, kept 7 days; deleted data leaves backups when the backup expires. Billing records: as long as tax law requires.
11.5 Terry Call. Audio and video are not kept. The transcript of a call, including its chat messages and what Terry said, and the suggestions shown to the host, are deleted 30 days after the call, wherever they are held. Terry's notes (the summary, decisions, objections and next steps) and the answers to the notes and voice notices stay with the conversation until the Customer deletes the person or the account ends.
11.6 Message requests are kept like other messages under 11.1. A personal mute list is kept until the User removes the entry or the account ends.
12. Security
12.1 We encrypt data in transit with TLS and at rest, including backups. Tokens, SMTP credentials and multi-factor seeds are encrypted with keys held separately from the data. Unsubscribe, booking and verification links are signed. Logins are rate limited and multi-factor authentication is available. Each Customer has its own database. Staff access production on a need-to-know basis and administrative access is logged.
12.2 No system is perfectly secure. If we confirm a breach of security safeguards involving Contact data, we notify the affected Customer within 72 hours as set out in the DPA, and we notify affected individuals and the state authorities that require it, within the time each state's breach notification law allows.
13. Cross-border processing
Terry is hosted in AWS region US East (Northern Virginia), us-east-1 and our Sub-processors operate in the United States and other countries. Personal information may be stored and accessed outside the country where the person lives and be subject to the laws there. Our contracts require Sub-processors to protect it. Customers are responsible for any notice to Contacts the law requires about cross-border transfer.
14. Regional notices
14.1 United States. Terry Limited LLC is a Pennsylvania company and we serve business customers in the United States. Where a Customer is within the scope of the California Consumer Privacy Act or another state privacy law, we act as their service provider and our duties are in the DPA. We do not sell or share personal information, and we do not use one Customer's Contact data to improve a model or a database used for any other Customer.
14.2 Canada. We do not currently take Canadian Customers. Terry's sending engine nevertheless enforces CASL whenever a Customer emails a Canadian address: it requires a recorded express or implied consent for that message, fails closed when it cannot tell where a recipient is, and every message identifies the sender and carries a working unsubscribe. That is a capability of the product, not a statement that this policy is governed by Canadian law.
14.3 United States. Commercial email complies with CAN-SPAM. Texting goes only to people who replied or opted in, within permitted hours, and every text offers STOP. Calls are not recorded without an announcement and recorded consent. Terry Call video calls are not recorded, and they are transcribed for notes only when every participant other than the host has agreed. Residents of states with comprehensive privacy laws (California, Colorado, Connecticut, Virginia, Texas, Oregon and others) may have rights of access, correction, deletion and portability. We act as a service provider or processor for Contact data under those laws and honour requests under sections 9 and 10 whether or not a threshold applies to us. Terry Limited LLC is below every threshold that would make it a "business" under the California Consumer Privacy Act, and we do not sell or share personal information as those terms are defined there, so no "Do not sell or share my personal information" link is required of us. A Customer may itself be in scope, which is a matter for the Customer.
14.4 European Union and United Kingdom. Terry is not currently offered to Customers established in the EU or UK, and Customers must not load EU or UK Contacts.
15. Children
Terry is a business tool. We do not knowingly collect personal information from anyone under 18.
16. Changes to this policy
We will post any new version at https://terryai.io/privacy with a new effective date. For material changes we email Customer Admins at least 30 days before the change takes effect.
17. Contact
Terry Limited LLC, a Pennsylvania limited liability company.
13 Kodiak Pass, Morgantown, PA 19543, United States.
Privacy requests: privacy@terryai.io. Abuse reports: abuse@terryai.io. Support: support@terryai.io.