Privacy Policy

1. Information We Collect

We collect agency account details, including names, email addresses, workspace settings, and billing information. Client organization records include company names, contact email addresses, and magic-link portal and proof tokens used to access client work.

We process requests, deliverables, files, and comments, including inbound emails sent to @inbound.agencyqueue.com, uploaded PNG, JPG, WebP, and PDF assets up to 25 MB, {x, y} pinpoint annotations, and external deliverable links. External services may collect information under their own privacy policies when you open those links.

Technical and usage telemetry may include IP addresses, browser user-agents, session records, and audit logs for operating and protecting the service. Stripe handles payment card details; AgencyQueue does not store raw credit card numbers.

2. How We Use Information

We use information to provision and operate subscription-agency request queues, route inbound client emails at @inbound.agencyqueue.com into queued tasks, and deliver accountless magic-link portals and POST-guarded proofing links. We also use it to process Free ($0/mo) and Pro ($49/mo) subscriptions and Stripe Connect Standard checkouts, prevent abuse and fraud, troubleshoot service issues, and provide customer support.

3. Parties to Whom Information Is Disclosed

Information necessary to provide the service may be disclosed to the following service providers, depending on the features and connections in use:

• Stripe, Inc. for payment processing, subscription billing, and Stripe Connect Standard onboarding and checkout.
• Lovable Cloud and its database hosting provider for PostgreSQL database hosting with Row-Level Security and object storage where enabled.
• Resend, Inc. / Amazon SES for transactional notifications and inbound email-to-request parsing where configured.
• Cloudflare, Inc. for DNS, TLS termination, DDoS mitigation, and edge routing.
• The subscribing Agency Workspace and its authorized team members and clients as directed by the agency. We disclose information to law enforcement or regulatory authorities only when legally required.

We never sell personal data to third-party data brokers or advertisers.

4. Method of Disclosure

Service-provider connections use encrypted HTTPS API requests and scoped API credentials or OAuth connections where supported. TLS 1.2/1.3, cryptographically signed webhooks such as Stripe-Signature and Resend webhook signatures, and data-processing agreements are safeguards available through these providers. Their availability does not establish that every integration has been configured or independently verified; we do not represent all webhook paths as signature-verified.

5. Security Practices in Place to Safeguard Information

We use encrypted HTTPS connections, token-hash checks for magic-link access, restricted database access, and server-side filtering of internal agency notes from client proof responses. Approval requires an explicit POST action; opening a proof link with GET does not approve work, helping prevent approval by email security scanners.

PostgreSQL Row-Level Security restricts direct client access to application tables; privileged server operations must apply their own access checks. We do not claim that RLS alone isolates all seven workspace tables or that the get_magic_proof_readonly SQL RPC is verified as the filtering layer.

Our infrastructure providers offer controls such as TLS 1.2/1.3 encryption in transit and AES-256 encryption at rest. Exact encryption settings and every deployment-specific control have not been independently verified. Where Stripe Checkout and Stripe Connect Standard are used, card handling is offloaded to Stripe, which maintains PCI-DSS Level 1 certification; AgencyQueue never stores raw credit card numbers. We seek to limit access to the information needed for service operations, but no system can guarantee absolute security.

6. Data Retention, User Rights & Contact

We retain information for as long as needed to operate your workspace, fulfill legal obligations, resolve disputes, and maintain security records. Retention varies by record type and purpose; deletion may be delayed for legally required records and backup retention.

Agencies and clients may request access, correction, export, or deletion of their data at any time by contacting support@agencyqueue.com or jrogercoker@gmail.com. We may verify your identity and, for agency-managed client records, coordinate with the subscribing agency before processing a request. Applicable law may limit deletion or require retention of certain records. This policy is effective October 23, 2026.