Version 2.0  ·  Effective August 13, 2026

Privacy Policy

1. Introduction

2primes Inc, a Georgia corporation (“2primes,” “we,” or “us”), operates the Tipoff platform (the “Service”) and the tipoff.io website (the “Site”). This Privacy Policy explains how we collect, use, share, and protect information, and the choices available to you. It applies to the Site and the Service and works alongside the Tipoff Business Terms (https://tipoff.io/business-terms) or a signed agreement, which govern our customers’ use of the Service.

We handle information in two roles. For information about our customers’ representatives, workspace users, and Site visitors — such as account details and usage information — we act for our own purposes as described in this policy. For content and data our customers bring into the Service — including personal information contained in it — we act on the customer’s behalf and under its instructions, as described in Section 3.

2. Information We Collect

Information you provide. When you create an account or are invited to join an organization’s workspace, we collect information such as your name, email address, job title, and organization. If your organization subscribes, we collect billing details; payment card information is collected and processed by our payment processor, Stripe, and we do not store full card numbers. We also collect communications you send us, like support requests and feedback. Content you and your organization create in the Service — such as prompts, workflows, playbooks, and agent configurations — is processed on your organization’s behalf, as described in Section 3.

Information collected automatically. When you use the Site or the Service, we automatically collect technical information such as device, browser, and operating system details; IP address and approximate location; pages visited, features used, and usage patterns; and log and diagnostic data.

Information from third parties. We may receive information about you from services you or your organization use with Tipoff, such as single sign-on providers. We collect only what is needed to provide the relevant integration.

Cookies and analytics. We use PostHog for product analytics to understand how visitors interact with the Site and to improve the experience. Analytics cookies on the Site are set only after you accept them via the consent banner; if you decline, no analytics cookies are written and no usage events are captured. We honor Global Privacy Control (GPC) signals on the Site — if GPC is enabled, analytics are disabled automatically. You can change your preference at any time using the Cookie preferences link at the bottom of every Site page.

3. Information We Process on Behalf of Customers

Organizations that use Tipoff bring their own data into the Service: content from the third-party services they connect (for example, CRM records, email, tickets, and files), content created in the Service (such as prompts, workflows, playbooks, and agent configurations), knowledge documents, and the activity and outputs of the agents they configure. This information — including any personal information it contains — is processed on the customer’s behalf, under the customer’s instructions and configuration and our agreement with the customer.

If a customer uses the Service to communicate with you — for example, through an outbound phone call, text message, or email — that customer is responsible for the communication, and we process related information, such as phone numbers, email addresses, and call recordings and transcripts, on the customer’s behalf. Voice and SMS communications are carried through the customer’s own telephony provider under the customer’s agreement with that provider.

If you have questions about information a Tipoff customer holds about you, or want to exercise rights over it, please contact that organization directly; we support our customers in responding as our agreements require. If you contact us about such information, we will route your request to the relevant customer where appropriate.

4. Organizational Workspaces

If you use Tipoff through an organization’s workspace, that organization administers the workspace. Administrators and the organization can control your access and may view content and activity within the workspace, including agent interactions and audit logs, and your use may be subject to your organization’s own policies. If the organization’s subscription ends, workspace data is handled as described in our agreement with the organization.

5. How We Use Information

We use the information described in Section 2 to: provide, maintain, and improve the Site and the Service; process transactions and send related information; send administrative messages, security alerts, and support communications; analyze usage to improve the experience and develop new features; detect, prevent, and address fraud, abuse, and technical issues; and comply with legal obligations. Where laws such as the GDPR apply, we rely on legal bases including performance of a contract, our legitimate interests (such as securing and improving the Service), consent where required, and compliance with legal obligations.

We do not use the content our customers bring into or create in the Service — including prompts, workflows, playbooks, agent configurations, and content from connected services — to train AI models.

6. AI Processing

To deliver the Service, content is processed by third-party AI model providers under agreements that do not permit them to use it to train their models. If a customer supplies its own model API key, that processing is governed by the customer’s own agreement with the model provider.

7. How We Share Information

We do not sell personal information or share it for cross-context behavioral advertising. We share information with: service providers that help us operate the Site and the Service (such as cloud hosting, payment processing, analytics, and AI model providers), bound by contractual obligations to protect it and use it only to provide services to us; legal authorities when required by law, regulation, or legal process; and a successor in connection with a merger, acquisition, or sale of assets, with notice to you. We also share information at a customer’s direction — for example, when agents act through the customer’s connected services.

8. Data Retention

We retain account information while your account or your organization’s subscription is active, and afterward as needed for legitimate business purposes such as billing, dispute resolution, security, and legal compliance. Content processed on a customer’s behalf, including call recordings and transcripts, is retained as part of the customer’s workspace until deleted in the Service; following termination, content is available for export for thirty (30) days, after which we may delete it. Usage and log data are retained for shorter operational periods.

9. Data Security

We implement commercially reasonable administrative, technical, and organizational measures, appropriate to the nature of the information and designed to protect it, including encryption in transit and at rest, access controls, and periodic security reviews. For more detail on our practices, see https://tipoff.io/security. No system is perfectly secure, and we cannot guarantee absolute security.

10. Your Rights and Choices

Depending on your location, you may have rights to access, correct, delete, or export the personal information we hold about you, and to opt out of marketing communications at any time. To exercise these rights, contact us at privacy@tipoff.io; we may need to verify your identity. For information we process on a customer’s behalf, we will refer your request to that customer as described in Section 3. You can manage analytics cookies at any time via the Cookie preferences link on the Site.

11. International Data Transfers

We are based in the United States and process information primarily in the United States; information may also be processed in other countries where we or our service providers operate. Where required by applicable law, we use appropriate safeguards for cross-border transfers, such as contractual protections.

12. Children’s Privacy

The Site and the Service are not directed to individuals under the age of 16, and we do not knowingly collect personal information from children. If we become aware that we have collected such information, we will take steps to delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy by posting a revised version with a new effective date. For material changes, we will provide reasonable advance notice, such as by email or in the Service.

14. Contact

Questions or concerns about this Privacy Policy or our data practices: privacy@tipoff.io

2primes Inc