Privacy Policy

Dorian Agent is a product owned and operated by Arno & Co. LLC, a limited liability company organized under the laws of the State of Wyoming, United States(“Arno & Co.”, “we”, “us”). This policy applies to the Dorian Agent website and application. You can reach us about privacy at hello@dorianagent.com; our postal address is available on request.

There are two kinds of data in Dorian Agent, and our role is different for each:

• Your account data. For information about you and your business, we are the controller and this policy describes how we handle it.
• Your lead and conversation data. For the contacts you bring and the messages exchanged with them, you are the controller and we act as your processor, handling that data only on your instructions to provide the Service. If you are a customer who received a message from a business using Dorian Agent, please see section 12.

• Account information. Your name and email address from Google or Apple sign-in, and the business details you provide (such as business name, industry, and messaging settings).
• Billing information. Your subscription status, plan, and credit ledger. Payments are handled by Creem; we do not receive or store your full card number.
• Lead and conversation data. The contact details (such as phone numbers and names) and the messages exchanged between your business and your contacts over WhatsApp and SMS, which the Service processes to reply, qualify, and follow up.
• Usage and technical data. Log data such as IP address, device and browser information, and events needed to operate, secure, and meter the Service.

We use information to:

• Provide the Service, including sending, receiving, and following up on messages you configure.
• Generate replies using AI (see section 6).
• Meter credit usage, process subscriptions, and manage billing through Creem.
• Provide support, including hands-on onboarding when offered.
• Secure the Service, prevent abuse, and enforce our terms.
• Maintain and improve the Service.

We use only essential cookies needed to sign you in and keep your session secure, set through our authentication provider. We do not use advertising cookies or third-party tracking or ad networks.

To generate replies, the content of the relevant conversation is sent to OpenRouter, which routes it to an AI model provider. We do not use your conversation content to train our own models. The handling of that content by OpenRouter and the model provider is subject to their terms. We send only what is needed to produce a useful reply.

We do not sell your personal information. We share information with the service providers (subprocessors) below, each only to the extent needed to run the Service, and with authorities when required by law:

• Clerk: Account sign-in and authentication (Google and Apple).
• Neon: Managed PostgreSQL database that stores your account and conversation data.
• Vercel: Application hosting and content delivery.
• Cloudflare R2: Object and image storage.
• Upstash: Redis used for rate limiting and caching.
• OpenRouter: Routes message content to AI model providers to generate replies.
• Twilio: SMS delivery and missed-call detection for US and international numbers.
• text.lk: SMS delivery for Sri Lankan (+94) numbers.
• Meta Platforms (WhatsApp): WhatsApp Business messaging.
• Creem: Payment processing as merchant of record.
• Inngest: Scheduling background follow-up messages.

We and our providers operate primarily in the United States, and information may be processed there and in other countries where our providers operate. We serve customers in the United States, Sri Lanka, and elsewhere, so data may move across borders to deliver the Service.

We keep account and conversation data for as long as your account is active and as needed to provide the Service. When you close your account, we delete or anonymize your data within a reasonable period, except where we must keep certain records (such as billing and credit-ledger entries) to meet legal, accounting, or security obligations.

We protect information with encryption in transit, access controls, and strict separation of each customer’s data. No system is perfectly secure, but we work to safeguard your data and to respond quickly if something goes wrong.

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, and to object to or restrict certain processing. If you are a California resident, we do not sell or share your personal information as those terms are defined under California law. If you are in the United Kingdom or European Economic Area, you have rights under the GDPR; if you are in Sri Lanka, you have rights under the Personal Data Protection Act. To exercise any right, email us at hello@dorianagent.com and we will respond as required by applicable law.

If a business used Dorian Agent to message you, that business (not us) decides what to send and controls your information. Please direct requests to access or delete your data, or to stop being contacted, to that business. You can also reply “STOP” to opt out, and you may contact us at hello@dorianagent.com and we will help route your request.

The Service is for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us information, contact us and we will delete it.

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above. Your continued use of the Service means you accept the updated policy. See also our Terms of Service.