Legal

Our Commitment

Change Agent AI is built for social sector organizations, including many that work on behalf of vulnerable populations that are under threat and even attack. We take that trust seriously and have designed this privacy policy to ensure that we protect user data to the fullest extent possible. This includes a commitment to reject data exploitation for profit business models including selling, sharing, or otherwise leveraging client data. We welcome suggestions for how we can further strengthen this policy at support@thechange.ai.

1. Data We Collect

Account Information: Name, email address, organization name, and billing information when a user creates an account or subscribes to our services.

Usage Data: How a user interacts with the platform, including features used, queries made, and documents uploaded. This helps us improve the Service.

User-Generated Content: Documents, conversations, and other content a user creates or uploads to the platform (“User Data”).

Website Analytics: We use Google Analytics to understand how visitors interact with our website. This collects anonymized usage data including page views, referral sources, and device information.

2. What We Never Do

Change Agent never sells user data. Not to advertisers, data brokers, or anyone else.
Change Agent never trains AI models on client data, unless specifically directed by a client for the client’s purposes. Your content is yours. Period.
Change Agent never shares user data with Big Tech. User data stays on private infrastructure.
Change Agent never uses user data for advertising. We make money from subscriptions and services, not surveillance.

3. How We Use Your Data

To provide and maintain the Service
To process subscriptions and billing
To communicate with users about the Service
To improve platform performance and features
To provide customer support
To comply with legal obligations

4. Data Storage & Security

User data is stored on private infrastructure. We do not use Big Tech cloud providers (AWS, Google Cloud, Azure) for customer data storage. We implement industry-standard security measures including encryption in transit and at rest, access controls, and regular security audits.

5. Data Retention & Deletion

We retain user data for as long as an account is active. Users may request deletion of specific content or their entire account at any time. Enterprise clients may specify data retention and deletion policies for their instance’s users that supersede our standard policy. Upon account deletion, we permanently remove user data within 24 hours. Temporary chats are never stored on our servers.

6. Third-Party Services

We use a limited number of third-party services:

Stripe — Payment processing. Stripe handles billing data under their own privacy policy.
HubSpot — Customer relationship management for sales inquiries.
Google Analytics — Anonymous website usage analytics (website only, not the platform).
Google API — Drive integration to upload files into chats, and Calendar integration to send Change Agent Scribe to record and transcribe meetings. These Google API integrations are not required to use core Change Agent features.
Recall.ai — Video meeting recording and transcription (only when using the “Change Agent Scribe” feature). Recall.ai acts as a data processor on our behalf and meets strict privacy and security requirements such as HIPAA, SOC2, ISO 27001, and more.

We do not share user data with any third-party service, except when users utilize integrations within the Change Agent platform. Using an integration represents an explicit determination by the user to share data with a given service. Change Agent encourages users to intentionally consider the impact of such determinations, including seeking legal advice.

More details specific to Google API:

As with all user data, we do not use Google API data for advertising or model training.
We only access the Google Drive files users explicitly choose to upload to reference in user Change Agent chats.
Google Calendar events are accessed only when approved through the use of Change Agent Scribe. Users can still use Change Agent Scribe without opting into Google Calendar integration.
When approved, the Change Agent Scribe feature uses calendar data to join meetings the user chooses to record, transcribe, and take notes. This process involves sharing meeting metadata (time, link, participants) with Recall.ai.
Google API data is retained only as long as necessary to provide the functionality authorized by the user. As with all user data, all data retrieved from Google APIs is stored securely and can be deleted permanently, with all cached and backup data being deleted forever within 24 hours of deletion.
Change Agent’s use of Google API data complies with Google’s Limited Use requirements, including restrictions on advertising, retargeting, and data resale.
Users can revoke Google API access at any time through their Google account settings.
No human reads user Google API data unless the user provides explicit consent for specific files/messages, or for security purposes.

7. Multi-Tenant Deployment Structure

This application is operated by Change Agent and may be accessed through multiple web domains. These include:

Primary Domains: thechange.ai and its subdomains (e.g., chat.thechange.ai, or dedicated subdomains for enterprise clients operated by Change Agent)
Client domains: Domains operated by our enterprise clients under white-label agreements

Regardless of which domain is used to access this application, the same data handling practices described in this policy apply. Change Agent remains the data controller for all personal information processed through the application.

8. Your Rights

Users have the right to:

Access their personal data
Correct inaccurate data
Request deletion of user data
Export user data in a portable format
Opt out of marketing communications
Know what data we collect and how we use it

9. Children’s Privacy

The Service is for social sector professionals, not individuals under the age of 18. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this policy from time to time. We will notify users of material changes via email. The “Last updated” date above reflects the most recent revision.

11. Contact

For privacy-related questions or data requests, contact us at support@thechange.ai

Our Commitment

1. Data We Collect

Account Information: Name, email address, organization name, and billing information when a user creates an account or subscribes to our services.

Usage Data: How a user interacts with the platform, including features used, queries made, and documents uploaded. This helps us improve the Service.

User-Generated Content: Documents, conversations, and other content a user creates or uploads to the platform (“User Data”).

2. What We Never Do

Change Agent never sells user data. Not to advertisers, data brokers, or anyone else.
Change Agent never trains AI models on client data, unless specifically directed by a client for the client’s purposes. Your content is yours. Period.
Change Agent never shares user data with Big Tech. User data stays on private infrastructure.
Change Agent never uses user data for advertising. We make money from subscriptions and services, not surveillance.

3. How We Use Your Data

To provide and maintain the Service
To process subscriptions and billing
To communicate with users about the Service
To improve platform performance and features
To provide customer support
To comply with legal obligations

4. Data Storage & Security

5. Data Retention & Deletion

6. Third-Party Services

We use a limited number of third-party services:

Stripe — Payment processing. Stripe handles billing data under their own privacy policy.
HubSpot — Customer relationship management for sales inquiries.
Google Analytics — Anonymous website usage analytics (website only, not the platform).
Google API — Drive integration to upload files into chats, and Calendar integration to send Change Agent Scribe to record and transcribe meetings. These Google API integrations are not required to use core Change Agent features.
Recall.ai — Video meeting recording and transcription (only when using the “Change Agent Scribe” feature). Recall.ai acts as a data processor on our behalf and meets strict privacy and security requirements such as HIPAA, SOC2, ISO 27001, and more.

More details specific to Google API:

As with all user data, we do not use Google API data for advertising or model training.
We only access the Google Drive files users explicitly choose to upload to reference in user Change Agent chats.
Google Calendar events are accessed only when approved through the use of Change Agent Scribe. Users can still use Change Agent Scribe without opting into Google Calendar integration.
When approved, the Change Agent Scribe feature uses calendar data to join meetings the user chooses to record, transcribe, and take notes. This process involves sharing meeting metadata (time, link, participants) with Recall.ai.
Google API data is retained only as long as necessary to provide the functionality authorized by the user. As with all user data, all data retrieved from Google APIs is stored securely and can be deleted permanently, with all cached and backup data being deleted forever within 24 hours of deletion.
Change Agent’s use of Google API data complies with Google’s Limited Use requirements, including restrictions on advertising, retargeting, and data resale.
Users can revoke Google API access at any time through their Google account settings.
No human reads user Google API data unless the user provides explicit consent for specific files/messages, or for security purposes.

7. Multi-Tenant Deployment Structure

This application is operated by Change Agent and may be accessed through multiple web domains. These include:

Primary Domains: thechange.ai and its subdomains (e.g., chat.thechange.ai, or dedicated subdomains for enterprise clients operated by Change Agent)
Client domains: Domains operated by our enterprise clients under white-label agreements

8. Your Rights

Users have the right to:

Access their personal data
Correct inaccurate data
Request deletion of user data
Export user data in a portable format
Opt out of marketing communications
Know what data we collect and how we use it

9. Children’s Privacy

The Service is for social sector professionals, not individuals under the age of 18. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this policy from time to time. We will notify users of material changes via email. The “Last updated” date above reflects the most recent revision.

11. Contact

For privacy-related questions or data requests, contact us at support@thechange.ai

Our Commitment

1. Data We Collect

2. What We Never Do

3. How We Use Your Data

4. Data Storage & Security

5. Data Retention & Deletion

6. Third-Party Services

More details specific to Google API:

7. Multi-Tenant Deployment Structure

8. Your Rights

9. Children’s Privacy

10. Changes to This Policy

11. Contact

Stay in the loop

Legal

Our Commitment

1. Data We Collect

2. What We Never Do

3. How We Use Your Data

4. Data Storage & Security

5. Data Retention & Deletion

6. Third-Party Services

More details specific to Google API:

7. Multi-Tenant Deployment Structure

8. Your Rights

9. Children’s Privacy

10. Changes to This Policy

11. Contact

Stay in the loop