TextBack — Privacy Policy
PRIVACY POLICY
TextBack — Missed-Call Text-Back Service for Businesses
Effective date: October 23, 2026. This Privacy Policy explains how TextBack ("TextBack," "we," "us," or "our") collects, uses, stores, shares, protects, retains, and deletes personal information in connection with the service at gotextback.com. It applies to business account holders and their authorized users, to resellers and their clients, and to individuals who call or text a business that uses TextBack.
1. WHO WE ARE AND HOW TO CONTACT US
1.1. The business. TextBack is a subscription software service that helps businesses respond to telephone calls they do not answer. Our mailing address is TextBack, 204 Myers Ave, Harrisonburg, VA 22801, USA. You can reach us by phone at +1 (540) 271-3655 and by email at b.bell633@gmail.com.
1.2. Questions and requests. Privacy questions, complaints, and requests — including requests to access, correct, or delete personal information — may be sent to us using the contact details in Section 1.1. If you are a customer of a business that uses TextBack, Section 9.4 explains why contacting that business first is usually the fastest route, and how we support its handling of your request.
2. OUR ROLES
2.1. Account information. For information about our direct business customers, resellers, and their authorized users — such as registration, account, and billing-administration information — TextBack determines why and how the information is processed and acts as the responsible business (a "controller" under laws that use that term).
2.2. Customer communications processed for businesses. For information about a business's own customers — people who call or text the business — the business decides why and how that information is used, and TextBack processes it only to provide the service to that business, as its service provider (a "processor" under laws that use that term). The business's own privacy notice governs its customer relationships.
2.3. Resellers. A reseller is an independent business. For its own clients' information, the reseller stands in the same position as a business customer under Section 2.2, and TextBack processes that information to provide the platform to the reseller. Resellers' own privacy practices are governed by their own notices.
3. INFORMATION WE COLLECT
3.1. Business account information. When a business registers, we collect the business's name, type, address, and website; the owner's and authorized users' names, email addresses, and phone numbers; login credentials, which are stored only in salted, hashed form and are never stored as readable passwords; and account settings such as business hours, services, message templates, and feature configurations.
3.2. Billing information. A payment card is collected at signup through our payment processor's secure hosted pages. Card numbers are entered with and processed by the processor and are never transmitted to or stored on our systems. We store the card brand and last four digits, billing status, trial and subscription dates, amounts, and a record of charge attempts and outcomes.
3.3. Caller and conversation information. When a person calls a business that uses TextBack and the call is not answered, we process the caller's telephone number, the date, time, and outcome of the call, the text messages exchanged, and related conversation records. Depending on the features the business uses, this can also include: voice messages a caller chooses to leave (audio, recorded with the caller's knowledge, stored for playback to the business, and may be transcribed so the business can read them); photographs a caller chooses to submit when requesting a quote; booking, quote, and callback requests and their outcomes; job values the business records for its own reporting; and language preference detected from the conversation, so replies continue in that language.
3.4. Opt-out records. When a person opts out — by replying STOP (or ALTO in Spanish), by using another opt-out word or plain language asking not to be texted, or by telling the business in person, by phone, or by email — we record the opt-out so it is honored. The record keeps the telephone number, the date, and how the opt-out arrived, including the words used when it came by text. Opt-out suppression records are kept separately from conversation records and are preserved even if the related conversations or account data are deleted, as explained in Section 8.3.
3.5. Website and technical information. Our systems record ordinary technical information needed to operate and secure the service, such as sign-in activity, account actions recorded in audit logs, and error and delivery records for calls, messages, and emails. The web application stores sign-in tokens and display preferences (such as light or dark theme) in your browser's local storage so you can stay signed in; we do not use third-party advertising or analytics cookies, and no third-party trackers are embedded in the service. We maintain simple first-party counters of how often our own public blog articles are viewed and how often their sign-up links are clicked, stored in our own database, to understand which articles are useful.
3.6. Information a business imports. If a business asks the service to import content from its own public website to prefill its profile, that imported content is saved as drafts for the business's review. We process it only as the business directs.
3.7. Information we do not seek. TextBack is not offered to medical or dental practices and is not designed to collect health information. We do not knowingly collect information from children under 13, and the service is offered to businesses, not to consumers for personal use.
4. HOW WE USE INFORMATION
4.1. To provide the service. Detecting unanswered calls routed to the service; sending and receiving text messages; presenting conversations, requests, bookings, and reports to the business; applying the business's configuration, templates, quiet hours, and follow-up rules; and providing Spanish-language replies where a conversation is in Spanish.
4.2. To run accounts and billing. Registering and administering accounts, authenticating users, processing subscriptions, trials, and payments through our processor, retrying failed charges as described in the Terms of Service, and maintaining billing records.
4.3. To communicate. Sending service, account, billing, and support communications; sending email digests of newly published articles only to people who subscribed to them, with unsubscribe honored; and responding to inquiries.
4.4. For safety, security, and legal compliance. Preventing fraud and abuse; enforcing opt-outs and messaging rules; maintaining audit logs; complying with carrier registration and messaging requirements; and meeting legal obligations and lawful requests.
4.5. To improve the service. Understanding feature usage in aggregate — including the first-party article counters described in Section 3.5 — and maintaining and improving reliability and security.
4.6. What we do not do. We do not sell personal information. We do not use caller phone numbers or conversation content for advertising, and we do not share mobile numbers or text-messaging opt-in information with third parties for their marketing purposes. Where a business enables artificial-intelligence drafting, conversation content may be processed by our AI provider solely to generate draft replies for the business's human review, as described in Section 6.4; if AI features are not configured, no content is sent to an AI provider.
5. TEXT MESSAGING PROGRAM
5.1. Program description. TextBack operates a missed-call text-back program on behalf of the local businesses that use our service. If you call a business that uses TextBack and your call is not answered, the business may send you a text message to continue the conversation you started. By calling the business, you consent to receive that reply text and related follow-up messages about your inquiry. Messages are conversational; message frequency varies depending on the conversation. Message and data rates may apply. You can opt out at any time by replying STOP, and you will receive no further texts from that business through this program. You can also opt out by telling the business in any other way — in person, by phone, or by email — and the business will record it and honor it the same way. Reply HELP for help. We do not sell phone numbers, and mobile numbers and text-messaging opt-in information are never shared with third parties for their marketing purposes.
5.2. Numbers used. Messages are sent from the business's texting number configured with the service, through our messaging provider, under carrier brand and campaign registration described in Section 6.1.
6. HOW WE SHARE INFORMATION
6.1. Service providers. We share information only as needed with providers that operate parts of the service under their own terms and privacy practices, currently including: Render, which hosts the application and its database; Twilio, which provides telephone numbers, call handling, and text messaging, and through which carrier brand and campaign registration is performed; Stripe, which processes payments and stores payment cards on its hosted pages; and Resend, which delivers transactional and subscribed email. Recordings of voice messages and other files submitted through the service are stored within the hosted application's storage.
6.2. Providers a business connects. If a business connects its own Google Calendar, Jobber, or Housecall Pro account, information necessary for that synchronization — such as booking times and job details — is exchanged with that provider under the business's own account and authorization. If a business does not connect those services, nothing is sent to them.
6.3. The business you contacted. Conversation and request information belongs to the business you called; it is visible to that business and its authorized users, and, where the business obtained the service through a reseller, to that reseller for administration of its client account, under the reseller's own obligations.
6.4. Artificial intelligence provider. Where AI drafting is configured for the deployment, our AI provider processes message content transiently to produce draft replies. Where configured, the provider is OpenAI; the AI features are inactive until configured, and no content is sent to an AI provider before then. Our provider's API terms do not permit it to train models on content sent through the API. Drafts are reviewed by a person before sending, except messages sent under templates and rules the business itself approved.
6.5. Legal and safety disclosures. We may disclose information where we believe it is required by law, legal process, or carrier or regulator requirements; to protect the rights, safety, and security of any person or of the service; or to detect, prevent, or address fraud or abuse.
6.6. Business transfers. If TextBack is involved in a merger, reorganization, or sale of substantially all relevant assets, information may transfer to the successor, subject to this Policy's commitments and applicable law.
7. SECURITY
7.1. Measures. We use reasonable administrative, technical, and organizational measures appropriate to a service of this kind, including: passwords stored only in salted, hashed form; hashed storage of password-reset and sign-in tokens, which are single-use and time-limited where applicable; account lockout after repeated failed sign-in attempts; role-based access separating business users, resellers, and platform administrators; audit logging of administrative actions; and transport encryption (HTTPS/TLS) for the website and application.
7.2. No absolute guarantee. No system is perfectly secure, and we do not guarantee that information will never be accessed, disclosed, altered, or destroyed by a breach of our measures. You are responsible for protecting your own credentials and devices, and for notifying us promptly of suspected compromise.
7.3. Incidents. If a security incident materially affects personal information, we will respond, investigate, and provide the notifications required by applicable law, and we will cooperate with affected business customers so they can meet their own obligations.
8. RETENTION, EXPORT, AND DELETION
8.1. While an account is active. Account, conversation, and billing information is retained while the business's account is active and as needed to provide the service, maintain billing and tax records, resolve disputes, and enforce our agreements.
8.2. After cancellation or termination. A business may request an export of its information, or deletion, by contacting us using the details in Section 1.1. Export requests made within thirty (30) days after an account ends will be fulfilled through the means the service reasonably supports. After that period, account information is deleted or rendered inaccessible within a commercially reasonable period, subject to Sections 8.3 and 8.4.
8.3. What is kept, and why. Opt-out suppression records are retained after deletion of related data so that a person who replied STOP is never texted again from that business through the service; a suppression record contains the telephone number, the date of the opt-out, and how it arrived (including the words used, when it came by text). Records we must keep for legal, tax, accounting, security, or carrier-compliance reasons are retained for the period those obligations require. Information in backups may persist until overwritten or deleted in the ordinary backup cycle; retained information remains subject to this Policy and is not used for unrelated purposes.
8.4. Business-level deletion tools. Within the service, a business can delete individual conversations; deleted conversations can be restored by an administrator during a limited retention window and are thereafter permanently purged, except for opt-out suppressions described in Section 8.3.
8.5. Consent and compliance records. Call logs, the messages sent and received, consent records (including Washington consent confirmations), and a short summary kept when a conversation is permanently deleted (the number, the contact dates, the message count, and any opt-out) are retained for six (6) years after the last contact with the number concerned. The sender of a text bears the burden of proving consent and of proving that opt-outs were honored; these records exist for that proof and for carrier or regulator inquiries, and are used for no other purpose.
9. YOUR RIGHTS AND CHOICES
9.1. Text messaging choices. Reply STOP at any time to stop texts from a business through the service; reply HELP for assistance. Opting out of one business's messages does not opt you out of messages from a different business you separately contact.
9.2. Email choices. Every subscribed email digest includes an unsubscribe option, and unsubscribing is honored for future digests. Transactional and account emails necessary to operate an account (such as billing and security notices) are not marketing email and cannot be opted out of while the account exists.
9.3. Privacy rights. Depending on where you live, you may have rights to know about, access, correct, delete, or obtain a copy of your personal information, and to appeal a decision about a request. Virginia residents have these rights under the Virginia Consumer Data Protection Act, subject to its exemptions and limits; residents of other states may have similar rights under their own laws. To exercise a right, contact us using Section 1.1. We will verify your identity in a manner proportionate to the request, respond within the period applicable law requires, and, if we decline a request, explain why and how to appeal.
9.4. Customers of a business. If your information was collected through a business that uses TextBack — for example, you called a plumber who uses the service — that business is the primary decision-maker for your information, and requests should normally be directed to it. If you contact us instead, we will route or support the request with that business as Section 2.2 describes, and we will not use your information for our own unrelated purposes.
9.5. No discrimination and no sale. We do not sell personal information and do not discriminate against any person for exercising a privacy right.
10. CHILDREN'S PRIVACY
10.1. The service is offered to businesses and is not directed to children. We do not knowingly collect personal information from children under 13 years of age. If you believe a child's information was provided to us, contact us using Section 1.1 and we will delete it as required by law.
11. THIRD-PARTY WEBSITES AND SERVICES
11.1. Our website and service may link to, or integrate with, third-party websites and services, including the providers named in Section 6. Their handling of information is governed by their own privacy policies, which we do not control and are not responsible for.
12. CHANGES TO THIS POLICY
12.1. We may update this Policy from time to time. The current version is always available at gotextback.com/privacy, with its effective date shown at the top. For material changes, we will provide notice by posting the updated Policy at least fourteen (14) days before it takes effect, where practicable, and by email or in-service notice to account holders for changes that materially affect account information. Continued use of the service after a change takes effect constitutes acknowledgment of the updated Policy.
13. STATE AND REGIONAL NOTES
13.1. Virginia. TextBack operates from Virginia. The rights described in Section 9.3 apply as provided by the Virginia Consumer Data Protection Act and other applicable law. Certain information and entities are exempt from that Act, including some business-to-business and employment information; where an exemption applies, we will say so in response to a request.
13.2. Other regions. The service is offered for businesses and their customers in the United States, and information is processed and stored in the United States. If you access the service from outside the United States, you understand that your information will be transferred to and processed in the United States, whose laws may differ from those of your jurisdiction.
END OF PRIVACY POLICY