Privacy Policy

Last updated: 2026-10-14

This Privacy Policy explains how ALL IN Nation LLC ("we," "us") collects, uses, shares, and protects information in connection with the ALL IN Tools platform at app.allintools.com, the marketing site at allintools.com, and related subdomains and pages (the "Service").

1. Information We Collect

• Account information. Name, email, phone, password hash, role, tenant assignment, and 2FA configuration of users who sign in.
• List / lead information. When you join our list, the name, email, company, and interest you submit through our public forms.
• Customer Content. Records, contacts, deals, tickets, files, messages, call recordings, transcripts, and other data you and your users submit to the Service.
• Billing information. Limited card metadata (last four digits, expiry, brand) and processor customer/payment-method tokens. We do not store full card numbers.
• Usage and telemetry. Login events, IP addresses, user agents, pages visited, API calls, error logs, and feature-usage counters. Used to operate, secure, and improve the Service.
• Communications you send through the Service. Outbound SMS, voice calls, voicemail, transactional email, and inbound replies, which flow through our subprocessors.
• Cookies and local storage. Auth tokens, theme preference, and short-lived UI state.

2. How We Use Information

We use the information we collect to provide, secure, monitor, and improve the Service; bill you and prevent fraud; send transactional notifications and, where you have opted in, product updates; power AI features in the modules you have enabled; comply with legal obligations; and enforce these Terms and our Acceptable Use Policy.

We do not sell your information. We do not use Customer Content from one tenant to train AI models on behalf of another.

3. Subprocessors

The Service relies on third-party subprocessors — for card processing, SMS/voice, email delivery, AI assistants, and hosting/backups. Each is bound by a contractual data-protection agreement and processes data on our instructions. We keep the current list available on request and announce material additions at least 14 days in advance.

4. AI Processing

When you use an AI feature, the content you ask it to work on, together with the context the assistant needs, is sent to the model provider your workspace uses to produce the response. Each provider handles that content under its own terms and privacy policy. Outputs are returned to your tenant only and are not visible to other tenants. You can opt out by disabling AI modules in your settings.

5. Data Retention

6. Your Rights

Depending on where you live, you may have the right to access, correct, delete, port, object to or restrict, and withdraw consent for the processing of your personal information. To exercise any of these, email privacy@allintools.com from the email address tied to your account. We respond within the timeframes required by applicable law.

California (CCPA/CPRA). California residents have the rights above plus the right to non-discrimination for exercising them. We do not sell or share personal information for cross-context behavioral advertising.

EEA / UK (GDPR). AllInNation acts as the data processor for Customer Content (the customer is the controller) and as the data controller for account, billing, telemetry, and security data.

7. Security

We use industry-standard practices: TLS in transit, encryption at rest for backups, bcrypt password hashing, token revocation, per-account login lockout, rate limiting, hardened HTTP headers, single-origin CORS, role-based access control, audit logging, and 2FA for privileged accounts. Report vulnerabilities to security@allintools.com.

8. Children

The Service is not directed to children under 13 (or 16 where that is the threshold) and we do not knowingly collect their personal information.

9. International Transfers

Data is hosted in the United States. If you access the Service from outside the U.S., your information is transferred to and processed in the U.S. We rely on standard contractual clauses where required.

10. SMS / Text Messaging

If you provide your mobile number and opt in to text messages — for example, through a form, checkout, or the chat widget on our sites — the following applies:

• We do not sell or share your mobile opt-in data or consent with third parties or affiliates for their own marketing purposes. Your consent to receive text messages is used solely to send you the messages you asked for and is never shared for third-party marketing.
• Message purpose. Texts are transactional and service-related: account notifications, support replies, and service or appointment updates tied to your relationship with us. We do not send unsolicited promotional texts to numbers that have not opted in.
• Frequency. Message frequency varies based on your activity and the notifications you enable.
• Opt out any time. Reply STOP to any message to unsubscribe; we will send one confirmation and then stop. Reply HELP for help, or contact privacy@allintools.com.
• Msg & data rates may apply. Carriers are not liable for delayed or undelivered messages.

Full text-messaging terms are on our SMS Messaging Terms page.

11. Google User Data

If your organization or you connect a Google account, ALL IN Tools requests only the Google permissions (scopes) needed for the feature you turn on, and only after you approve them on Google's consent screen:

• Google Calendar (calendar.readonly, calendar.events): we read the events on your primary calendar to detect conflicts, show real availability on booking pages, and keep bookings that were made through ALL IN Tools in sync in both directions (for example, if you move or cancel one of those events in Google Calendar, the booking is updated). To do this we keep a copy of each event's start time, end time, and title (we do not store attendee lists or event descriptions in that copy). When a booking or a task needs a calendar entry, we create events on your primary calendar and delete them when the booking is cancelled, and Google may email invitations to the attendees on those events.
• Google Ads (adwords, datamanager): we read campaign and conversion performance for the Google Ads accounts you select (impressions, clicks, spend, and conversions) and copy those figures into your workspace so you can see results in your marketing reports, and we send the conversion events you configure to the Google Ads account and conversion action you choose. When we send a conversion, customer identifiers such as email address, phone number, and name are hashed before they leave our servers.
• YouTube (youtube.readonly): we read channel and video performance metrics for the channel you connect. We never upload, edit, or delete anything.
• Sign-in and basic profile (openid, email, profile): we use your name and email address to identify the connected account.

We use Google user data only to provide or improve these user-facing features. We do not sell Google user data, we do not use it for advertising, and we do not allow humans to read it except with your consent, to investigate abuse or a security issue, or where required by law. ALL IN Tools' use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We do not use Google user data to develop, improve, or train generalized artificial intelligence or machine learning models, and we do not train any model on it.

AI features. Some AI features use Google user data as input, and when you use them the relevant content is sent to an AI model provider to produce the response you asked for, and for no other purpose:

• The marketing assistant can be given the Google Ads performance figures described above (impressions, clicks, spend, and conversions by ad platform), and the names of connected YouTube channels and, if you ask about them, channel statistics.
• AI booking assistants (such as an AI phone agent that offers appointment times) use the open and busy times derived from your Google Calendar to decide which times to offer. Event titles and attendees are not sent to AI providers.

The model providers used are those your workspace is configured to use, which can include Anthropic, OpenAI, Google (Gemini), DeepSeek, Groq, and model-routing services such as OpenRouter. Each provider handles the content it receives under its own terms and privacy policy.

Access tokens and refresh tokens issued by Google are stored encrypted and are used only on our servers; they are never sent to your browser. Anyone can revoke access at any time at myaccount.google.com/permissions (https://myaccount.google.com/permissions), which immediately invalidates the tokens we hold for that grant.

Disconnecting a Google account and retention. A workspace administrator can disconnect a Google account at any time from the workspace settings. What happens next depends on the connection:

• Google Calendar: we stop syncing, delete the stored Google tokens, and ask Google to revoke the grant. The record of the connection itself (including the connected email address) is kept, marked as disconnected.
• Google Ads conversion connections: we delete the stored Google tokens and ask Google to revoke the grant. The Google Ads account ID and conversion settings are kept for your audit history.
• The workspace-level Google connection used for YouTube and marketing: we delete the stored token and ask Google to revoke it.
• Individually added YouTube channels and Google Ads accounts: removing one in the marketing settings stops syncing it, but its encrypted token stays in that account's record until we delete it on request. It stops working as soon as access is revoked at myaccount.google.com/permissions (https://myaccount.google.com/permissions), or when the workspace-level connection above is revoked from the same Google sign-in.

Data we had already copied into your workspace remains until it is deleted, and disconnecting does not delete it automatically. This covers the event times and titles we cached from Google Calendar for conflict detection, the Google Ads performance figures copied into your marketing reports, and YouTube channel statistics. It stays part of your organization's content until your organization deletes it or requests deletion, and we have no scheduled job that purges it. To have Google-derived data removed, a workspace administrator or the person who connected the account can email privacy@allintools.com.

12. Lead Forms and Social Messages (Meta)

If a business connects its Facebook Page or Instagram account to ALL IN Tools, we handle the following on that business's behalf:

• Lead form submissions. When someone submits a Facebook or Instagram lead ad form, Meta notifies us and we retrieve the submission from Meta using the connected Page's access. This includes the name, email address, and phone number the person entered, their answers to the form's other questions, and the identifiers of the form, ad, and campaign. We use it so the business can respond to the person. If the business has set up an automation rule for lead forms, the rule creates a contact and an opportunity in that business's CRM.
• Messenger and Instagram messages and comments. Messages and comments sent to the connected Page or Instagram account, with the sender's Meta identifier and, where Meta provides it, their name or username, are delivered to us by Meta and shown in the business's inbox in ALL IN Tools so its team can read and reply.

Retention. The raw lead event is kept in the automation event log for about 30 days, and records of the automation runs that handled it are kept for up to 90 days after they finish. The contact and opportunity created from a lead, and messages in the inbox, are the business's records and are kept until the business deletes them or asks us to. We do not sell this data and we do not use it for advertising. To have a lead or message removed, the person can ask the business, or email privacy@allintools.com.

13. Changes to This Policy

We will post material changes at least 14 days in advance.

14. Contact

Privacy questions: privacy@allintools.com. For legal process: legal@allintools.com.

ALL IN Tools

The AI-powered operating system for your entire business.

Platform
Pricing
FAQ
Terms
Privacy
SMS Terms
Join the list