Privacy

The short version

• We do not retain scratchpad content. Everything typed or uploaded into a scratchpad, including every attached photo and file, is deleted automatically, for good, together with the scratchpad, 24 hours after it is created.
• We keep only a minimal record that a scratchpad existed: when it was created, by whom, when it was shared and when it was removed. It holds none of the content.
• We do not store the phone numbers we send scratchpad links to.
• Customers do not need an account, and we set no cookies for them.
• We do not sell personal information, and we do not run advertising or analytics trackers.
• We use a small number of providers to run the service. They are listed below.

Who this covers

Two kinds of people use the service:

• Agents sign in, create scratchpads and send links. They work for a business, such as a call center or an operator of AI voice agents.
• Customers are the people on the call who open the link. They never sign in.

When an agent’s business asks a customer for details, that business decides what to ask for and why. For what customers type and upload, we act on the business’s behalf, and we handle it only to run the scratchpad.

What we collect

From agents:

• Your email address, which our sign-in provider passes to us when you sign in. We show your name in the app, but we do not store it.
• A record of each scratchpad you create: when you created it, that it was you, when you shared it and when it was removed. This record never includes what is inside the scratchpad.
• Anything you type into a scratchpad’s notes. Customers can see and edit it too.

From customers:

• Whatever you type into the scratchpad, and any photos or files you attach, with their file names and sizes.
• Nothing else is asked for. There is no account, and no name or email is required.

Phone numbers. If an agent sends the link by text message, they enter the customer’s mobile number. We do not store it: not in our database, and not in the scratchpad record. We pass it once to our text message provider, Sendly, only to deliver that one message. Sendly handles it under its own terms.

Technical data. Like most services, our servers receive your IP address, browser type and the pages requested. We keep these in logs for 14 days to keep the service secure and to fix problems.

Cookies. Agents get a session cookie that keeps them signed in. Customers get no cookies. We do not use advertising or analytics cookies.

How we use it

• To show the agent what the customer typed and uploaded.
• To sign agents in and keep their accounts secure.
• To send the link by text message when an agent asks us to.
• To keep the service running, find bugs and prevent abuse.

We do not use what is in a scratchpad for advertising. If we add a feature that processes uploaded files, such as reading text out of an image, we will update this page first.

How long we keep it

• Scratchpad content: we do not retain it. The text, photos and files are removed automatically, together with the scratchpad itself, 24 hours after the scratchpad is created, whether or not anyone is still using it.
• Scratchpad records: after the content is gone, we keep only the metadata: when the scratchpad was created, by whom, when it was shared and when it was removed. We use it to run and secure the service. It contains nothing a customer typed or uploaded.
• Links: a link stops working after 24 hours.
• Agent accounts: we keep your email address, and the ID our sign-in provider gives you, for as long as you use the service. If you ask us to close your account, we delete them or make them anonymous.
• Logs: kept for 14 days, then removed.

Removed means removed. We do not archive scratchpad content or keep a recycle bin.

Who we share it with

We do not sell personal information. We share it only with the providers that help us run the service, and only as needed:

• WorkOS, which handles agent sign-in.
• Amazon Web Services, which hosts the service and stores scratchpad data and uploaded files.
• Sendly, which delivers text messages.

We may also disclose information if the law requires it. Our servers are in the United States.

Security

All traffic uses HTTPS. Each scratchpad is secured by a cryptographic token. The token is signed with a secret key only our servers hold, so it cannot be guessed or forged, and it expires after 24 hours. A link with a wrong, tampered or expired token looks exactly like a scratchpad that does not exist.

Anyone who has a link can open that scratchpad until it expires, so agents should send it only to the customer on their call. No system is perfectly secure, and we cannot promise otherwise.

Your choices

You can ask us to tell you what we hold about you, correct it, or delete it. Email support@spltfm.com. Agents can also ask us to close their account.

Customers: because the business that sent you the link decides what to ask for, the quickest route is usually to ask that business. We will help them, or you directly. A scratchpad deletes itself within 24 hours in any case.

Children

The service is built for businesses and is not directed to children. We do not knowingly collect personal information from them.

Changes to this page

If we change how we handle data, we will update this page and the date at the top. For changes that matter, we will also tell agents by email.

Contact

Questions about this page or your data? Email support@spltfm.com.