Legal
Privacy Policy
Last updated: 28 October 2026
This policy explains what personal data Dispatch collects, why, who it shares it with, how long it keeps it, the risks and safeguards involved, and the rights you have and how to use them.
The short version
- We run Dispatch, an AI agent platform. You sign in, build agents, give them knowledge (files and FAQs), and put them live on your website, on Facebook Messenger, or through our API. If you connect another tool, we send it only what that connection needs, and only while you leave it connected.
- Your prompts, files and conversations are sent to AI model providers (Anthropic, OpenAI and Amazon Web Services) so the agents can answer. If you connect your own provider key, those prompts go to that provider instead. We do not use your content to train AI models, and we do not turn on OpenAI’s option to store responses.
- When an agent talks to your customers, you decide what data it collects. For that data we act on your behalf, and you are responsible for telling them about it.
- Your data is stored in Singapore on Amazon Web Services, and some of it is processed in other countries by the providers listed below.
- We do not sell your personal data, show you ads, or use analytics or advertising trackers.
- To ask about your data, get a copy of it or have it deleted, write to support@rundispatch.ai.
1. Who we are
Dispatch (rundispatch.ai) is operated by Truepoint Technologies, Inc., Unit S13, 2F Robertson Plaza, Centennial Road, Tabon 1, Kawit, Cavite, Region IV-A (CALABARZON), 4104, Philippines.
Truepoint Technologies, Inc. is a corporation organized under the laws of the Republic of the Philippines. Dispatch is offered from the Philippines. This policy describes our processing under Philippine law, including the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission.
We decide what account, billing and usage data is collected and why, so for that data we are the personal information controller.
Data Protection Officer: dpo@truepoint.ph, or by post at the address above, marked for the attention of the Data Protection Officer. You can also complain to the National Privacy Commission at privacy.gov.ph.
2. Two kinds of data, two roles
| Whose data | Examples | Our role |
|---|---|---|
| You, the person with a Dispatch account | Name, email, sign-in details, workspace settings, billing and usage records | We are the personal information controller. This policy governs it. |
| Your end users, the people who talk to your agents through your website, the widget, Facebook Messenger or the API | The name, email and phone number your integration sends us, and their messages and conversations | We are a personal information processor acting on your instructions. You are the personal information controller and must give your end users your own privacy notice. |
The content you put into Dispatch (agent instructions, knowledge files, FAQs, conversations) is yours. We process it only to run the service for you.
3. What we collect, why, and for how long
For each activity below we say what data we use, why, the lawful basis we rely on, and how long we keep it. We do not rely on your consent for any of these activities, so you never have to give consent to use Dispatch. If we ever want to rely on consent, for example for marketing emails, we will ask for it separately and you can refuse or withdraw it at any time.
3.1 Creating and signing in to your account
- What: your name, email address, the time you accepted our Terms of Use (which include the Refund Policy) and were shown this policy, one-time sign-in codes, passkeys (we store only the public key), and, if you sign in with Google or another sign-in provider we offer, your account ID and basic profile (name and email) from that provider.
- Where it comes from: from you, or from the sign-in provider you choose.
- Why: to create your account, confirm your email address and keep your account secure.
- Lawful basis: necessary to provide the service you asked for under our contract with you.
- Required? Yes. Without an email address we cannot create an account.
- How long: while your account exists. One-time codes expire after use or within minutes.
3.2 Running the service
- What: the workspaces, agents, instructions, abilities, knowledge files, FAQs, tasks (one-off and recurring), API keys and conversations you create, plus the text we extract from files and the search embeddings we compute from them.
- Why: to provide the features you use: agent replies, knowledge search, file previews, task runs and the public API.
- Lawful basis: necessary to perform our contract with you.
- How long: until you delete the item or close your account (see section 7).
- Shareable files: if you make a knowledge file shareable, anyone with its link can open it, and an agent may show it in a conversation, until you turn sharing off or delete the file.
3.3 AI processing
- What happens: to produce a reply, we send the relevant instructions, knowledge excerpts and conversation history to the AI model you pick for the agent. The model generates the reply; it does not learn from it. Uploaded documents may be sent to a document-reading (OCR) service so their text can be extracted, and we turn that text into search embeddings so an agent can find the right passages. We also use AI models for internal tasks such as helping you set up agents and classifying content.
- Who: Anthropic and OpenAI for agent replies; Amazon Web Services (Amazon Bedrock) for embeddings and some internal tasks; Mistral AI for reading documents; TypeSafe AI for classification. See section 5.
- Lawful basis: necessary to perform our contract with you.
- Training: we do not use your content or your end users’ conversations to train AI models. We use these providers through their business APIs.
- Provider retention: AI providers may keep the requests we send them for up to 30 days to detect abuse, under their API terms. We do not turn on OpenAI’s option to store responses.
- Your own key: if you connect your own AI provider key, we send the prompts for that agent to that provider with your key. That provider bills you and handles the content under its own terms. Its location is the one it publishes, which may differ from the table in section 5.
- Web search: if you turn on the Web Search ability, an agent can search and read pages on the domains you allow. Your search queries are sent to the AI provider’s search tool.
- Risks and safeguards: AI replies can be wrong, incomplete or inappropriate, and anything you or your end users put in a conversation is sent to the AI provider. To limit this, we send only what the reply needs, use providers that do not train on API data, and let you choose the model, the knowledge and the instructions each agent uses. Avoid putting sensitive personal information into agents unless you need to (see section 3.8).
3.4 Your end users (when your agent is live)
- What: whatever your integration sends us: a name, email address and phone number (all optional), the messages exchanged, and any context fields you attach. Our widget also sends the visitor’s local time and time zone, so the agent knows the time where the visitor is. If you connect Facebook Messenger, Meta receives the messages and the identifiers that channel uses. If you connect another tool, that tool receives only the data the connection needs, and only while you leave it connected.
- Why: to let your agent hold a conversation and keep its history, on your instructions, and to pass a connected tool only what you asked that connection to do.
- Our role: personal information processor. Your own privacy notice governs this data. We use it only to provide Dispatch to you, and not for our own purposes.
- How long: until you delete the conversation or agent, or close your account.
3.5 Billing and payments
- What: your plan, credit and minute balances, top-ups, invoices and transaction records. Paddle.com is our reseller and Merchant of Record: Paddle collects your payment details and billing address directly, and we never see your full card number.
- Why: to charge for the service, keep balances accurate and meet tax and accounting duties.
- Lawful basis: our contract with you, and our legal obligation to keep tax and accounting records.
- How long: while your account exists, and afterwards for 5 years after the end of the tax year they relate to, as Philippine tax law requires, or longer if they are needed for a pending tax case.
3.6 Usage, security and support
- What: usage records (AI tokens, run minutes, model used), your IP address and browser details in session and server logs, rate-limiting counters, and the messages you send our support team.
- Why: to bill usage, keep the service secure and working, stop abuse and answer your questions.
- Lawful basis: our contract with you, and our legitimate interest in keeping Dispatch secure and preventing fraud and abuse. That interest does not override your rights: we use this data only for these purposes and keep it only as long as stated here.
- How long: sessions expire after 2 hours of inactivity. Server logs are kept for 15 days. Usage records are kept as long as the billing records they support. Support messages are kept while your account exists.
3.7 Emails we send
- What: service emails: sign-in codes, billing notices, warnings before credits expire, and changes to these documents.
- Lawful basis: our contract with you, and our legal obligation to tell you about changes.
- Marketing: we do not send marketing emails today. If that changes, we will ask for your consent first, and every marketing email will include a way to unsubscribe.
3.8 Sensitive personal information
Dispatch does not ask for sensitive personal information, such as information about health, religion, political affiliation, government-issued numbers or legal proceedings. Agents may still receive it if you put it in your knowledge files or an end user types it into a conversation. If your agents are meant to handle sensitive personal information, you must have a lawful basis for it under the Data Privacy Act and tell your end users. We protect any sensitive personal information we receive with the safeguards in section 9.
3.9 Automated decisions
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects, such as a decision about credit, employment or insurance. We do use automated checks to rate-limit traffic and to flag possible abuse. If a check blocks your account or your access to Dispatch, write to support@rundispatch.ai and a person will review it.
4. Cookies and similar technologies
Dispatch uses only cookies that the service needs to work:
| Cookie | Purpose | Duration |
|---|---|---|
| Session cookie | Keeps you signed in | 2 hours of inactivity |
| XSRF-TOKEN | Protects forms against cross-site request forgery | Same as the session |
sidebar_state |
Remembers whether you collapsed the sidebar | 7 days |
When you pay, Paddle’s checkout may set its own cookies for payment processing and fraud prevention. Paddle’s privacy policy covers those cookies.
We do not use analytics, advertising or cross-site tracking cookies. If we add any, we will ask for your consent before setting them.
5. Who we share data with
We do not share your personal data with other companies for their own purposes. We use the service providers below to run Dispatch. They process personal data only on our instructions and only to provide their part of the service, under contracts that require them to keep it confidential and secure.
| Provider | What they do for us | Where the data is processed |
|---|---|---|
| Amazon Web Services | Hosting, database, file storage, queues, email delivery (Amazon SES), AI models through Amazon Bedrock | Singapore. Bedrock requests may be routed to AWS regions worldwide. |
| Anthropic | AI model replies (Claude) | United States |
| OpenAI | AI model replies (GPT) | United States |
| Mistral AI | Reading text from uploaded documents (OCR) | European Union |
| TypeSafe AI | Content classification | United States |
| Ably | Real-time updates in the app | United Kingdom, United States, European Union and Australia |
| Meta Platforms | Facebook Messenger, only if you connect a Page | United States and other countries where Meta operates |
| A tool you connect | Only the data that connection needs, and only while you leave it connected | The country that tool’s provider publishes |
| Paddle.com | Checkout, payments, invoicing, tax (Merchant of Record) | United Kingdom and other countries |
| Google (and any other sign-in provider we offer) | Sign-in, only if you choose that option | United States and other countries |
We may also disclose data when the law requires it (for example, a subpoena or an order of the National Privacy Commission or a court), to protect our rights or the safety of others, or to a buyer or successor if our business is sold or reorganized. In that last case we will tell you first.
We do not sell your personal data, and we do not share it for advertising.
6. International transfers
Our main hosting region is Singapore, and the providers above process data in the United States, the European Union, the United Kingdom and other countries. When personal data leaves the Philippines, we stay responsible for it. We transfer it only to providers bound by contracts that require them to protect it to the standard of the Data Privacy Act, and we check that they have adequate security measures. You can ask for details at support@rundispatch.ai.
7. How long we keep data, and deleting it
- General rule: we keep personal data only as long as we need it for the purposes in section 3, to meet a legal obligation, or to establish, exercise or defend legal claims. When we no longer need it, we delete it or anonymize it so that it can no longer identify you.
- Content: you can delete agents, conversations, knowledge files and FAQs at any time. When you do, we also delete their extracted text and embeddings.
- Closing your account: you can close your account in Settings. We then delete or anonymize your personal data and your workspace content within 7 days, except data we must keep by law, such as billing records (section 3.5).
- Backups: deleted data can remain in our encrypted backups for up to 7 days until those backups are overwritten. We do not restore deleted data from backups except to recover from an incident, and if we do, we delete it again.
8. Your rights
Under the Philippine Data Privacy Act of 2012, you have the right to:
- be informed whether and how your personal data is processed, including any automated decisions (this policy does that), and to be told before we make a material change to how we process it (section 11);
- object to processing, including processing for direct marketing, automated processing or profiling. If you object, we stop, unless we need the data to provide the service under our contract with you, to meet a legal obligation, or to comply with a subpoena;
- access your personal data, including where it came from, who received it and why, how it was processed, and when it was last accessed and changed;
- correct data that is inaccurate or incomplete;
- erase or block your data, for example if it is no longer needed, was unlawfully obtained, or is being used for a purpose you did not authorize;
- data portability: receive the data you gave us in an electronic, structured and commonly used format;
- withdraw consent at any time where we rely on it, without affecting processing done before;
- be indemnified for damages if you suffer harm because your data was inaccurate, unlawfully obtained or used without authorization;
- file a complaint with the National Privacy Commission (privacy.gov.ph).
Your lawful heirs and assigns can exercise these rights after your death, or if you are incapacitated.
How to make a request: email support@rundispatch.ai. You do not need to create an account to make a request. We will ask for proof of identity only if we have a reasonable doubt about who you are. We answer within 15 days, and it is free unless a request is clearly unfounded or excessive. If we decline a request, we will tell you why and how you can challenge our decision. Please contact us first so we can try to fix the problem; you can still go to the National Privacy Commission at any time.
If you are an end user of a business that uses Dispatch, please contact that business first, because it controls your data. If you write to us, we will forward your request to the business and help it respond.
9. Security
We protect personal data with organizational, physical and technical measures. We encrypt data in transit (TLS) and at rest, limit access to the people and systems that need it, bind our staff to confidentiality, store passkeys as public keys only, and use one-time codes instead of passwords. Our hosting provider protects the physical data centres.
No system is completely secure. If a personal data breach is likely to put you at real risk of serious harm, we will notify you and the National Privacy Commission within 72 hours of becoming aware of it, as the Data Privacy Act requires. We will tell you what happened, what data was involved, what we are doing about it, what you can do, and who to contact. If the breach involves your end users’ data, we will tell you within 8 hours of becoming aware of it so that you can notify them.
10. Children
Dispatch is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you think a child has given us personal data, contact us at support@rundispatch.ai and we will delete it.
11. Changes to this policy
If we make a material change, such as a new purpose, a new kind of recipient, a new transfer destination or a change in how you exercise your rights, we will email you and show a notice in the app before the change takes effect. You can object to the change or close your account before it applies to you. We will also update the “Last updated” date above. Small corrections are made without notice.
12. Contact us
- Questions about your data, and requests to access, correct, export or delete it: support@rundispatch.ai or +63 977 821 1163
- Data Protection Officer: dpo@truepoint.ph
- Legal notices and requests from authorities: legal@truepoint.ph
Truepoint Technologies, Inc.
Unit S13, 2F Robertson Plaza, Centennial Road, Tabon 1, Kawit, Cavite, Region IV-A (CALABARZON), 4104, Philippines