Privacy Policy
Last Update: December 2, 2025
Table of contents
Introduction
This Privacy Policy describes how CityOS, Inc. and its subsidiaries and affiliates (collectively, "CityOS," "we," "us," or "our") collects, uses, discloses, and protects personal information in connection with our Services.
Services: means our AI-powered marketing automation platform, including our Smart Channels for SMS and email messaging, Marketing Assistant (CityOS Copilot), analytics dashboard, and any other services, features, content, applications, or websites we operate.
1. Who this Policy Covers
This Privacy Policy applies to three categories of individuals:
Merchants
Companies, organizations, or individual business owners who contract with CityOS for the Services. This includes sole proprietors, partnerships, and corporate entities.
B. Authorized Users
Employees, agents, contractors, and other individuals whom a Merchant has authorized to access and use the Services on the Merchant's behalf.
C. End Users (Customer Contacts)
Individuals who are current or prospective customers, clients, or patients of our Merchants and who receive messages or communications through our Services. This includes individuals who:
Receive SMS or email messages sent through CityOS
Interact with CityOS-powered chat widgets
Respond to CityOS-generated campaigns
Engage with AI-powered communications
D. Website Visitors
Individuals who visit www.cityos.ai or related CityOS websites to learn about our Services, request information, or browse our content.
Throughout this Privacy Policy, "you" and "your" refer to you as a reader, and how we handle your information depends on which category you fall into
When CityOS is a Data Controller (or "Business"):
For Merchant account information and billing data
For Authorized User login credentials and activity
For Website Visitor browsing and form submissions
For AI Network Intelligence (anonymized aggregate data)
When AI generates autonomous responses (joint controller with Merchant)
When CityOS is a Data Processor (or "Service Provider"):
For End User contact information provided by Merchants
For message content and campaign data uploaded by Merchants
When following specific Merchant instructions for message delivery
For End User engagement data collected on Merchants' behalf
Joint Controller Relationship:
For AI-generated responses and autonomous messaging decisions, CityOS and the Merchant share data controller responsibilities. See Section 3.3 for details.
If you are an End User:
The Merchant who sent you messages is primarily responsible for your data. To exercise privacy rights related to messages you receive, contact that Merchant directly. However, you can always contact us at privacy@cityos.ai for AI-related concerns or if you cannot reach the Merchant.
By using our Services or providing us with personal information, you acknowledge and agree to the data practices described in this Privacy Policy.
2.Information We Collect
The personal information we collect depends on your relationship with CityOS and how you interact with our Services.
Account and Registration Information
Name, email address, password, business name and entity information (such as EIN or Tax ID), business address, phone number, job title, industry, number of locations, and business hours.
Payment and Billing Information
We use Stripe to process payments. Stripe collects and stores your payment details. We receive only limited information such as the last 4 digits of your card number, card brand, expiration date, and transaction amounts. For details on how Stripe handles payment data, see stripe.com/privacy.
Communication and Campaign Content
Messages you send or receive through CityOS (SMS, and Emails), campaign content, customer notes and annotations, and your communications with our support team.
Usage Data
Information about how you use our Services, including login times, features accessed, dashboard interactions, settings and preferences, campaign performance, and reports generated.
Contact Information
Name, phone number, email address, and mailing address (if provided).
Engagement Data
Your message content and replies, response times and patterns, email opens and clicks, conversation history, opt-in and opt-out dates, and communication preferences.
Behavioral Patterns
When you typically engage with messages, what content you click on or respond to, topics and offers you show interest in, and tone preferences.
Transaction Information (If Applicable)
Purchase history, transaction amounts and dates, and payment methods used (tokenized, not raw card data).
Location Information
General geographic area (inferred from phone number area code or IP address), city or region, and time zone.
Important: The Merchant who sent you messages is the primary data controller of this information. For privacy requests, contact the Merchant first or email us at privacy@cityos.ai if you cannot reach them.General geographic area (inferred from phone number area code or IP address), city or region, and time zone.
Phone numbers you communicate with
Frequency, duration, and timing of message exchanges
Service types used (SMS, MMS)
How We Handle CPNI:
Collected only as necessary to provide SMS Services
Protected with appropriate security measures
Used only for service provisions (not marketing)
Access restricted to authorized personnel with business needs
Not shared except as required by law
Your Rights: You have the right to approve or deny use of your CPNI for marketing purpose. CityOS does not currently use your CPNI for our own marketing. Contact compliance@cityos.ai with CPNI questions.
2.4 Information Collected from Website Visitors
A. Information You Provide
Name, email address, phone number, business name, job title, company, and message content when you fill out contact forms, request demos, or reach out to us.
B. Automatically Collected Information
IP address and general location, browser type and version, device information, operating system, referring website, pages viewed and time spent, links clicked, and date and time of visit.
C. Cookies and Tracking
See Section 5 for detailed information about cookies and tracking technologies.
3.How We Use Your Information
For Merchants and Authorized Users
Create and manage accounts, authenticate users, process billing, provide customer support, analyze platform performance, develop new features, and conduct research.
For End Users (processed on behalf of Merchants)
Deliver SMS and email messages, generate AI responses, optimize send times, track engagement, honor opt-out requests, and provide Merchant analytics.
How It Works
We collect engagement data (open rates, click rates, response times), anonymize it (remove all identifying information), identify patterns (best send times, effective content, optimal frequency), and apply insights to improve Local Models, City Network, and platform-wide best practices.
What We Create
Aggregate benchmarks, timing optimization models, content effectiveness scores, and industry-specific insights.
Ownership
CityOS owns all anonymized Network Intelligence data and may use it for improving Services, creating benchmarks, marketing materials, research, and licensing to third parties (anonymized only).
Opt-Out
Merchants may opt out of contributing data to Network Intelligence by contacting legal@cityos.ai. Opted-out merchants will still benefit from aggregate insights generated by other merchants, but their data will not be included in network learning.
What CityOS Controls:
AI model training and updates
Content safety filters
Legal compliance mechanisms
Response quality and accuracy
What Merchants Controls:
Enabling/Disabling AI features
Configuring tone and brand voice
Campaign goals and timing
Customer data used for personalization
How It Works
We use machine learning to analyze customer interactions, predict engagement patterns, generate personalized message content, optimize send timing, and recommend offers based on behavior.
AI Transparency
All AI-generated messages can be identified. End users can request human review of AI decisions. Merchants can override AI recommendations (where applicable). Our AI does not make decisions about creditworthiness, employment, housing, or other legally protected categories.
AI Limitations
AI may occasionally generate inaccurate content, misinterpret context, or make suboptimal recommendations. CityOS continuously monitors and improves accuracy, but merchants should review AI suggestions when appropriate.
Your Rights Regarding AI
Request information about AI decisions affecting you, opt out of AI-driven personalization (may reduce effectiveness), and request human review of AI-generated content.
Transactional
Account alerts, billing notices, security alerts, password resets, support responses, and legal notices.
Marketing
Product updates, tips and webinars, promotional offers, surveys, and industry insights.
See Section 8 for opt-out instructions.
Our Marketing
Send promotional emails, display CityOS ads on social media and other websites, measure ad effectiveness, and analyze audience demographics.
Merchant Marketing
Enable Merchants to send campaigns, recommend AI-personalized offers, track performance, and segment audiences.
Enforce Terms of Service and Acceptable Use Policy, comply with TCPA/CAN-SPAM/telecommunications laws, respond to legal requests, detect and prevent fraud/spam, investigate abuse, protect rights and property, and maintain platform security.
Service Providers
We share data with vendors who help us operate (Twilio and Sinch for SMS, SendGrid for email, AWS for hosting, Stripe for payments, Google Analytics). All service providers are contractually required to protect your data and use it only for specified purposes.
With Merchants
End User data is shared with the Merchant who sent you messages (contact info, engagement data, conversation history). The Merchant is the primary data controller.
For Legal Reasons
We disclose information when required by law, to respond to legal processes, to protect rights and safety, to prevent fraud, or in emergency situations.
Business Transfers
If CityOS is acquired or merged, your information may transfer to the new entity. We'll notify you and ensure your rights continue.
Aggregated/De-identified Data
We freely share anonymized data that cannot identify you (industry benchmarks, aggregate statistics, research insights).
With Your Consent
We may share your data in other ways with your explicit permission.
5.Cookies and Tracking Technologies
What We Use:
Essential Cookies:
Authentication, security, load balancing, session management.
Analytics Cookies:
Google Analytics, performance monitoring, heatmaps, session replay.
Marketing Cookies:
Google Ads, Facebook Pixel, LinkedIn Insight Tag, retargeting.
Your Choices
Browser Settings:
Block cookies in Chrome/Firefox/Safari/Edge settings.
Do Not Track:
We don't currently respond to DNT signals but honor direct opt-out preferences.
6.Data Retention
How Long We Keep Data:
Merchant Account Info Retention Period: Active + 90 Days
Billing Records Retention Period: 7 Years
End User Contact Data Retention Period: While Merchant Active +90 Days
Opt-out List Retention Period: Indefinite (Required by Law)
Usage Logs Retention Period: 2 Years
After Account Cancellation: Data deleted within 90 days (except billing records, opt-out lists, and anonymized data).
Legal Holds: Data retained longer if required for litigation, investigations, or legal compliance.
7.Data Security
We use industry-standard security including encrypted connections (HTTPS/TLS), secure authentication, access controls, and ISO 27001-certified data centers (Hetzner US).
No system is completely secure. We will notify you of any breach as required by law.
8.Your Rights and Choices
For End Users (Merchant Customers)
Stop SMS messages: Reply STOP to any message
Stop emails: Click unsubscribe or reply STOP
Access your data: Contact the merchant or email privacy@cityos.ai
Delete your data: Contact the merchant or email privacy@cityos.ai
Correct your data: Contact the merchant directly
Note: CityOS processes your data on behalf of merchants. For fastest response, contact the merchant directly.
For Merchants and Authorized Users
Access your data: Log in to your dashboard or email privacy@cityos.ai
Delete your account: Email support@cityos.ai (30-day notice required)
Correct your data: Update in your dashboard or email privacy@cityos.ai
Export your data: Request via dashboard or email support@cityos.ai
Stop marketing emails: Click unsubscribe (cannot opt out of transactional messages)
Response Time: We respond to requests within 30-45 days as required by law.
Verification: We may verify your identity before processing requests.
State-Specific Rights: See Section 11 for additional rights under California, Virginia, Colorado, and Connecticut law.
9.Children's Privacy
Our Services are not for anyone under 18.
We don't knowingly collect information from children. If we discover we have, we'll delete it immediately.
Parents: If your child provided information to us, email support@cityos.ai and we'll delete it within 30 days.
10.International Data Transfers
Primary Operations: US-based servers and merchants only.
International Users: If you're outside the US and interact with a US merchant using our Services, your data will be transferred to and processed in the United States.
Contact: legal@cityos.ai
11.State-Specific Privacy Rights
California (CCPA/CPRA)
Your Rights: Know what we collect, delete your data, correct inaccuracies, opt out of sales/sharing (we don't sell), limit use of sensitive data.
We Don't Sell Data: In the past 12 months: no sales, limited "sharing" for advertising (website visitors only).
Exercise Rights: Email privacy@cityos.ai
Response Time: 45 days (may extend to 90)
Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA)
Your Rights: Know, correct, delete, portability, opt out of targeted advertising/profiling.
Appeal Process: Email privacy@cityos.ai, then contact your state Attorney General if unsatisfied.
12.Privacy Policy Updates
We may update this Privacy Policy from time to time. If we make a material change to the Privacy Policy, we will notify you.
13.Contact Us
If you have any questions about this Privacy Policy, you can email us at privacy@cityos.ai
