Privacy
Last updated 18 October 2026.
TextPA answers a business's incoming enquiries by text. Customers' messages pass through it and are never kept. If a business's assistant texted you this link, the first section is for you. The rest is for the businesses that use TextPA: what is on their phone, what our servers keep, who else sees anything, how the assistant decides, and how to delete it.
If a business's assistant texted you
- The business you texted uses TextPA, an automated assistant on its own phone, to ask for the details it needs. The business decides what to ask and deals with your enquiry itself.
- Your number and your answers stay on the business's phone. Your number is never sent to our servers.
- Your message is read in memory in Sydney to work out what you need, and is then gone. It is not stored by us anywhere.
- Every reply is fixed wording. The assistant never gives advice, quotes a price, confirms a booking or turns you away; the business does that.
- It does not look for emergencies and is not monitored. If you need urgent help, call 000.
- Reply STOP, or something like "don't text me", and the assistant never texts you again.
- To see or correct your details, ask the business. We hold nothing about you to give.
On your phone
- Your customers' numbers, the answers they gave and where each enquiry stands live on your phone only, in a file that is left out of iPhone backups.
- A customer's number is never sent to our servers.
- Message text is not saved in the app. Messages keeps the texts, as it always has.
- TextPA checks your contacts on the phone so it never replies to someone you have saved. Your contacts never leave the phone.
- A customer may mention something personal, such as an allergy or an injury. It is handled like any other answer: kept on your phone, and never put in a notification.
- An enquiry is removed a day after it is handed over and you have dealt with it or taken it over. One you have not dealt with stays on your list. A STOP is kept for good, so that customer is never texted again. Deleting the app deletes all of it.
What the server keeps
- For each phone, a random install id and the key Apple's App Attest vouched for at setup. There are no accounts, no passwords and no name.
- Your own business mobile number, so we can text you the daily check, with whether the last check passed, whether your subscription is active and a push token for alerts. A push token that stops being refreshed drops out after 60 days.
- An email address, only if you give one, and whether you want news at it. It is never confirmed by us and never written to a log.
- A customer's text reaches the server only while it is being screened, in memory. It is not written to the database, to a log, or to an error report.
- Our logs record what happened, with the install id and lengths, never a number or a message. They are kept for up to six months.
How the assistant decides
Software makes some choices about each text without a person, so here is what it decides and what it never does.
- It sorts a first text from a new number into an enquiry, a customer who is not enquiring, spam, something unrelated, or unsure. Only an enquiry gets a reply.
- When it is unsure, it sends nothing and tells you a text needs a look.
- The language model only reads. Fixed rules decide what is still missing, when the checklist is complete and when to go quiet, and every reply comes from fixed wording.
- It never accepts, declines or prices work. You make every decision about the customer.
Who sees what
A customer's text passes through AWS and Bedrock in memory only, in Sydney. Twilio, RevenueCat and Apple, Sentry and Expo are never sent a customer's number, name or message by us. They are companies based overseas, mainly in the United States, so what they hold may be stored outside Australia.
| AWS (Sydney) | Runs the API and the database, so it holds the install record above. Customer texts pass through its memory and are not stored. |
|---|---|
| AWS Bedrock (Sydney) | The language model that reads a customer's text and reports what it asks for. It writes nothing the customer sees. It is called in Sydney only, never through a routing profile that could serve it from elsewhere, and its request logging is off. |
| AWS email | Your email address and our welcome email to it, only if you gave an address. The welcome email greets you by the name in your setup; we do not keep that name. |
| Twilio | Your business mobile number and the daily check text we send you. Never a customer's number or message. |
| RevenueCat and Apple | Your install id and your subscription. Apple also knows the Apple ID that paid; we do not. |
| Sentry | Errors, with personal details stripped before they leave the phone or the server. |
| Expo and Apple push | Your push token and a fixed line such as "New enquiry ready". The notification cannot carry a customer's name, number or message. |
What we never do
- Store the text of a message, on the server or in the app.
- Use a customer's message to train a model. It is never kept, so there is nothing to train on.
- Send a customer's number to our servers, or let our servers choose who a text goes to.
- Sell or share data. The only parties that see anything are the services in the table.
- Require ID, a name or an account to use TextPA.
- Put a customer's details in a notification, a log, an error report or an email.
Deleting your data
- Settings has Delete everything. It removes the install record, including any email, from our server, and every conversation and setting from your phone. It deletes nothing if the server cannot be reached, so you can try again.
- Our database keeps backups so it can be restored after a fault. A deleted install record, with its business mobile and any email, can still be restored from them for up to 35 days, then it is gone.
- Deleting the app removes what is on your phone. It does not remove the install record on the server; use Delete everything first.
- Your push token is a separate record that expires 60 days after the phone last refreshed it.
- Apple, RevenueCat and Sentry keep their own records, which we cannot delete for you. Apple's page for your subscription is in Settings.
Your rights and complaints
You can ask what we hold about you and have it corrected, by emailing support@textpa.app. We reply within 30 days.
If a data breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner (OAIC), as the Notifiable Data Breaches scheme requires.
To complain about how we handle your information, email us first. If we have not resolved it within 30 days, you can complain to the OAIC at oaic.gov.au or on 1300 363 992.
Legal requests
- We keep no customer's message, name or number, so there is none to hand over. What we hold about you is what this page lists, including the backups above.
- Questions, or a request about your data: support@textpa.app.
Who runs TextPA
TextPA is run by John Bell, a sole trader in Victoria, Australia (ABN 46 336 880 727). When this page changes, the date at the top changes with it.