Privacy Policy

1. Introduction and Scope

This Privacy Policy describes how Spekkel, LLC ("Spekkel," "we," "us," or "our"), the operator of the Shepherd Action relationship management platform ("Shepherd Action" or the "Service"), collects, uses, shares, and protects personal information when you visit shepherdaction.com (the "Website"), use the Service, exchange messages with us or with a business that uses the Service, or otherwise interact with us.

This Privacy Policy applies to three groups of people:

• Visitors and Leads — people who browse the Website, submit a form, register for a workshop, or book a strategy session with us.
• Customers and Users — businesses, ministries, and individuals who create an account and operate a workspace on the Service ("Customers"), and the people they authorize to use it ("Users").
• Contacts — people whose information a Customer stores in the Service, or who receive email or SMS messages sent by a Customer through the Service.

If you are a Contact, please read Section 6. In most cases the Customer who added you to the Service, not Spekkel, decides how your information is used, and your requests should be directed to that Customer.

By using the Website or the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Website or the Service.

2. Information We Collect

Information You Provide Directly

• Contact details — your name, email address, phone number, organization, and role when you submit a form, register for an event, book a meeting, request support, or create an account.
• Account and profile information — login credentials, workspace name, business name, business mailing address, time zone, branding, and notification preferences.
• Billing information — plan selection and billing contact. Payment card details are collected and processed by our payment processor; we do not store full card numbers.
• Communications — messages you send to us, support requests, feedback, survey responses, and information you share during meetings, coaching sessions, or correspondence.
• Customer Data — contacts, notes, tags, campaign content, templates, tasks, and other content that you or your Users upload, create, or import into your workspace (see Section 6).

Information Collected Automatically

• Device and connection data — IP address, browser type and version, operating system, device identifiers, and language settings.
• Usage data — pages viewed, features used, actions taken, timestamps, links clicked, and referring pages.
• Message engagement data — whether an email was delivered, opened, clicked, bounced, or marked as spam, and whether an SMS message was delivered, failed, or received a reply.
• Log and security data — authentication events, API and agent requests, error reports, and audit records.
• Cookies and similar technologies (see Section 10).

Information from Integrations and Third Parties

• Email accounts you connect (for example Google Workspace or Microsoft 365) — mailbox metadata and message content necessary to send, receive, and synchronize email with your contacts.
• Calendar and scheduling tools you connect (for example Calendly or Google Calendar) — event details, invitee names, email addresses, and phone numbers supplied at booking.
• Messaging and automation services — delivery status and reply data from our SMS carrier (Twilio), our email delivery provider, and automation platforms you connect (for example Zapier).
• AI agents and API clients you authorize — requests made to your workspace through an API key or Model Context Protocol (MCP) connection, including the identity of the key used and the actions taken.
• Public or licensed business information used to verify identity, prevent fraud, or register messaging campaigns with carriers.

3. How We Use Information

We use the information we collect to:

• Provide, operate, secure, maintain, and improve the Website and the Service.
• Create and administer accounts and workspaces, authenticate Users, and provide customer support.
• Send the email and SMS messages that Customers compose and schedule through the Service, and report on their delivery and engagement.
• Send service communications about your account, billing, security, and changes to the Service or our policies.
• Send SMS messages to people who have expressly opted in to receive them from us (see Section 4).
• Send marketing email that you have requested or that we are otherwise permitted to send, with an unsubscribe link in every message.
• Process payments, manage subscriptions, and prevent fraud and abuse.
• Register and maintain A2P 10DLC messaging campaigns with wireless carriers and enforce carrier and industry messaging rules.
• Monitor for and enforce compliance with our Terms of Service, including suppression of opted-out recipients across the Service.
• Comply with legal obligations, respond to lawful requests, and establish, exercise, or defend legal claims.
• Produce aggregated or de-identified statistics that do not identify any individual.

We do not use Customer Data or the content of your messages to train general-purpose artificial intelligence models, and we do not permit our AI service providers to do so.

4. SMS Program and Mobile Information

This section describes how Spekkel collects and handles mobile phone numbers and SMS consent for messages that we send under our own brand, "Shepherd Action by Spekkel." Messages that a Customer sends to its own Contacts through the Service are governed by that Customer's consent practices and Section 6.

How You Opt In

You opt in to the Shepherd Action SMS Program by completing the public web form on shepherdaction.com, entering your mobile phone number, and checking the SMS consent checkbox. The checkbox is unchecked by default and the form will not accept a phone number until the box is checked. The consent language reads:

"By checking this box, I agree to receive SMS messages from Shepherd Action by Spekkel at the phone number provided. Message and data rates may apply. Message frequency varies (2 to 15 messages per month). Reply STOP to opt out, HELP for help."

We record the date, time, source page, and IP address of each opt-in and retain that record for as long as we send you messages and for a reasonable period afterward to demonstrate consent.

Message Types and Frequency

Messages include appointment and strategy-session reminders, booking confirmations, follow-up communications, and informational updates about Shepherd Action. Message frequency varies, typically 2 to 15 messages per month.

Message and Data Rates

Message and data rates may apply according to your wireless carrier plan.

How to Opt Out

Reply STOP to any message to unsubscribe. You will receive one final confirmation message and no further messages. You may also email support@spekkel.ai with your phone number and an opt-out request. Reply START to resubscribe.

Help

Reply HELP to any message, or email support@spekkel.ai, for assistance.

No Sharing of Mobile Information

We do not share, sell, rent, or disclose your mobile phone number, SMS consent status, or SMS opt-in information with third parties or affiliates for their marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. We disclose mobile numbers only to the service providers we use to deliver the messages you requested (such as our SMS carrier, Twilio), and only for that purpose. Those providers are contractually prohibited from using your mobile information for any other purpose.

Supported Carriers

Messages are supported on all major U.S. wireless carriers, including AT&T, T-Mobile, Verizon, U.S. Cellular, and their affiliates. Carriers are not liable for delayed or undelivered messages.

5. Email Communications

If you provide your email address to us, we may send you service messages and, where permitted, marketing messages about Shepherd Action. Every marketing email we send identifies Spekkel, LLC as the sender, includes our physical mailing address, and contains a working unsubscribe link. We honor unsubscribe requests within ten (10) business days as required by the CAN-SPAM Act, and in practice immediately. You cannot unsubscribe from essential service messages (such as billing notices and security alerts) while you hold an account.

6. Customer Data and Contacts

Our Role

When a Customer stores Contact information in the Service or sends messages through it, the Customer determines what information is collected, why it is collected, and whether the Contact has consented to receive messages. For that information ("Customer Data"), the Customer is the data controller or "business," and Spekkel acts as a data processor or "service provider." We process Customer Data only on the Customer's instructions, as set out in our Terms of Service, and as required by law.

What This Means for Contacts

If a Customer has added you to Shepherd Action or sent you a message through it:

• The Customer is responsible for having a lawful basis and, for SMS, your prior express consent, before messaging you.
• To opt out of SMS, reply STOP to the message. To opt out of email, use the unsubscribe link in the message. The Service records the opt-out and suppresses further bulk messages from that Customer to you.
• To access, correct, or delete the information a Customer holds about you, contact the Customer directly. Their name and contact details appear in the messages they send you. If you are unable to reach them, contact us at support@spekkel.ai and we will forward your request.

Customer Responsibilities

Customers must not upload Customer Data they are not authorized to use, must provide any notices and obtain any consents required for their use of the Service, and must not store sensitive personal information (such as Social Security numbers, payment card numbers, health records, or government identifiers) in free-text fields of the Service.

Multi-Tenant Isolation

Each Customer workspace is logically separated. Customer Data in one workspace is not visible to other Customers, and API and agent credentials are scoped to a single workspace.

7. Artificial Intelligence, Automation, and Connected Agents

The Service includes optional features that use artificial intelligence ("AI Features") to draft messages, summarize notes, suggest follow-ups, and complete tasks. The Service also allows Customers to connect external AI agents and automation tools to their workspace through API keys and MCP connections ("Connected Agents").

• When you use an AI Feature, the relevant content is transmitted to our AI service provider solely to generate the requested output. We contractually require our AI providers not to use your content to train their models and to delete it after processing.
• Connected Agents act on behalf of the Customer who authorized them. Every agent action is logged with the key used, the workspace affected, and the result. Customers control which capabilities each key may use and may revoke any key at any time.
• Connected Agents operated by third parties (for example an automation platform or agent service you choose) are governed by that third party's privacy policy. We are not responsible for how a third-party agent handles information once it leaves the Service.
• AI output may be inaccurate. You remain responsible for reviewing AI-generated content before you send or rely on it.

8. How We Share Information

We share personal information only in the following circumstances:

Service Providers

We engage third-party providers who process information on our behalf and under our instructions, including cloud hosting and database services, SMS carriers and aggregators (such as Twilio), email delivery providers, payment processors, AI model providers, analytics tools, and customer-support tools. Each provider may access only the information needed to perform its services and is bound by confidentiality and data-protection obligations.

Integrations You Authorize

When you connect a third-party service (such as Google, Microsoft, Calendly, Zapier, or a Connected Agent), we exchange information with that service as needed to provide the integration you requested. Your use of the third-party service is governed by its own terms and privacy policy.

Wireless Carriers and Messaging Registries

To send SMS on behalf of a Customer we may provide the Customer's business identity, contact information, campaign descriptions, and sample messages to carriers and The Campaign Registry for A2P 10DLC registration and vetting.

Legal, Safety, and Enforcement

We may disclose information if we believe in good faith that disclosure is required by law, subpoena, court order, or governmental request; to enforce our Terms of Service; to investigate fraud, abuse, or security incidents; or to protect the rights, property, or safety of Spekkel, our Customers, Contacts, or the public.

Business Transfers

If Spekkel is involved in a merger, acquisition, financing, reorganization, or sale of some or all of its assets, information may be transferred as part of that transaction, subject to this Privacy Policy. We will notify affected Customers before their information becomes subject to a materially different privacy policy.

With Your Direction or Consent

We share information when you direct us to or otherwise consent.

What We Do Not Do

We do not sell personal information. We do not "share" personal information for cross-context behavioral advertising as defined under California law. We do not share mobile phone numbers, SMS consent, or opt-in data with third parties or affiliates for marketing purposes.

9. Google and Microsoft Account Data

If you connect a Google account, our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. If you connect a Microsoft account, our use of information from Microsoft Graph adheres to the Microsoft APIs Terms of Use. In both cases we use connected-account data only to provide the email and calendar features you enable, we do not use it for advertising, we do not allow humans to read it except with your consent, for security purposes, or as required by law, and we do not transfer it to others except as necessary to provide those features, to comply with law, or as part of a merger or acquisition. You may disconnect an account at any time from your workspace settings, after which we stop synchronizing and delete cached credentials.

10. Cookies and Tracking Technologies

We use cookies and similar technologies to keep you signed in, remember your preferences, secure the Service, and understand how the Website and Service are used. We may use first-party analytics to measure traffic. We do not use third-party advertising cookies or sell data collected through cookies. You can control cookies through your browser settings; disabling them may prevent parts of the Service from working. Because there is no industry standard, we do not currently respond to browser "Do Not Track" signals, but we honor Global Privacy Control signals where required by law.

11. Data Retention

We retain personal information for as long as needed to provide the Service, comply with legal and carrier record-keeping obligations, resolve disputes, and enforce our agreements. In particular:

• Account and Customer Data are retained while the account is active. After termination, Customers have thirty (30) days to export their data, after which we delete or de-identify it within ninety (90) days except as retained in routine backups or as required by law.
• SMS and email consent, opt-out, and suppression records are retained for at least four (4) years after the last message, consistent with the statute of limitations under the Telephone Consumer Protection Act, and opt-out records may be kept indefinitely to honor the opt-out.
• Message logs and delivery records are retained for operational, compliance, and audit purposes for a reasonable period.
• Billing records are retained as required by tax and accounting law.

12. Data Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls and role-based permissions, workspace-scoped credentials, audit logging of API and agent activity, and regular review of our service providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security breach affecting your personal information, we will notify you and any applicable regulators as required by law. You are responsible for safeguarding your credentials and API keys and for notifying us promptly at support@spekkel.ai of any suspected unauthorized access.

13. Your Privacy Rights and Choices

Depending on where you live, you may have the right to:

• Know or access the personal information we hold about you and receive a copy of it.
• Correct inaccurate or incomplete personal information.
• Delete personal information, subject to legal exceptions.
• Receive your information in a portable format.
• Opt out of marketing communications at any time.
• Restrict or object to certain processing, and withdraw consent where processing is based on consent.
• Not be discriminated against for exercising your rights.

To exercise these rights, email support@spekkel.ai or write to the address in Section 18. We will verify your identity before acting on a request and respond within the time required by applicable law (generally forty-five (45) days). You may designate an authorized agent to make a request on your behalf; we may require proof of authorization. If we deny a request, you may appeal by replying to our decision.

If your information was provided to us by a Customer as part of Customer Data, we will refer your request to that Customer and assist them in responding.

United States State Privacy Laws. Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have the rights described above to the extent provided by those laws. In the preceding twelve months we have collected the categories of personal information described in Section 2, for the purposes described in Section 3, and disclosed them to the categories of recipients described in Section 8. We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use or disclose sensitive personal information for purposes other than those permitted by law. We do not knowingly process the personal information of consumers under sixteen (16) years of age.

European Economic Area, United Kingdom, and Switzerland. If you are located in these regions, our legal bases for processing are performance of a contract, our legitimate interests (such as operating and securing the Service), compliance with legal obligations, and your consent. You have the rights described above as well as the right to lodge a complaint with your local supervisory authority. When we transfer personal information out of these regions we rely on standard contractual clauses or another lawful transfer mechanism.

14. Children's Privacy

The Service is a business tool and is not directed to children. You must be at least eighteen (18) years old to create an account. We do not knowingly collect personal information from children under thirteen (13). If you believe a child has provided us with personal information, contact us at support@spekkel.ai and we will delete it.

15. International Users

Spekkel is located in the United States, and the Service is hosted and operated there. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States, where privacy laws may differ from those of your country. By using the Service you consent to that transfer.

16. Third-Party Websites and Services

The Website and Service may link to or integrate with third-party websites and services that we do not control. This Privacy Policy does not apply to them, and we are not responsible for their privacy practices. We encourage you to review the privacy policy of every third-party service you use.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date above. If the changes are material, we will provide additional notice, such as by email to account holders or a prominent notice in the Service, at least fourteen (14) days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the revised policy.

18. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, contact us at:

Spekkel, LLC
Attn: Privacy
8787 Branch Ave., #179
Clinton, MD 20735
Email: support@spekkel.ai
Website: https://shepherdaction.com

© 2026 Spekkel, LLC. All rights reserved. · 8787 Branch Ave., #179, Clinton, MD 20735