Privacy Policy
Effective Date: August 11, 2026 | Last Updated: August 11, 2026
This document is a working draft prepared for legal review before publication — see the note at the bottom of this page.
1. Who We Are
Colony ("Colony," "we," "us," or "our") is a product of eOTP, LLC, a United States limited liability company, operating the website colonys.io and the Colony CRM platform. We serve business customers ("Customer," "you") located anywhere in the world. This Privacy Policy explains what personal data we collect, how we use it, and the choices you have.
Colony is a business-to-business (B2B) service. It is not directed at, and we do not knowingly collect personal data from, individual consumers acting outside a business capacity, or from children.
2. Information We Collect
- Account & Company Information: name, email, phone number, company details, and login credentials when you or your team sign up.
- Customer Data You Input: the leads, customers, deals, tickets, tasks, and related business records you or your team create and store in Colony on your own customers' behalf. This data belongs to you — see Section 6.
- Messaging Data: messages, media, and metadata sent or received through connected channels — WhatsApp (via the Meta/WhatsApp Business Platform) and SMS/Voice (via LogicSMS) — when you use those features.
- Usage & Log Data: login activity, feature usage, IP address, and similar technical logs, used for security, troubleshooting, and improving the product.
- Payment Information: Colony itself does not currently charge fees and does not collect payment card details (see Section 5). If that changes, this policy will be updated before any payment collection begins.
3. How We Use Information
- Provide, operate, and maintain the Colony platform.
- Enable the messaging, SMS, and voice features you choose to connect.
- Provide customer support and respond to inquiries.
- Maintain security, detect abuse, and prevent fraud.
- Improve and develop the product.
- Send you service communications (e.g. account, security, and billing notices) and — only if you opt in — marketing and product update emails.
4. AI Processing
Certain Colony features (for example, AI-generated pages and AI-assisted content editing) send relevant content to third-party AI providers — currently Anthropic (Claude) and, for select features, OpenAI — solely to generate the response you requested.
We do not use your data, or your customers' data, to train AI models — ours or any third party's. Data sent to an AI provider is used only to produce your requested output and is handled under that provider's business/API terms, not their consumer product terms.
5. Sharing, Sub-processors & No Sale of Data
We do not sell or rent your data, or your customers' data, to anyone, for any purpose. We share information only as needed to run the service, with the following categories of service providers ("sub-processors"), each bound by contract to protect your data and use it only to provide their service to us:
| Provider | Purpose |
|---|---|
| Anthropic | AI content generation (Claude) |
| OpenAI | AI content generation (select features) |
| Meta Platforms, Inc. (WhatsApp Business Platform) | Sending/receiving WhatsApp messages on your behalf |
| LogicSMS | SMS and voice call delivery |
| Cloudflare | Transactional email delivery and DNS |
| Hetzner | Application hosting and data storage |
We may also disclose information if required by law, legal process, or to protect the rights, property, or safety of Colony, our customers, or others.
6. Your Data Remains Yours
As between you and Colony, you own the business data you input into the platform (your leads, customers, tickets, and related records). We process it on your behalf, as a data processor/service provider, to operate the service for you — not as our own asset to use, share, or sell independently of providing the service.
7. WhatsApp & Meta Platform Data Use
Where you connect a WhatsApp Business number through Colony, the following apply in addition to the rest of this policy:
- Message content and metadata are processed through Meta's WhatsApp Business Platform under Meta's own Business Data Processing Terms and Platform Policies.
- We do not use WhatsApp messaging data for advertising, and we do not sell it, consistent with Meta's platform requirements.
- You are responsible for your own compliance with WhatsApp's Business Messaging Policy, including obtaining appropriate opt-in from your recipients before messaging them and using only Meta-approved message templates outside the 24-hour customer service window.
8. SMS & Voice — LogicSMS
SMS and voice call features in Colony are provided through LogicSMS. Use of these features is also governed by LogicSMS's own Terms of Service and Privacy Policy, which take precedence for the handling of SMS/voice content and telephony data specifically. You are responsible for obtaining valid consent from your recipients before sending SMS or making calls to them, including compliance with TCPA and equivalent rules wherever your recipients are located.
9. Cookies
Colony currently sets only strictly-necessary cookies required for the service to function: authentication, session state, and CSRF protection. These do not require opt-in consent under GDPR/ePrivacy-style rules, since they are essential to providing the service you requested.
We may in the future add an analytics/marketing tag (such as Google Tag) for our own marketing purposes. If and when we do, this policy will be updated first and, where required, you will be asked for consent before any non-essential cookie is set.
Websites built with Colony. The public websites and pages that businesses publish with Colony (for example Habitat storefronts and landing pages) are run by those businesses, who decide what their site does. On those pages Colony shows a cookie notice with two equal choices, “Essential only” and “Accept all”. Essential cookies and browser storage (for example your cart or sign-in) are always used. Colony keeps anonymous visit counts (your IP address is shortened and no cookie is used) unless you choose “Essential only” or your browser sends a Global Privacy Control signal. If the business has added its own Google Analytics, it is loaded only after you choose “Accept all”, and Google’s advertising signals are switched off. You can change your choice at any time with the “Cookie settings” button on the page.
10. Data Retention
We retain your account and business data for as long as your account is active. If you cancel or delete your account, we retain the data for up to 30 days to allow for recovery in case of accidental deletion, after which it is permanently deleted from our production systems (backups age out separately on their own retention schedule). You may request earlier deletion — see Section 12.
11. Where Your Data Is Stored
Colony is hosted with Hetzner. As a US company serving customers globally, your data may be processed and stored in a different country than the one you or your customers are located in. We take reasonable steps to protect data regardless of location, consistent with this policy.
12. Your Rights
Depending on where you're located, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights, contact us at the email below.
13. Marketing Communications
We will only send you marketing or product-update emails if you opt in. You can opt out at any time using the unsubscribe link in any such email, or by contacting us directly. Service, security, and billing communications are not marketing and cannot be opted out of while you have an active account.
14. Children's Privacy
Colony is a B2B service not directed at children, and we do not knowingly collect personal data from anyone under 18.
15. Changes to This Policy
We may update this Privacy Policy from time to time. We'll update the "Last Updated" date above, and for material changes we'll make reasonable efforts to notify active account holders directly.
16. Contact Us
Questions about this policy or your data: info@colonys.io
Drafting note: this policy reflects Colony's practices as described to date and has not yet had a legal review. Known open items before publication: (1) eOTP, LLC is a placeholder entity pending registration of Colony's own LLC — update the entity name here once that's final; (2) the retention period (30 days) and any state-specific disclosures (e.g. CCPA/CPRA for California users) should be confirmed with counsel; (3) this page should be linked from Sign Up / footer once approved.