Effective 4 November 2026
Privacy Policy
This policy explains what onBehalf collects, why, and who it shares it with. It covers our website, our permissioning product, and the one-time SMS verification codes we send.
Mobile information
Your mobile information will not be sold or shared with third parties for promotional or marketing purposes.
Mobile numbers and the consent record attached to them are used only to deliver the one-time verification codes you asked for, to prove that an approval came from the person entitled to give it, and to honour opt-out requests. We do not use mobile numbers for advertising, profiling, or audience building, and we do not disclose them to advertisers, data brokers, lead generators, or affiliate networks — under any circumstances.
1. Who we are
onBehalf is operated by Tobias Jongbloets, trading as onBehalf, 238 Lafayette Ave, Brooklyn, NY 11238, United States. For any privacy question, write to privacy@onbehalf.online.
2. What we collect
When you opt in to SMS codes
- Your mobile number.
- A display name, if you choose to give one.
- The date, time and source of your consent, and the exact wording you agreed to.
- Delivery records: whether the message was accepted by the carrier, and whether it was delivered, failed, or blocked.
When you approve an AI agent
- The name the requester gave us, the account they referred to, and what they asked to do.
- The email address and phone number held for you by the company whose account is involved. We obtain these from that company, not from the requester.
- A public passkey credential — a public key and a credential identifier. The private key never leaves your device and is never sent to us.
- Your decision, the terms you were shown, and a record of the decision.
When you just browse the site
Our servers keep ordinary request logs (time, path, status, and a truncated network address) for security and debugging. We do not run advertising trackers, third-party analytics, session recording, or cross-site pixels on this site.
3. Why we use it
- To deliver the verification code you requested.
- To confirm that an approval or change was authorised by you, and to be able to show that it was.
- To keep a permission active for as long as you allow, and to stop it when you revoke it.
- To detect and prevent abuse of the service.
- To meet legal, tax and carrier-compliance obligations.
4. Who we share it with
| Recipient | What they receive | Why |
|---|---|---|
| Our SMS provider (Telnyx) | The mobile number and the message body | Solely to deliver the code and return a delivery status |
| Our email provider | The email address held for you and the message | Solely to deliver a permission request you are entitled to receive |
| The company whose account is involved | The fact that a permission was granted, its scope and its expiry | So the company can accept or refuse the agent's request |
We do not share mobile numbers or messaging consent with any party other than the messaging provider that transmits the message. We do not sell personal information.
5. How long we keep it
- Consent and opt-out records for mobile messaging: kept while the consent is live, and for four years afterwards, because carriers and regulators require proof of consent.
- Permission and decision records: kept for the life of the permission plus seven years, so that a past authorisation can be evidenced.
- Passkey public credentials: kept until you remove them.
- Server logs: 30 days.
6. Your choices
- Stop SMS: reply STOP to any message, or write to us. This takes effect immediately and does not affect any other part of the service.
- Withdraw a permission: use the link in the permission email, or ask us.
- Access, correct or delete: write to privacy@onbehalf.online. We will respond within 30 days.
7. Security
Traffic is encrypted in transit. Passkey private keys stay on your device. Where we store sensitive fields at rest we encrypt them. Access to production data is limited to the operator and requires a credential. No system is perfect; if a breach affects you we will tell you and the relevant regulator as required by law.
8. Children
The service is not directed to anyone under 18 and we do not knowingly collect their data.
9. Changes
If we change this policy we will update the effective date above. Material changes affecting mobile messaging will be communicated before they take effect.
This is a demonstration environment operating on synthetic account data. The privacy commitments above are the intended production posture and are what the system is built to enforce.