Privacy Policy

• Account information: name, email, and business details provided when you create an account.
• Customer interaction data: chat messages, SMS messages, and booking requests processed by the AI receptionist on behalf of your business.
• Calendar data via integrations: when you connect a Google or Microsoft calendar, we access your calendar to read free/busy availability and to create appointment events that customers book through the chat.

• We access calendar data only to read free/busy availability and to create appointment events on your behalf when a customer books through the chat.
• We do not modify or delete calendar events that you or your customers created. The service does not currently support reschedule or cancellation on your behalf.
• We do not read, store, or use the content of unrelated calendar events beyond what is necessary to determine availability.
• We do not sell, rent, or share Google or Microsoft user data with third parties.
• We do not use Google or Microsoft user data for advertising, profiling, or any purpose unrelated to providing the appointment-booking service. We do not perform human review of your Google or Microsoft user data except with your explicit consent for support or debugging.
• Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• OAuth refresh tokens for connected calendars and Twilio auth tokens are encrypted at rest using AES-256-GCM.
• Data is transmitted over TLS.
• We retain data only as long as necessary to provide the service or as required by law.

We use the following subprocessors to operate the service:

• Lovable Cloud / Supabase — application hosting and database.
• Twilio — SMS delivery and inbound messaging.
• Lovable AI Gateway / Google Gemini — AI model inference for generating chat and SMS responses.
• Lovable Emails — transactional email delivery (booking confirmations, notifications).
• Google Calendar API — availability checks and event creation on connected Google calendars.
• Microsoft Graph — availability checks and event creation on connected Microsoft calendars.

We share data only with the subprocessors listed above, under confidentiality obligations, and only as needed to operate the service. We do not sell your data.

• You can disconnect a calendar integration at any time. Disconnecting revokes our access and deletes the stored OAuth credentials for that connection.
• You can request deletion of your account and associated data by emailing help@soteaux.com. We will process deletion requests within 30 days.

Questions about this policy: help@soteaux.com, Soteaux LLC.