Privacy Policy

Account information. Name, email address, business name, and password (stored as a salted hash, never in plain text) when you sign up.

Connected accounts. When you connect Gmail via Google OAuth, we request only permission to send email on your behalf (scope: gmail.send) — we do not read your inbox through Google's API. Instead, you set up a mailbox forwarding rule (in Gmail's own settings) that forwards incoming mail to a private, per-account address we provide; our system receives and processes that forwarded mail in order to generate and send replies. When you separately connect Google Calendar from the Bookings page, we access your calendar to check availability and create, update, or cancel events. These are two independent connections — connecting one does not grant access to the other, and either can be disconnected independently.

Forwarded email content. A message forwarded to your account's private address is parsed to extract the sender, subject, and body needed to generate a reply. Bulk/automated mail (newsletters, mailing lists, no-reply senders) is detected and discarded without being read by our AI. Successfully processed messages retain only the metadata needed for your activity log and duplicate-delivery protection — the full raw message is deleted immediately after processing (or after a short retention window, for messages that failed to process, so we can debug the failure).

Business profile data. Business details, working hours, tone preferences, and knowledge you provide so our AI agents can respond on your behalf.

Contacts and pipeline data. Contact records, deal/pipeline stages, and notes you or our agents create while managing your customer relationships.

Content you connect or generate. Draft and sent email replies, generated newsletters, social media captions and images, review responses, and invoices, along with any social media account credentials you connect for publishing.

Billing information. Plan, subscription status, and task usage. Payment card details are collected and processed directly by our payments processor, Dodo Payments — we do not store your full card number on our servers.

Usage and log data. IP address, browser/device information, timestamps, and activity logs (e.g. which agent ran, when, and the outcome) for security, debugging, and the in-app activity log.

• To operate the agents you enable — drafting and sending email replies, booking or rescheduling calendar events, generating newsletters and social content, replying to reviews, and sending invoice reminders.
• To process payments, manage subscriptions, and calculate task-based usage limits.
• To send transactional notifications (e.g. booking reminders, bell notifications, receipts) via our email provider, Brevo.
• To provide customer support and respond to your requests.
• To detect, investigate, and prevent fraud, abuse, and security incidents.
• To improve the Service — for example, understanding which features are used and where errors occur.

To generate replies, newsletters, and content, relevant text (such as an incoming email or your business profile) is sent to our large language model provider, Groq, for processing. This data is used only to generate the response for your account and is not used by us or our providers to train AI models.

Some agents also perform live web research (for example, to suggest timely newsletter topics) using search-capable models. Search queries are derived from your business category and public holidays/trends, not your private inbox content.

We do not sell your personal information. We share data only with the following categories of service providers, each bound by their own confidentiality and security obligations, and only as needed to operate the Service:

• Google — for Gmail and Calendar access you explicitly authorize via OAuth.
• Groq — for AI text generation, as described above.
• Brevo — for sending transactional emails (booking reminders, etc.) on our behalf.
• Dodo Payments — for processing subscription payments and credit purchases.
• Cloud hosting and database providers — for storing and running the Service infrastructure.
• Social media platforms (e.g. LinkedIn, Instagram) — only if and when you connect an account for content publishing.

We may also disclose information if required by law, to protect our rights, or in connection with a merger, acquisition, or sale of assets, subject to this Policy.

We retain account and business data for as long as your account is active. Activity logs are retained according to your plan's retention window (from 3 days on the Free plan up to 90 days on Agency). Pending confirmation actions (e.g. an unconfirmed cancellation or reschedule) expire automatically after 48 hours. When you delete your account, we delete or anonymize your personal data within a reasonable period, except where we are required to retain it for legal, tax, or security purposes.

We use industry-standard safeguards to protect your data, including encryption in transit, access controls, and automated security scanning of our own codebase. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security, but we work continuously to protect your information and will notify you as required by law in the event of a data breach affecting your account.

You can access, update, or delete most of your data directly from your account settings. You may disconnect your Gmail or Calendar connection at any time, which revokes our access to that account. Depending on your location, you may also have the right to request a copy of your data, request correction or deletion, or object to certain processing. To exercise any of these rights, contact us at support@autobiz.com.

If you disconnect Google Calendar (or Google revokes the grant), booking automation is automatically turned off for your account until you reconnect.

The Service is intended for business use by adults and is not directed to individuals under 18. We do not knowingly collect personal information from children.

Your information may be processed and stored in countries other than your own, including by the service providers listed above. We take reasonable steps to ensure your data is treated securely wherever it is processed.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through an in-app notice before the change takes effect. The "Last updated" date at the top of this page reflects the most recent revision.

Questions about this Privacy Policy or how we handle your data? Email us at support@autobiz.com.