Your data, your rights

1. What We Are

AI Booking Agent is a scheduling service operated as a data processor on behalf of service providers. We facilitate appointment booking through voice and web interfaces. We do not independently determine the purposes or means of processing personal data — your service provider does.

2. What We Collect

To provide scheduling services, we collect the following personal data:

• Full name
• Phone number
• Preferred service type
• Appointment date and time preferences

3. Voice Interaction Data

When you interact with our voice booking system, the following data is processed:

• Your spoken responses are transcribed to text for appointment booking
• Transcribed text is stored temporarily to complete your booking session
• No audio recordings are made or stored
• Booking-relevant information (name, date preferences) is extracted from your responses

4. How We Protect Your Data

Phone numbers are encrypted at rest using AES-256-GCM encryption with per-business keys. Even in the event of a data breach, your phone number cannot be read without the corresponding encryption key.

We implement industry-standard security measures including encrypted database connections, rate limiting, audit logging of all data access, and regular security reviews. Access to production systems is restricted to authorized personnel only.

5. Data Retention

We apply specific retention periods to different categories of data:

• Call session data and transcripts: 90 days
• Payment and billing records: 7 years (tax and financial compliance)
• Audit logs: 3 years (regulatory compliance)
• Customer contact data: retained until deletion is requested or business account is terminated

Your service provider controls the retention period for customer data. When a business terminates their account, all associated encryption keys are destroyed, rendering customer data permanently unrecoverable. You may also request deletion of your data at any time through your service provider.

6. Your Rights

Regardless of where you are located, you have fundamental rights over your personal data. The following rights apply across all jurisdictions we operate in:

7. Data Processor Role

We act as a data processor. Your service provider (clinic, salon, gym, or other business) is the data controller and determines how your data is used. Under GDPR Article 28, our processing activities are governed by a Data Processing Agreement (DPA) with each service provider. We only process personal data on documented instructions from the data controller.

8. International Data Transfers

We use the following third-party services to provide our platform. Each processes data on our behalf under appropriate contractual safeguards:

For transfers from the EU/EEA/UK, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission. For transfers from other jurisdictions, we implement equivalent contractual and organizational safeguards as required by applicable law, including PIPEDA (Canada), the Privacy Act (Australia), and PDPL (UAE).

9. Children's Privacy

We do not knowingly collect data from children under 16 (or under 13 in jurisdictions where that is the applicable age threshold, such as the US under COPPA). If we become aware that we have collected personal data from a child without appropriate parental consent, we will take steps to delete that information promptly.

10. Contact & Exercising Your Rights

To exercise your data rights (access, erasure, rectification, or portability), please contact your service provider in the first instance, as they are the data controller. You may also contact us directly at privacy@aibookingagent.com.

If you are unsatisfied with how your request has been handled, you have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction (e.g., the ICO in the UK, the DPC in Ireland, the OAIC in Australia, the OPC in Canada).

11. Updates to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, legal requirements, or regulatory guidance. Changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.