Privacy policy

AI Receptionist is an AI receptionist service run from New Zealand. Businesses use it to answer their phone calls, text messages and website chats, and to book appointments. Questions about this policy or your information: claudedemoagency@gmail.com.

When a business connects its Google Calendar, we ask Google for two permissions only:

• See when the calendar is busy (free/busy times), so the receptionist only offers times that are actually free. We see that a time is taken, not what the appointment is.
• Manage calendar events, used only to create, move and cancel the appointments the receptionist books. We don't read, change or delete any other events.

The access tokens Google gives us are stored encrypted (AES-256-GCM) and used only to provide this service to that business. We don't sell Google user data, share it with anyone else, use it for advertising, or use it to train AI models.

AI Receptionist's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

A business can disconnect at any time from its Google Account's third-party access page, or by emailing claudedemoagency@gmail.com — we then delete the stored tokens.

To answer you and book appointments, we collect:

• your phone number (from caller ID or the text message) and your name, if you give it;
• what you say or type in the conversation, and the receptionist's replies;
• appointment and enquiry details, such as the service, date and time.

The business you contacted can see this information so its team can help you. We use it only to provide the service to that business — never for advertising, and we don't sell it. Each business's information is kept separate from every other business's.

We use these providers to run the service; they process information only for that purpose:

• Anthropic — the AI that writes the receptionist's replies;
• ElevenLabs — voice calls (speech recognition and the receptionist's voice);
• Twilio — phone numbers, calls and text messages;
• Google — calendars of businesses that connect one, and sending email notifications to businesses;
• Railway — hosting and the database (servers in California, USA);
• n8n — passing website chats and text messages to the service, and scheduled tasks such as follow-ups and notifications.

Some of these providers process information outside New Zealand.

Access to the service is restricted to signed-in staff, connection details are encrypted, and important actions are logged. We keep information only as long as it's needed, and delete it automatically:

• Conversations — call transcripts, text and chat messages, and call summaries — are deleted 90 days after the conversation, including the copies our voice provider (ElevenLabs) holds. Calls are not recorded as audio; any older recordings are deleted on the same schedule.
• Your contact details (name, phone number, email), notes about your enquiries, and notes on your appointments are removed 2 years after your last contact with the business. The record that an appointment took place is kept without your details.
• System records: security audit records are kept for 1 year (with IP addresses removed after 90 days); error and processing logs for 90 days.

These are the standard periods; a business may set different ones for its own customers. Our service providers keep limited data under their own terms.

Under the New Zealand Privacy Act 2020 you can ask to see the personal information we hold about you and ask us to correct it. You can also ask us to delete it sooner than the periods above (if you have an upcoming appointment, it will need to be cancelled first). Email claudedemoagency@gmail.com and we'll respond within 20 working days. You can also complain to the Office of the Privacy Commissioner.