Privacy Policy

Effective 12 October 2026. This policy describes HelloBusy as it actually works today, not as it might work later.

What HelloBusy does · What we handle · Google data & Limited Use · Calls & recording · AI processing · Where your data lives · Subprocessors · Retention & deletion · Your choices · Security · Company details

1. What HelloBusy does

HelloBusy is an AI front office for a small business. With the owner's permission it:

• reads the business's email and calendar, sorts what arrives, files things, and drafts replies and calendar changes;
• answers business phone calls the owner misses with an AI voice receptionist, and keeps the recording, the transcript and a summary;
• keeps a to-do list, a lead/contact list and a chat with the owner's chief of staff;
• sends a daily brief, and notifications to the owner's phone if they turn them on.

Nothing leaves the business without the owner's approval. Emails, calendar changes and other outgoing actions are created as approvals; they happen only when the owner taps Send or Apply. The AI that writes them has no ability to send: it writes a draft, and the code that sends runs only from an approval. The exceptions are the things the owner has explicitly set up to go out on their own — the receptionist answering the phone, and automatic replies to enquiries from the business's own website form — which the owner turns on and can turn off. Separately, inside your own mailbox, the agents label and file mail (for example moving receipts out of the inbox) as they sort it; that doesn't send anything to anyone, and every filing can be undone from History.

2. What we handle

We do not ask for payment card details: if and when paid plans are switched on, payment is handled by Stripe and card data goes to Stripe, not to us (see subprocessors).

We do not knowingly collect special-category data. Of course, email and phone calls can contain anything your customers write or say; we handle it as described here and do not mine it for any purpose of our own.

3. Google account data, and Google's Limited Use rules

If you connect a Google account, HelloBusy asks for these permissions and uses them for these things only:

• Gmail read (gmail.readonly) — to read and sort your mail;
• Gmail modify (gmail.modify) — to label, archive and file messages (every filing can be undone from History);
• Gmail send (gmail.send) — to send only the specific message you approved, when you tap Send;
• Google Calendar — to read your calendar and make the changes you approve.

Accounts connected before 12 October 2026 may also still carry Google Drive, Docs, Sheets and read-only Contacts permissions, from the earlier version of this software. HelloBusy does not use them — the only Drive access it makes is to put this instance's own encrypted backups into the Drive of the account that owns the server. You can see exactly what a connected account has granted, and take any of it back, at myaccount.google.com/permissions. The sign-in flow in HelloBusy today asks for Gmail read and Calendar read; the permission to file and to send on your approval comes from a separate grant you make for that mailbox, and without it HelloBusy can only draft.

To stop HelloBusy using a Google account, revoke it at the Google link above — that takes effect immediately — or ask us from Account → Your data and we will delete the stored tokens; we start on that the same day.

Limited Use disclosure. HelloBusy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide and improve the user-facing features you see in HelloBusy — sorting your mail, surfacing what needs you, drafting what you approve.
• We do not transfer Google user data to others except as needed to provide or improve those features, to comply with applicable law, or as part of a merger or acquisition with notice to you. Where a provider is needed to run a feature, it appears in our subprocessor list and is bound to the same limits.
• We do not use or transfer Google user data for advertising, ad targeting, personalisation, credit assessment, lending, or to sell to data brokers or information resellers. We never sell your data.
• We do not use Google user data to develop, improve or train generalised AI or machine learning models, and we never will. Content goes to our AI provider only to produce your own results. See AI processing for exactly which account that provider runs under today and what that means while HelloBusy is in pilot.
• We do not allow humans to read your Google user data, except: with your explicit consent (for example when you ask for support on a specific message); where necessary for security purposes such as investigating abuse; to comply with applicable law; or where the data has been aggregated and anonymised.

Microsoft 365 / Outlook is not connected today. If we add it, this policy will be updated before it ships.

4. Phone calls, recordings and consent

Your business phone line can forward to your AI receptionist. When it does:

• the call is handled by Vapi, our voice platform, which records the audio and produces a transcript;
• the recording, the transcript and a summary appear in your dashboard and app;
• the caller's number and the time and length of the call are kept with it.

Recording consent is the business's responsibility. Call-recording law differs by state and country: some require all parties to consent, others only one. As the business operating the line, you are the one who must comply, and you confirm you have the right to record and transcribe calls to your number. The receptionist's opening script can announce that the call is recorded, and does so where you have set it to — check your own state's rules and your script. If you would rather not record at all, ask us under Account → Your data or email us, and we will switch recording off for your line; your receptionist carries on answering, and you keep the transcript and the summary.

Callers who want their recording deleted can ask you, or email [email protected]; a specific call can be deleted outright (see retention).

5. AI processing

Two different AI providers do the thinking, and it is worth knowing which is which.

Your inbox, your drafts, your tasks and your chat: Anthropic's Claude. To draft a reply, sort an inbox, summarise a call or answer you in chat, the relevant content — an email thread, a transcript, your own message — is sent to Anthropic, processed, and the result comes back to your instance. We do not train any model on your content, and we never will.

Where that runs today, plainly. While HelloBusy is in pilot, those requests are made through a Claude subscription account held by HelloBusy's operator, not through Anthropic's commercial API. That account is governed by Anthropic's consumer terms, under which Anthropic may retain conversation content and, depending on the account's privacy setting, may use it to improve their models. We are moving this onto Anthropic's commercial API — where business content is not used for model training under Anthropic's commercial terms — and we will not take on customers beyond the pilot, who have not been told this in person, until that move is done. This paragraph will be updated the day it changes. If this matters to you now, email [email protected] and ask where it stands.

Your phone calls: Vapi, and the providers behind it. A live call does not go to Anthropic. Vapi runs the call, Deepgram turns the speech into text, Vapi's own voice model speaks the replies, and the receptionist's own thinking during the call is done by a Llama model running at Groq. The call summary and tags that appear in your dashboard are produced by Vapi from the transcript. Afterwards, when your chief of staff reviews calls or writes a follow-up, that part is Claude as described above.

6. Where your data lives

Each business gets its own private server instance — your email, calls and customer records are not pooled into a shared database with other customers'. The servers are rented from Akamai Connected Cloud (Linode) and currently run in Atlanta, Georgia, USA. Cloudflare sits in front of our domains for DNS, TLS and protection against abuse, so requests to our sites pass through Cloudflare's network. Call recordings are also held by Vapi, and email and calendar data of course remain in your own Google account.

If you use HelloBusy from outside the United States, your data will be processed in the United States.

7. Subprocessors

The named companies we rely on to run the service:

Two more things leave your instance only because you asked them to:

• Web research. When your researcher looks into a new lead, the question — typically a company or person's name and what they enquired about — goes out as a web search and the pages it finds are fetched. That search runs through Anthropic's search tooling and touches the websites it reads, as any search would.
• Tools you connect yourself. If you attach an outside tool to one of your agents, what that agent sends it goes to whoever runs that tool, under their terms, not ours. Nothing is attached unless you attach it.

Our providers are US companies and process your data in the United States; Cloudflare's network is worldwide, so a request can pass through a datacentre near you on its way in.

We will keep this list current. If we add a subprocessor that handles your content, we update this page.

8. How long we keep things, and deletion

• Calls you delete go to Recently Deleted and are purged for good — from your instance and from Vapi — 30 days later. "Delete now" purges immediately.
• Spam calls are purged automatically 30 days after the call.
• Call audio on your server is kept only while a message is unheard; once you have listened, the local copy is removed and only the transcript and summary remain.
• Email and calendar are not copied wholesale: we keep the identifiers, subjects, senders, a one-line snippet and the extracts needed to show you a task, a filing or a draft. The messages themselves stay in your Google account.
• Text transcribed from email attachments is cached on your instance and deleted automatically 30 days after it was made, by a job that runs every night.
• Tasks, leads, contacts, approvals and chat are kept while your account is open, because they are your working records.
• The IP address recorded by our public contact form is cleared 30 days after the submission; the enquiry itself is kept as a business record.
• Backups run nightly, are encrypted with AES-256 before they leave the server, and are stored in Google Drive, where the last 14 are kept and older ones are deleted automatically. The key is a passphrase in a root-only file on your own instance; it is never put inside the backup it unlocks, and Google cannot read the contents. Deleted data can therefore persist in backups for up to 14 days.
• Server logs are kept on the instance for troubleshooting and are deleted automatically after 30 days.
• If you close your account, we delete your data and your instance within 30 days, and we delete the backups in the same pass rather than waiting for them to age out. Say the word and we will do it sooner.

9. Your choices and your requests

You can do these yourself, at any time: delete a call (on its own, or everything in Recently Deleted); mark a task done or dismiss it; undo a filing from History; decline any draft; revoke a paired iPhone; remove a passkey; sign out everywhere; and revoke HelloBusy's access to a Google account at myaccount.google.com/permissions.

And these you ask us for, with one tap under Account → Your data — which logs the request and tells us immediately: a copy of your data, deletion of your account and its data, disconnecting a Google account, or turning call recording off for your line. You can also email [email protected] from the address on your account, and you can ask us to correct anything we hold. We start the same day, answer within 30 days, and don't charge for a reasonable request. Depending on where you live you may also have the right to object to or restrict processing, to complain to your data protection authority, and — in California — to know what is collected and to opt out of "sale" or "sharing": we don't sell or share your personal information, so there is nothing to opt out of.

Where HelloBusy processes your customers' personal data on your behalf, you are the controller and we are the processor acting on your instructions. We don't yet have a standard data processing agreement on the shelf: if you need one, say so before you connect anything and we will agree one with you in writing.

10. Security

• Sign-in is by passkey (Face ID, Touch ID or a security key), or a one-time code or link emailed to you. There are no passwords to steal, and we store only the public half of a passkey and only a hash of a code or link.
• Sessions use secure, HttpOnly, SameSite cookies; only a hash of a session token is stored. The iPhone app uses its own per-device token, which you can revoke.
• Everything travels over HTTPS, with HSTS set on every one of our hosts. Connected-account credentials, call recordings, the database and the text taken from your attachments sit in files on your own instance that only the account the service runs as can read. They are not separately encrypted at rest on the disk, which is why the file permissions and the limits on who can reach the server matter.
• Backups are encrypted with AES-256 before they leave the server, and the Drive folder they go to is private to one account and shared with nobody.
• Access by us is limited to what support requires, and we open a customer's dashboard only with their consent, except where security or the law requires otherwise.
• We are a small team on ordinary cloud infrastructure. We do not hold SOC 2, ISO 27001 or any other security certification, and we don't claim to. If you need one, tell us before you sign up.

No service is perfectly secure. If we discover a breach affecting your data we will tell you promptly and tell you what we are doing about it.

11. Children

HelloBusy is a tool for businesses and is not for children. We do not knowingly collect personal information from anyone under 13, and accounts may not be created by or for them. If you believe a child's information has reached us, email [email protected] and we will delete it.

12. Changes to this policy

When this policy changes we update the effective date above, and for anything that materially affects you we email the address on your account before it takes effect. Carrying on using HelloBusy after that means the new version applies.

Company details

The entries marked above are being finalised and will appear here once registration is complete. Until then, [email protected] reaches us for anything in this policy, including data requests and legal notices.

Questions about this policy? Email [email protected].