Who we are and when this policy applies
Buk Capital LLC operates Inbound Booking and is referred to as we, us, or our in this policy. This policy covers our website, accounts, support, billing, and the personal information processed through our AI receptionist, calendar, and messaging features. The information processed depends on which features a business has enabled. Creating an account does not, by itself, activate telephone answering or messaging.
For our own account administration, website operations, security, support, and billing, we determine why personal information is used. Where applicable law uses that term, we act as a controller. When a business uses our service to handle its callers, inquiries, and appointments, that business generally determines the purposes of that processing and we process the information on its behalf. Depending on the applicable law and agreement, we act as its processor or service provider. These roles depend on the actual activity, not just a label.
The business you call has its own responsibilities for notices, permissions, retention decisions, and handling your request. Its privacy policy also applies to its use of your information. If you call an Inbound Booking demonstration operated by us, Buk Capital LLC is responsible for that demonstration's collection and use. This policy does not replace a business's privacy notice or a separately agreed data processing agreement.
Business identity for optional SMS registration
If you request outbound texting, we collect the business’s legal identity, entity type, registered address, contact information, website, EIN where applicable, consent procedures and policy URLs needed for carrier registration. Sole proprietors may instead need mobile verification. We use this information to register and maintain the business’s texting program with Telnyx and its registry and carrier review partners, verify authorized requests, process billing and resolve registration issues. During a voice trial we save the request and wait for successful paid conversion before submitting it to those partners.
Sensitive registration details are encrypted by the application before private database storage using a dedicated key stored outside that database. Customer and administrative views show a masked identifier and registration status. Registration details are kept separate from receptionist knowledge and are not supplied to the voice AI as business instructions. Full EINs are not included in ordinary summaries, support messages or application error responses. Authorized server processing must decrypt the information to submit the requested registration.
We retain enrollment, consent, provider status, billing and audit records as needed to operate the requested texting service, resolve disputes and satisfy applicable obligations. Local enrollment data is removed through the account-deletion process subject to the billing and legal retention described in this policy. Deleting local data does not automatically delete independent registry or carrier records; contact us about those requests. Do not enter an SSN or personal identification number in the EIN field.
Information we collect and where it comes from
We receive information directly from you, from the business using our service, from callers and message recipients, and from service providers that authenticate an account, route communications, process a payment, or perform an authorized integration. You do not have to provide optional information, although we may be unable to complete a booking, callback, or requested feature without the necessary details.
- Account information: display name, email address, authentication and session information, account identifiers, business membership and role, signup or password recovery activity, and signup terms acceptance and privacy acknowledgment metadata, including the policy version and timestamp. Authentication is provided through Supabase.
- Business configuration: business name, industry, telephone numbers, address, service area, time zone, services, appointment preferences, business hours, AI answering schedule and outside-hours action, receptionist greeting and voice, and the number used for human handoff.
- Caller and appointment information: telephone number, name, email address if provided, requested service, service address and postal code where needed, requested dates, appointment details, and information a caller volunteers during the conversation.
- Website support: chat messages, conversation history, account and business association when signed in, optional contact details, callback phone numbers and preferred times, and support request status. Guest conversations use a private browser cookie. Opening chat after signing in can link that browser’s guest conversation to your account so you can return to it on another device. Platform support staff can access these conversations; other members of your business do not automatically receive access.
- Optional administrator phone alerts: when a platform administrator enables browser notifications, we store that device’s push subscription endpoint, encryption keys, optional device label, and delivery status. The browser or device notification provider delivers a generic alert and an inbox link; chat text and visitor contact details are not included. Administrators can disable alerts for their device from the support inbox or device settings.
- Communication records: call identifiers, time and duration, outcome, text transcripts and summaries, callback requests, text message content, sender and recipient numbers, delivery status, errors, and consent or opt-out records.
- Connected service information: Google account identity and email, calendar names and identifiers, time zones and access permissions, authorization tokens, connection status, busy time intervals, and appointment event information used for booking and reconciliation.
- Billing and operational information: Stripe customer and subscription identifiers, plan and subscription status, checkout and billing event records, metered call usage, and support correspondence. Payment details entered on Stripe's checkout or billing portal are collected by Stripe.
- Technical information: our hosting, authentication, communications, and other providers may process IP addresses, browser and device information, request timestamps, diagnostic information, security events, and delivery logs to operate and protect the service.
Why we use information
We do not sell personal information, rent caller lists, or use caller conversations or Google user data for targeted advertising. The current service does not include advertising pixels or cross-site advertising analytics. Google data is subject to the additional restrictions below, including when troubleshooting or improving a calendar feature.
- Create and authenticate accounts, maintain business workspaces, and save the configuration chosen by their authorized users.
- Answer inbound calls, provide the business information supplied to the receptionist, check availability, create appointments, and record or route callback and handoff requests.
- Send permitted appointment messages and account emails, track delivery, and respect communication preferences and opt-outs.
- Operate billing and usage measurement, reconcile integration results, investigate service errors, and provide support.
- Protect accounts and the service, prevent abuse and fraud, comply with applicable obligations, resolve disputes, and enforce our agreements.
AI calls, transcripts, and human assistance
The receptionist is an AI system. For an enabled phone service, Telnyx routes telephone traffic. xAI processes call audio and conversation context using the business’s selected Grok built-in voice to understand the caller, generate speech, and request booking or other supported actions. Relevant business details, caller statements, available appointment times, and the results of requested actions may be included in this processing. We use supplied voices; this service does not create a clone of a customer’s or caller’s voice.
Railway hosts the persistent process that controls enabled AI calls. This process handles business configuration, caller identifiers and conversation context, text transcripts, requests to perform actions such as checking availability or booking, the results of those actions, and call and operational metadata. Call audio travels directly between Telnyx and xAI; the Railway call-control process does not relay that audio.
Our current application does not store audio recording files. It does store text transcripts, summaries, call metadata, and information captured for appointments or callbacks. Transcripts may be incomplete and may contain recognition or AI errors. This application-level statement does not mean that telecommunications or AI providers have no logs, temporary processing, or retention under their own applicable service terms and settings.
Authorized users of the business can access the communication information made available in their workspace. We and our providers may need access to relevant information to deliver the service, provide authorized support, investigate security issues, or meet legal obligations. Access to Google user data remains subject to the stricter restrictions in section 5.
Our application does not train a general-purpose AI model on caller conversations. Provider processing is governed by the applicable business/API arrangements; this policy does not promise zero provider retention or a provider-wide exclusion from every form of data use. We do not use Google user data to develop or train generalized AI or machine learning models.
Callers can ask for human assistance or a callback. Availability depends on the business and its configured handoff arrangements. A caller who does not want AI processing can end the call and contact the business through another available channel; requesting a handoff does not remove information already processed. Businesses are responsible for providing any call-processing or transcription notice and obtaining any consent required for their circumstances. Publishing this policy is not a substitute for those notices or permissions.
Please do not provide payment card numbers, passwords, government identifiers, health records, or other sensitive information to the receptionist. The service is intended for ordinary business inquiries and scheduling, not emergency response or sensitive professional consultations.
Google sign-in, Calendar and Limited Use
You may choose Google instead of an email and password to create an account or sign in. Google provides Supabase with your Google account identifier, email address, and basic profile information such as your name and profile image, when available. We use this information to authenticate and maintain your account. We do not receive your Google password. Signing in with Google does not connect a calendar or grant access to Gmail, Drive, or Contacts; Calendar requires a separate authorization.
Connecting Google Calendar is optional and requires authorization by the business owner. We request Google account identity and email, permission to read the calendar list, permission to check busy times, and permission to access calendar events. Google's event permission is broader than creating a single appointment and can technically permit reading, changing, and deleting events on calendars available to the account. Our current booking workflow uses the selected business calendar to check availability, create requested appointments, process verified caller requests to reschedule or cancel those appointments, and read back its events to resolve uncertain results. We do not request Gmail, Google Drive, or Google Contacts access.
We read calendar names, identifiers, time zones, and access roles to let the owner select a writable calendar. We retain the connected account email, selected calendar identifier and name, connection status, and encrypted access and refresh tokens. The encrypted token bundle includes the Google account identifier and granted permissions. Our server uses these credentials to communicate with Google.
The receptionist receives calculated available appointment times rather than the titles, descriptions, attendees, or contents of unrelated calendar events. Appointment details supplied by the caller may be written to the business's selected Google calendar. Those events are then subject to the calendar owner's sharing settings and Google's handling of calendar information.
Inbound Booking's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including Limited Use requirements. We also follow the applicable Google Workspace API User Data and Developer Policy. We use Google Calendar data only for the user-facing calendar features you authorize, subject to these policies. We do not sell it, use it for advertising or creditworthiness decisions, or use it to develop or train generalized AI or machine learning models.
We share Google data only as needed to provide or improve the authorized user-facing feature, for permitted security purposes, to comply with applicable law, or in another circumstance expressly allowed by Google's policies. Human access is limited to the exceptions those policies permit, such as your affirmative agreement to view specified information, a necessary security investigation, compliance with law, or permitted internal use of aggregated, anonymized information. Any transfer in connection with an acquisition or similar corporate transaction requires your explicit prior consent where Google's policies require it; the general corporate-transfer provision below does not override this restriction.
You can disconnect Google Calendar in the business's integration settings. Disconnecting removes that business's locally stored authorization tokens and pending connection requests from the active database. Connection metadata and existing appointment history remain; events already created in Google Calendar are not deleted. Disconnecting one business does not revoke Google authorization shared with another connected business. You can remove the application's Google permission through your Google Account connections page. Revoking permission stops future authorized access but does not itself erase records already created. Contact us about deletion of retained information; the retention and request provisions below apply.
Microsoft, Apple iCloud, and Yahoo calendars
A business owner may optionally connect Microsoft Outlook through delegated account authorization, or iCloud and Yahoo Calendar using an app-specific password generated by that provider. Microsoft authorization requests basic account identity, offline access, and calendar read/write permissions. Those permissions can technically allow reading, creating, changing, and deleting calendar events. We do not request Outlook mail or contacts permissions. An iCloud or Yahoo app password can also have broader provider permissions than the calendar functions used here; generate one specifically for this service and revoke it when no longer needed.
We retain the connected account address, calendar identifiers, names, time zones, permissions, and connection state. Microsoft access and refresh tokens and iCloud or Yahoo app passwords are encrypted before database storage. We use them server-side to discover writable calendars, check availability including recurring events, create caller-requested appointments, process verified rescheduling or cancellation of those appointments, and reconcile uncertain writes. The receptionist receives calculated availability, not the contents of unrelated events. Each receptionist uses its published calendar selection. The business controls the connected calendar's sharing permissions.
Disconnecting removes the locally stored credentials and disables new bookings through that connection. It does not delete existing calendar events or appointment history. You can also revoke Microsoft application access or the Apple or Yahoo app password at the provider. Reconnecting is necessary after credentials are revoked or expire. Only iCloud-hosted calendars are available through the Apple connector; a calendar stored only on an iPhone is not accessible to this service.
Verifying caller-requested appointment changes
When a caller asks to change or cancel an appointment made through their receptionist, we ask permission to send a short-lived verification code to the telephone number recorded on the original booking. Telnyx processes the number and verification attempt. We retain limited challenge, attempt, call, appointment and authorization records to prevent unauthorized changes and repeated requests. Verification for one requested change is not consent to marketing or ongoing text alerts.
Only after verification can the receptionist reveal matching appointment details and request a change. The caller must confirm the requested action. A spoken code may appear in the call transcript; the code and change authorization expire and cannot be used as an account password. Changes require access to the original connected calendar. Existing calendar events added outside Inbound Booking are not imported into this verification flow.
Requested follow-up emails for callers
When enabled for the receptionist, the AI offers email for confirmed appointment changes, saved callback or meeting requests, and approved business details specifically requested during the call. It reads the address back and asks the caller to confirm the destination and requested message. We retain the confirmed address, call and request identifiers, permission, approved message facts and delivery status. Resend receives the destination and message content. An appointment receipt requires a confirmed calendar action; a callback receipt acknowledges only the saved request. Private owner summaries are not copied into caller follow-ups, and ordinary information-only calls do not receive automatic messages.
A caller may decline email and receive the booking details verbally instead. Appointment confirmation permission is not permission for unrelated advertising. Delivery records help us identify failed or bounced messages; provider acceptance does not guarantee arrival in an inbox.
Call summaries sent to business owners
Owners can separately select email, text, both, or no post-call notifications for each receptionist. New-receptionist setup defaults owner summary email on and owner text off; the owner can change either choice. Existing disabled choices and opt-outs are preserved. We store private notification recipients, verification and opt-out records, subscriptions, and delivery status separately from the receptionist's knowledge. A confirmed account email can be used directly; other email and mobile recipients must complete verification before delivery. These preferences do not authorize texts to callers. With the optional outbound SMS add-on, owner and caller texts use that business’s approved messaging program and existing AI number. Both require completed carrier registration and paid SMS eligibility; email works independently.
When enabled, xAI processes caller transcript excerpts to extract supported summary facts. Confirmed appointment details come from saved booking records. Resend delivers summary emails and email verification codes; Telnyx delivers verification codes and short owner alerts with a link to the authenticated dashboard. Summary emails can contain caller statements and booking information, so use a mailbox you control and protect. Provider acceptance is distinct from delivery. Owners may disable summaries in their account; replying STOP disables text alerts to the recipient.
Google business suggestions
While you enter a business name during supported setup or settings, Google listing suggestions appear after at least eight characters and a brief typing pause. The search text and optional city or ZIP refinement are sent through our server to Google Places. Selecting a listing sends its Place ID to Google for one details request, which may fill phone, address, business hours, and time zone, and suggest a business type. A business type may also be preselected from the page where you started signup. You can review or change these fields, or complete setup manually. AI answering hours are configured separately from business hours. Opening existing settings alone does not start a lookup.
The full Google listing name is displayed temporarily for lookup. In this setup flow, you enter the business name your receptionist should use in a separate field; that name is saved as your business name and used by your receptionist. Saving also retains the selected Place ID, phone, address, business hours, time zone, business type, and AI answering settings shown in the form, including operational information filled from Google. Saved operational details are used by your receptionist. We do not separately retain lookup queries, unselected suggestions, raw Google categories, or complete provider responses. Selecting a listing does not verify your identity, ownership, or authority to act for the business, connect a Google account, or grant access to manage a Google Business Profile.
We retain request counters and account identifiers to enforce lookup limits and prevent abuse; these counters do not contain search text or Google suggestions. Google's handling of lookup requests is governed by its Privacy Policy. Our lookup includes Google Maps content, and use of that content is subject to the Google Maps terms linked below.
Text messages and mobile information
When caller texting and the business sender are enabled, the one-response flow asks the caller to text DETAILS with a short request code to the business’s AI number from the confirmed mobile number within 15 minutes. The inbound text and its provider identifier, sender, recipient, timestamp and matching request are retained as evidence for that response. It is not recurring-message enrollment. A telephone number, caller ID, spoken yes, or booking alone does not authorize a caller text. A booking or callback can proceed without agreeing to messages. Message and data rates may apply.
We store the permission or opt-out status, its source and time, related event identifiers, and the information needed to deliver and troubleshoot messages. Reply STOP to the sending number to stop appointment texts from that business. Supported equivalent opt-out keywords are also recognized. A later conversation or booking does not override a recorded STOP; resubscription requires a supported inbound START request. An opt-out does not cancel an appointment, erase earlier records, or stop necessary account emails. A message already submitted for delivery may still arrive.
We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. We do not share mobile numbers or messaging consent records with affiliates for their marketing or promotional purposes. We disclose this information only to the business you are communicating with, providers needed to operate the messaging service, and others when legally required or otherwise necessary to protect rights or comply with law. Consent to one business's messages does not authorize unrelated businesses to message you.
For assistance with a booking, contact the business directly. For assistance with this platform's messaging or privacy practices, email hello@inboundbooking.com. Our SMS Terms explain the messaging program in more detail.
Retention and deletion
Retention depends on the information, its purpose, the business's instructions where we act on its behalf, and applicable obligations. Account and configuration records support an ongoing service relationship. Call, appointment, message, and integration records support the business's requests, troubleshooting, and service history. Consent and suppression records may need to remain so that we can document permissions and avoid contacting someone who opted out. Billing, security, dispute, and compliance records may need to be retained separately.
Guest website-support conversations are scheduled for automatic deletion from the active database after 48 hours without a new message from the visitor or support staff. An empty conversation uses its creation time. Deletion includes the thread’s messages, linked callback requests and queued alerts. Reading the thread or changing its status does not restart this period. Cleanup runs periodically and can be delayed by a service outage. If you sign in and link the guest thread to your account before deletion, it becomes account support history and is not subject to this guest cleanup period. Unreferenced guest access credentials are also cleaned up.
The current service does not offer a universal automatic deletion period or a self-service control that immediately erases all account and caller records. Contact us to request account closure or deletion. We will evaluate and handle the request under applicable law and, where relevant, the business customer's instructions. Closing a subscription or disconnecting an integration is not the same as deleting all related data.
Deletion from active systems may not immediately remove restricted backup copies or records that a provider must retain for security, billing, legal obligations, or other applicable purposes. We cannot erase a calendar event or information that a business independently copied, exported, or retained merely by deleting our own copy. We will explain material limits and the applicable timing when handling a verified request. We retain personal information only for as long as reasonably necessary for the relevant purposes and obligations.
Security
The application uses safeguards including authenticated accounts, controls that scope business records to authorized membership, protected server-side integration operations, encrypted stored Google authorization tokens, and verification of supported provider callbacks. These measures reduce risk but cannot guarantee that a service, account, transmission, or AI response is always secure or error-free.
Protect your login credentials and business access, review who can access your connected calendar, and notify us promptly of suspected unauthorized activity. Please do not email passwords, access tokens, full payment details, or unnecessary sensitive information when reporting a problem.
Location and international processing
Buk Capital LLC operates this service from the United States. Our service providers and their infrastructure may process information in the United States and other countries. This service does not promise that all information remains in a particular country. Privacy laws and access by public authorities may differ between jurisdictions.
Where applicable law requires a safeguard for a cross-border transfer, the relevant transfer must be supported by a lawful mechanism, such as an applicable adequacy decision or appropriate contractual safeguards. We do not claim certification under a data transfer framework merely because a provider may participate in one. Contact us for information relevant to a particular transfer or a business's required data processing terms before using the service for that purpose.
Privacy rights and legal bases, where applicable
Privacy rights vary with your location, our role, and whether a particular law applies to the processing. Subject to those conditions and lawful exceptions, you may have rights to know about or access personal information, obtain a portable copy, correct inaccuracies, request deletion, restrict or object to processing, withdraw consent, or appeal a request decision. You may also have a right to complain to a relevant privacy regulator. We will not unlawfully discriminate against you for exercising a protected right.
If European Economic Area, United Kingdom, or similar data protection rules apply to processing for which we are controller, the legal basis may be performance of our agreement with an account holder, compliance with a legal obligation, consent for an activity that requires it, or legitimate interests such as maintaining a secure and functional service, subject to the protections required by applicable law. Withdrawing consent does not invalidate processing already lawfully undertaken. A business customer determines and communicates the basis for its own caller processing; our agreement with that business does not, by itself, establish a contractual basis for every caller.
If a US state privacy law applies and grants you rights to opt out of sale, sharing for cross-context behavioral advertising, targeted advertising, or certain consequential profiling, those rights apply according to that law. Our current service does not sell personal information or use it for those advertising activities, and the receptionist is not designed to make decisions about credit, employment, insurance, housing, or similar eligibility. We do not claim every state privacy statute applies to every visitor or to our business.
How to make a request or raise a concern
Email hello@inboundbooking.com with the subject Privacy request. Tell us the type of request, whether you are an account holder or caller, the relevant business, and enough information to locate the records, such as the account email or approximate call date. Do not include a password, payment card number, or identity document in your initial message. We will seek only information reasonably needed to verify identity, authority, and the scope of the request, using a safer method if additional evidence is needed.
If you are a caller, contacting the business first will usually help because it controls the underlying business record. You can also contact us, and we will help identify the appropriate route. Where we act only on a business's behalf, we may forward or coordinate the request with that business instead of making an independent decision about its records. We will not disclose another person's information in response to an unverified request.
An authorized agent may submit a request where permitted by law; we may need evidence of authorization and identity verification. We respond within the time required by the law that applies, including any permitted extension and explanation. A request may be limited or declined where an applicable exception, another person's rights, or an unresolved verification issue requires it. If you disagree with a decision, reply with the subject Privacy appeal and explain the concern. We will review it and provide the response and further options required by applicable law.
Children and sensitive uses
Business accounts are intended for adults authorized to act for a business. Inbound Booking is not directed to children, and we do not knowingly solicit personal information from children under 13. If you believe a child has provided information inappropriately, contact us so we can assess the circumstances and take appropriate action. This statement does not authorize a business to collect children's information through our service without the protections required by law.
Do not use the receptionist to solicit protected health information, biometric identification, highly sensitive identifiers, or information requiring a specialized regulated environment unless we have expressly agreed in writing to support that use and the necessary safeguards and agreements are in place. We do not advertise this service as HIPAA certified or as a substitute for a business's own compliance obligations.
Changes and contact
We may update this policy as our service or legal requirements change. The date shown on this page identifies the current version. When required, we will provide additional notice and obtain permission before a materially different use of information, including new uses of Google data that require renewed authorization. Continued use does not override a statutory right or supply consent where affirmative consent is required.
Questions about this policy or Buk Capital LLC's handling of Inbound Booking information can be sent to hello@inboundbooking.com. You may also use that address to request the appropriate business correspondence details for a formal privacy matter.