Privacy Policy

This policy covers two different people, and says which one applies in each section: the business that signs up to use Maintaining Efficiency (“you”, “the Business”), and the people who call or text that business's number, who never sign up for anything and never see this page unless they go looking for it.

We are the processor of your customers' data and the controller of your own account data. If you operate somewhere with its own rules about that distinction — the UK and EU GDPR in particular — that is the roles each of us holds.

From you, the Business: your name, email, business name, address, hours, services, prices and policies, and the credentials needed to connect your phone number, calendar, and payment account.

From your customers, because your agent talks to them: name, phone number, and whatever they say on a call. Calls are recorded and transcribed by default, and the agent discloses that at the start of every call.

From your connected calendar: whichever calendar you connect. Nothing here is collected unless you take that step yourself.

We do not collect anything from people who are not calling or texting your number. There is no tracking pixel or analytics script on this site watching visitors who never engage with your agent.

To run the agent: answer calls in your voice and policies, check and book against your calendar, and send the messages you have configured.

To show you the dashboard: call logs, booked appointments, and the figures on your home screen, each with the basis for that figure stated next to it.

To bill you, where billing is enabled for your account.

We do not use your data, or your customers' data, to train general-purpose AI models, and we do not sell it. Where we send data to a subprocessor to do part of the job — transcribing a call, placing a booking — that is described in clause 5, and it is for that job only.

If you connect a Google Calendar, we request access to two scopes: read your events, so the agent can tell a caller whether a time is free, and create events, so it can book one. We do not request access to anything else in your Google account — not Gmail, not Drive, not contacts.

Our access and use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: that data is used only to provide and improve the calendar-checking and booking features described in this policy, is never used for advertising, and is not transferred to anyone except where necessary to provide those features, to comply with the law, or as part of a merger or sale of the business — and never as part of a sale of Google user data on its own.

You can revoke this access at any time from your Google Account's third-party access settings, or by disconnecting the calendar in your dashboard. Revoking it stops new reads and writes immediately; it does not retroactively delete appointments already created.

Providers we use to run parts of the service, each bound to use what we send them only for that purpose: a voice platform to run the phone call and speech, a language model provider to understand what a caller says and decide how to respond, a telephony carrier to place and receive calls and texts, a calendar provider (Google, or others via Cal.com) to check and book appointments, a payments processor to bill your account, and an email provider to send account and password-reset emails.

We do not name every provider here because the specific ones can change as the product does — the current list is in our subprocessor configuration, and we do not add one without it being bound to the same purpose-limited use as the ones above.

We share data beyond this list only if the law requires it, or if you tell us to — for example, exporting your data to send to your own accountant.

We keep your data for as long as your account is open, so the service keeps working. After you close your account, we delete it within thirty days.

One exception: records of consent and opt-outs. We keep those regardless of when the rest of an account is deleted, because they are the evidence that protects you if a suppressed number is ever contacted by mistake, and they protect the person who opted out.

You can ask for your data, or a specific customer's data, to be deleted before your account closes. Contact us using the address in clause 9.

Credentials for connected providers — your calendar, your phone number, your payment account — are encrypted at rest, separately from the rest of your account data.

Access to your account is protected by a session credential we store as a hash, not as plain text; we cannot read it back out even if we wanted to.

No system is unbreakable. If we learn of a breach affecting your data, we will tell you what happened and what we are doing about it.

One cookie: the session that keeps you signed in. It carries no tracking value and is not shared with or read by anyone but this service. There is no advertising or analytics cookie anywhere on this site.

To ask what we hold about you, correct it, export it, or delete it, contact privacy@[your domain — see task #47]. We will respond within thirty days.

If you are in the UK or EU and are not satisfied with our response, you have the right to complain to your local data protection authority.

This service is not directed at children, and we do not knowingly collect data from anyone we know to be under 13.

We may update this policy as the service changes. Material changes take effect thirty days after we notify Business accounts, the same notice period as the Terms of Service.