Privacy Policy

1. What we collect

When you sign up, we collect your account email and password (handled entirely by Supabase Auth. We never see or store your raw password). When you set up a business, we collect the business information you provide: name, contact details, hours, services, pricing, and any customer/client list you paste in, upload, or that syncs in from a connected calendar. When your customers text your Atronet number, we store the message content and phone number so Receptionist can hold a conversation and so you can see what was said. If you connect an email inbox (Gmail, Outlook, Yahoo, iCloud or another provider), we read incoming messages so Receptionist can reply to them. See "Gmail data specifically" and "Other email providers" below. We also record the alerts Atronet sends you, such as a customer's name, contact details and a short summary of what they asked, and whether each alert was delivered. As you go through our signup wizard, we also record which steps you reach and your business name and email, so we can see where people get stuck and improve the signup flow. See "Who we share it with" below for where this is stored.

2. How we use it

3. Who we share it with

We use a small number of subprocessors to run the Service, each only for what's needed to operate it:

We do not sell your data or your customers' data to anyone.

4. Google Calendar data specifically

If you connect a Google Calendar, Atronet requests exactly two Google OAuth scopes and nothing broader:

We do not request access to any other Google data, not your email, your contacts, your files, or any calendar other than the one you connect.

What we access and why. When you connect Google Calendar, we periodically read your primary calendar's events to keep your Atronet client list in sync (an event's guest name and title become a client record), and we read your free/busy times before offering an appointment slot by text. When Receptionist books, reschedules, or cancels an appointment, we create, update, or delete the corresponding event on your Google Calendar directly.

Whether Google data is shared with third parties. Names and appointment/service descriptions that originate from your connected Google Calendar are used to draft two categories of automated SMS text: post-appointment check-in messages and win-back messages to past clients, using Anthropic's Claude API. In both cases, the information sent to Anthropic is limited to a client's name (or email if no name is on the event) and the service/event title; nothing else from your calendar, the full event list, other attendees, descriptions, locations, or your free/busy schedule, is sent to Anthropic or to any other AI or analytics service. No Google data is sold, used for advertising, or used to train AI models. See "Limited Use compliance" below.

How Google data is protected. Your Google OAuth access and refresh tokens are stored encrypted, never in plain text, and are never exposed to your browser or to anyone other than Atronet's own servers making calendar API calls on your behalf.

Retention and deletion. Calendar-derived client records and stored appointment data are kept for as long as your account is active, the same as other business data described in "Data retention" below. Deleting your Atronet account deletes your stored Google OAuth tokens and all calendar-derived client/booking data immediately and permanently. Atronet does not currently offer a separate "disconnect calendar only" control that leaves the rest of your account intact, to stop Atronet's access to your calendar without deleting your whole account, revoke Atronet's access directly from your Google Account's third-party access settings; deleting your Atronet account revokes that same access automatically.

Limited Use compliance. Atronet's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Calendar data only to provide and improve the specific user-facing features described above: calendar sync, availability checking, appointment booking/rescheduling/cancellation, and the follow-up and win-back messages described here. We do not use Google user data for advertising, we do not sell it, we do not allow humans to read it except where necessary for security, to comply with applicable law, or with your consent, and we do not use it to train or improve generalized/non-personalized AI or machine-learning models.

5. Gmail data specifically

If you connect Gmail, Atronet requests exactly two Google OAuth scopes and nothing broader:

We do not request the broader gmail.modify scope (which would also let us archive, label, or delete your mail) or gmail.compose. We never delete, label, or otherwise modify an existing message in your inbox. We only read it and, when appropriate, send a reply.

What we access and why. We periodically check your inbox for new messages so Receptionist can hold an email conversation with your customers the same way it does over SMS. When Receptionist replies, we send that reply from your connected Gmail address using the send scope above.

Whether Gmail data is shared with third parties. The content of an inbound email (sender, subject, and body) is sent to Anthropic's Claude API so it can draft a reply, the same way inbound SMS content is used. No Gmail content is sold, used for advertising, used to train AI models, or shared with anyone beyond what's needed to draft and send that one reply.

How Gmail data is protected. Your Gmail OAuth access and refresh tokens are stored encrypted, never in plain text, and are never exposed to your browser or to anyone other than Atronet's own servers making Gmail API calls on your behalf.

Retention and deletion. An inbound message is fetched, processed to classify it and draft a reply, and Atronet then keeps the sender's address, the subject line, the message and thread id and the conversation status (open, auto-replied, or handed off to you) for as long as your account is active. So that Atronet can follow a conversation, it also keeps a short excerpt (up to 400 characters) of each of the most recent messages in a conversation, for up to 30 days from the last message in it. We do not keep the full body of your emails. A short summary of why Atronet alerted you (which can quote a customer's message) is kept in your alert history for as long as your account is active. Deleting your Atronet account deletes your stored Gmail OAuth tokens, that thread metadata and those excerpts immediately and permanently. To stop Atronet's access to Gmail without deleting your whole account, revoke Atronet's access directly from your Google Account's third-party access settings; deleting your Atronet account revokes that same access automatically.

Limited Use compliance. The same Limited Use commitments described above for Google Calendar apply to Gmail data: we use it only to provide the email-answering feature described here, we do not use it for advertising, we do not sell it, we do not allow humans to read it except where necessary for security, to comply with applicable law, or with your consent, and we do not use it to train or improve generalized/non-personalized AI or machine-learning models.

Gmail or Outlook connected through Nylas. Where Atronet offers it, you can connect Gmail or Outlook through Nylas, our email connection partner, instead of directly. Google or Microsoft then shows you Nylas's consent screen, naming the permissions Nylas asks for on Atronet's behalf (to read your inbox and to send replies from your address), and Nylas holds the connection grant. Atronet keeps only the grant Nylas issues, encrypted. The same rules as for a direct connection apply to what Atronet does with your mail: it is used only to read new customer emails and send replies you have enabled, message content is sent to Anthropic's Claude API only to draft a reply, nothing is sold or used for advertising or to train AI models, and you can revoke access from your Google or Microsoft account settings or by deleting your Atronet account.

Other email providers (Outlook, Yahoo, iCloud and others). If you connect Outlook, Atronet asks Microsoft for permission to read your mail (Mail.Read), send mail as you (Mail.Send), see your basic profile (User.Read) and keep access without asking again (offline_access). If you connect Outlook Calendar it asks for permission to read and write your calendar (Calendars.ReadWrite). If you connect Yahoo, iCloud or another email account, the connection is made through Nylas, using an app-specific password you create with your email provider and enter on the sign-in page Nylas shows you; Atronet never receives or stores that password, and keeps only the connection grant Nylas issues, encrypted. In all cases the same rules as for Gmail apply: message content is sent to Anthropic's Claude API only to draft a reply, only the metadata and short excerpts described above are kept, access tokens are stored encrypted and never exposed to your browser, nothing is sold or used for advertising or to train AI models, and you can revoke access from your provider's account settings or by deleting your Atronet account.

6. Cookies

Your login session is kept in your browser's local storage by Supabase's client library, not a cookie. The site itself sets no cookies by default.

The one exception: if you click "Accept" on the cookie banner shown on your first visit, we load a Google Ads tracking cookie so we can see which ads led to a signup. This is entirely optional. If you click "Decline," or don't respond, nothing loads and no cookie is set. You can change your mind at any time; the banner reappears if you clear your browser's site data, or you can re-open it from the link at the bottom of this page. This cookie is set by Google, used only to measure ad performance, and is covered by Google's own ads policy. See "Who we share it with" above for Google's role as a subprocessor for this.

Change your cookie choice

7. Data retention

We keep your business's data for as long as your account is active. If you delete your account (available directly from your dashboard's Account & Data panel), your business record, client list, booking history, and message history are permanently deleted, and any connected phone number and active subscription are released/canceled as part of that same action.

8. Your rights

You can export a full copy of your business's data at any time from your dashboard ("Export my data"). You can delete your account and all associated data at any time from the same panel. This is immediate and permanent. Beyond export and deletion, you can also ask us to correct inaccurate data we hold about you, ask us to restrict or object to certain processing, or ask what data we hold. Contact jacob@atronet.co for any of these and we'll respond as soon as we can. If you're not satisfied with how we've handled your data, you have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

9. SMS opt-out

Anyone your business texts can reply STOP (or UNSUBSCRIBE/CANCEL/END/QUIT) at any time to stop receiving automated messages, and START (or UNSTOP) to opt back in. We record opt-out status per phone number and every automated send checks it first.

10. Children's privacy

The Service is intended for business use and is not directed at children. We do not knowingly collect data from anyone under 16.

11. Security

Access to your business's dashboard requires a verified, signed-in session tied to your account. Data is never accessible from a bare link or guessed ID alone. OAuth tokens and connection grants for connected calendars and inboxes are stored encrypted, not in plain text. The confirmation code Atronet sends you to prove alerts reach you is stored only as a one-way hash and expires after 15 minutes.

12. Changes to this policy

We may update this policy from time to time; material changes will be reflected by updating the "Last updated" date above.

13. Referral programme

If you join Atronet's referral programme (atronet.co/refer), we collect your name, email address (taken from your Atronet account, not re-typed), your confirmation that you're 18 or older, and your acceptance of the Referral Terms. We do not ask you for, and do not want, any personal information about the business you're referring, no name, email, or phone number for them. You share your own unique referral link however you choose; we do not send anything on your behalf.

Attribution. When someone follows your referral link, we set a short-lived, first-party cookie recording which referral code they came from, for up to 30 days. That cookie is not readable by any script on the page (it's set "HttpOnly") and is only ever read by our own server, once, at the moment a new business account is created, to record that this particular new business was referred by you. If no business is created within that window, or the person never follows through, nothing further happens and no record is created.

Reward and payment records. If a referral qualifies, we keep a record connecting your account to the referred business's Atronet account id (not their name, email, or any other contact details), the date it was attributed, the date it qualified, the £75 reward status, and, once paid, the date and a short internal payment reference. This is what lets us pay the right person once, and what we rely on if either of us needs to check a referral's status later.

Retention. We keep referral and reward records for as long as your account is active and for a reasonable period afterward for our own accounting and fraud-review records, the same as other financial records described in "Data retention" above.

Your rights. The same rights described in "Your rights" above apply to your referral programme data. Contact jacob@atronet.co to ask what we hold, correct it, or ask us to stop.

14. Contact

Questions about this policy or your data: jacob@atronet.co