Privacy policy — ReceptionAI

Provisional version of 23 October 2026 — service in testing phase.

1. Who are we?

ReceptionAI is a virtual receptionist that, on behalf of businesses (salons, practices, tradespeople…), answers their customers' WhatsApp messages and calls and manages their appointments. During the testing phase, the service is published by Samuel Chemla. Contact: samuel.project.dev@gmail.com.

2. Data processed

• Customers of businesses: phone number, name provided, content of messages exchanged, appointments booked, changed or cancelled.
• Business users: login email address, business information (contact details, opening hours, services, prices), and access to their Google Calendar when they connect it.

3. Why?

Solely to provide the service: answering customers' questions using the information supplied by the business, checking its availability, recording appointments in its calendar, forwarding to the business any requests that cannot be handled automatically, and keeping the service secure. Data is never sold or used for advertising.

4. Service providers

Data is processed by technical providers, solely to run the service: Meta (WhatsApp Business), Anthropic (the artificial intelligence that drafts replies), Supabase (data hosting, European Union — Paris), Google (calendar, when the business connects it), Vercel (application hosting).

Audience measurement: the site counts page views anonymously (Vercel Web Analytics), without cookies and without tracking you from one visit to the next.

Data (appointments, conversations, customer records, settings) is stored in the European Union, in Paris. Some providers (AI, WhatsApp, Google, telephony) may process it outside the European Union, notably in the United States, under their contractual data-protection commitments. ReceptionAI is developed in Israel, a country covered by a European Commission adequacy decision under the GDPR.

5. Retention period

Conversations and appointments are kept for as long as the business uses the service, then deleted within 12 months of the end of its subscription at the latest, unless the law requires otherwise.

6. Security

Each business's data is isolated from the others; calendar access is encrypted; technical keys never leave our servers.

7. Your rights

You can request access to, correction or deletion of your data, or object to its processing, by writing to samuel.project.dev@gmail.com. To have your WhatsApp-related data deleted, include your phone number: requests are handled within 30 days. You can also contact the data protection authority in your country.

8. Your Google Calendar data

When a business connects its Google Calendar, ReceptionAI only requests the access needed to book appointments:

• availability (free/busy): knowing which times are busy so customers are only offered free slots. The AI only receives free slots, never the content of your events;
• events: create, move or cancel the appointments booked by ReceptionAI or by you from your dashboard, show your other events in your dashboard calendar, and detect appointments you change directly in Google Calendar;
• calendar list: letting you choose which calendar to use.

This data is used only to run the service for the business. It is not sold, not shared with third parties (except the technical providers listed above, to run the service), not used for advertising, and not read by humans except with your consent, for security, or where required by law. It is not used to train AI models.

Protection: the Google access token is encrypted (AES-256-GCM) in our database, all exchanges use encrypted connections (HTTPS), and only ReceptionAI's servers can use it, solely for your business.

Retention: the content of your other Google events is never stored; it is read when your calendar is displayed or your availability is calculated. We only keep the identifiers of events created by ReceptionAI, so we can move or cancel them. When you disconnect, access is revoked with Google and the token is deleted immediately.

Artificial intelligence: your Google data is never transferred to any AI service that would use it to train its models. Our AI provider (Anthropic) only receives the computed free slots, never the content of your events, and does not train its models on data sent by our service.

ReceptionAI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect your calendar at any time from your ReceptionAI dashboard or from the “Third-party apps” page of your Google Account: access is then removed from our servers.