Privacy policy | Smart Concierge

Data controller

Smart Concierge (smartconciergeservice.com). Contact: denys.aiautomation@gmail.com.

Data we process

Business contact details (email, phone); end-customer WhatsApp messages processed on behalf of the business; Google account email and Google Calendar data when a business owner connects Google Calendar (calendar list, calendar identifiers, and event data needed to check availability and create, update, or cancel bookings); and technical logs (IP, timestamps) to operate the service.

Purpose

Providing the WhatsApp concierge: bookings, FAQ answers, and handoff to human staff. Google Calendar access is used only to show free slots and to create, update, or cancel appointment events for that business. We do not sell personal data.

Google user data — sharing and disclosure

Google user data obtained via Google APIs (OAuth tokens, connected Google account email, calendar list, and calendar event data) is used solely to operate Smart Concierge for the connecting business. We do not sell Google user data. We do not share, transfer, or disclose Google user data to advertisers or data brokers. We do not share Google Calendar contents with other tenants. Limited disclosure may occur only to infrastructure sub-processors that host or process the service under contract (currently Hetzner for EU hosting), and only as needed to run the application. We do not transfer Google user data to Meta or Stripe. OpenAI may process WhatsApp conversation text to understand booking intent; we do not send Google Calendar payloads or Google OAuth tokens to OpenAI for model training or unrelated purposes.

Data protection mechanisms

We protect sensitive data with industry-standard controls: TLS encryption in transit; encryption at rest for Google OAuth refresh and access tokens stored in our database; access limited to authenticated admin users for their own tenant; logical isolation of each business’s data (multi-tenant separation); and hosting in the EU (Hetzner) with provider security measures under contract. Access to production systems is restricted to authorized operators.

AI / machine learning and Google Limited Use

Smart Concierge uses third-party AI (OpenAI) to interpret WhatsApp messages for booking and FAQ flows. The use of raw or derived user data received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google Workspace or Google Calendar user data—raw, aggregated, or derived—to create, train, or improve foundational or generalized machine learning or artificial intelligence models. Google user data is not transferred or sold for such training.

Legal basis (GDPR)

Contract performance with the business; legitimate interest in security and service operation; end-customer consent where applicable (voluntary WhatsApp messages).

Sub-processors

Meta (WhatsApp Cloud API), OpenAI (natural language processing of WhatsApp messages), Google (Google Calendar API when connected by the business), Hetzner (hosting in the EU), and Stripe (billing when used). Each provider is engaged under contract with appropriate security and data-processing terms.

Retention

For the duration of the contract and legal retention periods. Google OAuth tokens and calendar linkage are kept while the integration remains connected and are removed or invalidated when the business disconnects or the account is deleted. The business may request export or deletion per contract.

Your rights

Access, rectification, erasure, restriction, portability, and objection: contact by email. Complaint to the AEPD (Spain).