HelloBusy

Privacy Policy

This policy describes HelloBusy as it actually works today, not as it might work later. Where we can't yet do something, it says so.

Effective 21 October 2026  ·  Last updated 21 October 2026

1. What HelloBusy does

HelloBusy is an AI front office for a small business. With the owner's permission it:

• answers business phone calls the owner misses with an AI voice receptionist, and keeps the recording, the transcript and a summary;
• reads the business's email and calendar, sorts what arrives, files things, and drafts replies and calendar changes;
• books work — appointments, callbacks and jobs go onto the calendar you connected, as changes you approve, or directly where you have told your receptionist it may book;
• keeps a to-do list, a lead and contact list, and a chat with the owner's chief of staff;
• sends a daily brief, and notifications to the owner's phone if they turn them on.

Nothing leaves the business without the owner's approval. Emails, calendar changes and other outgoing actions are created as approvals; they happen only when the owner taps Send or Apply. The AI that writes them has no ability to send: it writes a draft, and the code that sends runs only from an approval. The exceptions are the things the owner has explicitly switched on to go out on their own — the receptionist answering the phone, and automatic replies to enquiries from the business's own website form — which the owner turns on and can turn off. Separately, inside your own mailbox, the agents label and file mail (for example moving receipts out of the inbox) as they sort it; that doesn't send anything to anyone, and every filing can be undone from History.

2. What we handle

We do not ask for payment card details: if and when paid plans are switched on, payment is handled by Stripe and card data goes to Stripe, not to us.

We do not knowingly collect special-category data. Of course, email and phone calls can contain anything your customers write or say; we handle it as described here and do not mine it for any purpose of our own.

3. Google account data, and Google's Limited Use rules

You connect your own Google account to HelloBusy through Google's own OAuth sign-in screen. We never ask for your Google password, and you can see and withdraw the access at any time at myaccount.google.com/permissions. HelloBusy asks for these permissions and uses them for these things only:

• Gmail read (gmail.readonly) — to read and sort your mail;
• Gmail modify (gmail.modify) — to label, archive and file messages (every filing can be undone from History);
• Gmail send (gmail.send) — to send only the specific message you approved, when you tap Send;
• Google Calendar — to read your calendar and make the bookings and changes you approve.

To stop HelloBusy using a Google account, revoke it at the Google link above — that takes effect immediately — or ask us from Account → Your data and we will delete the stored tokens; we start on that the same day.

Limited Use disclosure

HelloBusy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide and improve the user-facing features you see in HelloBusy — sorting your mail, surfacing what needs you, drafting what you approve.
• We do not transfer Google user data to others except as needed to provide those features, to comply with applicable law, or as part of a merger or acquisition with notice to you. Where a provider is needed to run a feature, it appears in our subprocessor list and is bound to the same limits.
• We do not use or transfer Google user data for advertising, ad targeting, personalisation, credit assessment, lending, or to sell to data brokers or information resellers. We never sell your data.
• We do not use Google user data to develop, improve or train generalised AI or machine learning models, and we never will. Content goes to our AI providers only to produce your own results. See AI processing.
• We do not allow humans to read your Google user data, except: with your explicit consent (for example when you ask for support on a specific message); where necessary for security purposes such as investigating abuse; to comply with applicable law; or where the data has been aggregated and anonymised.

Microsoft 365 / Outlook is not connected today. If we add it, this policy will be updated before it ships.

4. Phone calls, recordings and consent

Your business phone line can forward to your AI receptionist. When it does:

• the call is handled by Vapi, our voice platform, which records the audio and produces a transcript;
• the recording, the transcript and a summary appear in your dashboard and app;
• the caller's number and the time and length of the call are kept with it.

Recording consent is the business's responsibility. Call-recording law differs by state and country: some require all parties to consent, others only one. As the business operating the line, you are the one who must comply, and you confirm you have the right to record and transcribe calls to your number. The receptionist's opening script can announce that the call is recorded, and does so where you have set it to — check your own state's rules and your script. If you would rather not record at all, ask us under Account → Your data or email us, and we will switch recording off for your line; your receptionist carries on answering, and you keep the transcript and the summary.

Callers who want their recording deleted can ask you, or email [email protected]; a specific call can be deleted outright (see retention).

5. AI processing

Two different sets of AI providers do the thinking, and it is worth knowing which is which.

Your inbox, your drafts, your tasks and your chat: Anthropic's Claude

To draft a reply, sort an inbox, summarise a call or answer you in chat, the relevant content — an email thread, a transcript, your own message — is sent to Anthropic, processed, and the result comes back to your office.

Those requests are made through Anthropic's commercial API on HelloBusy's own business account. Under Anthropic's commercial terms, business content sent to the API is not used to train their models. Your office cannot be run any other way: the software refuses to start an agent for a customer on anything but the commercial API, because the only other route would be a personal login, and a customer's data may never go through one.

We do not train any model on your content, we never will, and we do not use one business's data to answer another's. Each office's content is sent only to produce that office's own results.

Your phone calls: Vapi, and the providers behind it

A live call does not go to Anthropic. Vapi runs the call, Deepgram turns the speech into text, Vapi's own voice model speaks the replies, and the receptionist's thinking during the call is done by a Llama model running at Groq. The call summary and tags are produced by Vapi from the transcript. Afterwards, when your chief of staff reviews calls or writes a follow-up, that part is Claude as described above.

6. Where your data lives

Each business gets its own encrypted database with its own key, isolated from every other customer. Your email, calls and customer records are never pooled into a shared database, and the key that opens your database cannot open anyone else's. Each business also runs as its own operating-system account with its own files and its own background jobs, so one customer's software cannot read another's. Your backups are encrypted with a second key that is again yours alone.

The servers are rented from Akamai Connected Cloud (Linode) and currently run in Atlanta, Georgia, USA. Cloudflare sits in front of our domains for DNS, TLS and protection against abuse, so requests to our sites pass through Cloudflare's network, and the off-site copies of your encrypted backups are stored in Cloudflare R2. Call recordings are also held by Vapi, and your email and calendar of course remain in your own Google account.

If you use HelloBusy from outside the United States, your data will be processed in the United States.

7. Subprocessors

The named companies we rely on to run the service:

About notifications. A notification sent to a browser, or to HelloBusy added to your Home Screen, is encrypted on your own office with keys only that device holds — so Apple, Google and Mozilla carry it without being able to read it. They do see that something was sent to that device, and when. The iPhone app is different: Apple's push service carries that text in the clear, the way it does for every iPhone app.

Tools you connect yourself. If you attach an outside tool to one of your agents, what that agent sends it goes to whoever runs that tool, under their terms, not ours. Nothing is attached unless you attach it. The lead researcher's web search is not switched on for customer offices today; if that changes, this page will say so before it does.

Our providers are US companies and process your data in the United States; Cloudflare's network is worldwide, so a request can pass through a datacentre near you on its way in.

We will keep this list current. If we add a subprocessor that handles your content, we update this page.

8. How long we keep things, and deletion

• Calls you delete go to Recently Deleted and are purged for good — from your office and from Vapi — 30 days later. "Delete now" purges immediately.
• Spam calls are purged automatically 30 days after the call.
• Call audio on your office is kept only while a message is unheard; once you have listened, the local copy is removed and only the transcript and summary remain.
• Email and calendar are not copied wholesale: we keep the identifiers, subjects, senders, a one-line snippet and the extracts needed to show you a task, a filing or a draft. The messages themselves stay in your Google account.
• Text transcribed from email attachments is cached on your office and deleted automatically 30 days after it was made, by a job that runs every night.
• Tasks, leads, contacts, bookings, approvals and chat are kept while your account is open, because they are your working records.
• The IP address recorded by our public contact form is cleared 30 days after the submission; the enquiry itself is kept as a business record.
• Backups run nightly and are encrypted with AES-256 under your office's own backup key before they leave the server. The newest 14 are kept, on the server and in Cloudflare R2, and older ones are deleted automatically. Deleted data can therefore persist in backups for up to 14 days.
• Server logs are kept for troubleshooting and deleted automatically after 30 days.

Closing your account

If you close your account we delete your data and your office within 30 days, and we delete the backups in the same pass rather than waiting for them to age out. Say the word and we will do it sooner.

Deletion destroys your keys. Closing an office removes its database, its files, its units and its Linux account, and then destroys the two keys that office's data was encrypted with — the data key and the backup key. Any copy of your encrypted data that could still exist anywhere, including an off-site backup blob, becomes permanently unopenable by anyone, us included. The off-site copies are deleted as well, so "deleted" means gone and unreadable, not just removed from a list.

9. Your choices and your requests

You can do these yourself, at any time: delete a call (on its own, or everything in Recently Deleted); mark a task done or dismiss it; undo a filing from History; decline any draft; revoke a paired iPhone; remove a passkey; sign out everywhere; and revoke HelloBusy's access to a Google account at myaccount.google.com/permissions.

And these you ask us for, with one tap under Account → Your data — which logs the request and tells us immediately: a copy of your data, deletion of your account and its data, disconnecting a Google account, or turning call recording off for your line. You can also email [email protected] from the address on your account, and you can ask us to correct anything we hold. We start the same day, answer within 30 days, and don't charge for a reasonable request.

Depending on where you live you may also have the right to object to or restrict processing, to complain to your data protection authority, and — in California — to know what is collected and to opt out of "sale" or "sharing": we don't sell or share your personal information, so there is nothing to opt out of.

Where HelloBusy processes your customers' personal data on your behalf, you are the controller and we are the processor acting on your instructions. We don't yet have a standard data processing agreement on the shelf: if you need one, say so before you connect anything and we will agree one with you in writing.

10. Security

• Sign-in is by passkey (Face ID, Touch ID or a security key), or a one-time code or link emailed to you. There are no passwords to steal, and we store only the public half of a passkey and only a hash of a code or link.
• Sessions use secure, HttpOnly, SameSite cookies; only a hash of a session token is stored. The iPhone app uses its own per-device token, which you can revoke.
• Everything travels over HTTPS, with HSTS set on every one of our hosts.
• Your data is encrypted at rest. Your office's database is encrypted with SQLCipher (AES-256), and the Google logins we hold, the call audio kept for unheard messages, the text taken from your attachments, your stored secrets and any export we make for you are each encrypted with AES-256-GCM. The files are also readable only by the account your office runs as.
• The key is not kept beside the data. It lives outside the application directory, is handed to each of your office's services by the operating system when they start, and is never included in a backup. A copy of your database, or a copy of a backup, is unreadable on its own. We are straight about the limit of this: the services hold the key in memory while they run, so it protects copies of your data that leave the server rather than the running server itself — that is what the HTTPS, the passkey login and the file permissions above are for.
• Backups are encrypted again under your office's own backup key before they leave the server, and the off-site copies are uploaded exactly as they lie — never decrypted, re-packed or re-keyed on the way out. Opening one needs both of your office's keys.
• Access by us is limited to what support requires, and we open a customer's dashboard only with their consent, except where security or the law requires otherwise.

Two things are deliberately not encrypted, so you know: the server's own operational logs, which can mention an email address or a phone number and are deleted after 30 days, and a picture or PDF from your email for the few seconds it takes to read the text out of it.

We are a small team on ordinary cloud infrastructure. We do not hold SOC 2, ISO 27001 or any other security certification, and we don't claim to. If you need one, tell us before you sign up.

No service is perfectly secure. If we discover a breach affecting your data we will tell you promptly and tell you what we are doing about it.

11. Children

HelloBusy is a tool for businesses and is not for children. We do not knowingly collect personal information from anyone under 13, and accounts may not be created by or for them. If you believe a child's information has reached us, email [email protected] and we will delete it.

12. Changes to this policy

When this policy changes we update the date at the top, and for anything that materially affects you we email the address on your account before it takes effect. Carrying on using HelloBusy after that means the new version applies.

Company details

Questions about this policy, or a request about your data? Email [email protected].