1. Introduction

ScepterIQ ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered customer engagement platform.

2. Information We Collect

We collect the following types of information:

Account Information: Name, email address, business name, and billing information when you create an account.
AI Interaction Data: Conversation transcriptions, interaction metadata (duration, timestamps), and outcomes (appointments booked, leads captured) from your AI assistant's customer interactions.
Business Information: Details you provide about your business including services, hours, FAQs, and appointment availability.
Usage Data: Information about how you use our platform, including credit consumption, analytics, and performance metrics.
Google Account Data: If you connect Google Calendar, we receive your Google account email address and account ID via Google OAuth, and we access calendar data as described in Section 3a below.

3. Third-Party Service Providers

To provide our AI customer engagement platform, we use trusted, enterprise-grade third-party providers for:

AI Processing Infrastructure — Powering conversational AI capabilities
Speech Processing — Enabling natural-sounding AI interactions
Cloud Infrastructure — Hosting and data storage

When your AI assistant checks calendar availability during a customer conversation, a list of open time slots is shared with our AI and speech processing providers. After a booking, the confirmation reference (event ID and link) of the appointment we created is also passed to the AI provider. This is used solely to present available times to the customer and confirm the booking. No event titles, descriptions, attendees, or other calendar contents are shared with these providers.

These providers process data on our behalf and are bound by their own privacy policies and data protection obligations.

3a. Google User Data

When you connect your Google Calendar through our integrations settings, we request the following access via Google OAuth:

What we access

Google account email address and account ID — to identify your connected account. We do not store your Google profile name or photo.
Free/busy information on the single calendar you select (default: your primary calendar) — to check whether a time slot is available. We do not read event titles, descriptions, attendees, or other event details.
Calendar event creation — to book appointments on your behalf when your AI assistant schedules a customer. The event contains the details your customer provides (name, service, address, notes, and their email address if given, added as an attendee without sending an invitation). We only create new events; we never edit or delete your existing events.
Read-back of events we created — solely to prevent double-booking when a retry uses the same appointment identifier

How we use it

Google user data is used exclusively to check availability and book appointments during customer conversations. It is never used for advertising, and is never sold to third parties.

How we store it

OAuth tokens (access and refresh tokens) are encrypted at rest using AES-256-GCM authenticated encryption at the application layer before being written to the database. Tokens are decrypted only when needed to make authorized API requests on your behalf.
Calendar data — Free/busy results are used only to calculate open time slots and are not stored. The ID and link of an event we create are kept in a temporary cache that expires after one hour, and are not stored as part of your booking records. The appointment details your customer provides (name, phone, service, address, preferred time) are stored in our database as part of your booking records.

Who it is shared with

During a live customer conversation, a list of available time slots (derived from free/busy data) and, after a booking, the confirmation reference of the event we created are shared with our AI and speech processing providers solely to present those slots to the customer and confirm the booking. No event titles, descriptions, attendees, or other calendar contents are shared with any third party.

How to disconnect and delete

You can disconnect Google Calendar at any time from Settings > Integrations in your ScepterIQ dashboard. Disconnecting immediately deletes your stored OAuth tokens from our database. You can also revoke ScepterIQ's access directly from your Google account at myaccount.google.com/permissions.

ScepterIQ's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. How We Use Your Information

We use collected information to:

Provide and maintain our AI customer engagement platform
Process your transactions and manage your account
Send you service-related communications
Comply with legal obligations

&check; Google user data (calendar data, OAuth tokens, and Google account information) is never used to develop, improve, or train generalized AI or machine learning models. It is never sold to third parties or used for advertising purposes.

5. Conversation Logs & Transcripts

We store conversation logs and transcripts to provide you with interaction history, enable quality review, and improve our service. This data is encrypted and accessible only to you and authorized ScepterIQ personnel for support purposes.

Google user data is accessed by ScepterIQ personnel only (a) with your explicit consent, (b) as necessary for security purposes (e.g. investigating a breach), (c) to comply with applicable law, or (d) when the data has been aggregated and anonymized so that it can no longer identify you. Automated access to Google user data is limited to the calendar availability and booking operations described in Section 3a.

6. We Do Not Sell Your Data

&check; We do NOT sell your personal information or interaction data to third parties.

Your data is used solely to provide and improve ScepterIQ's service. We do not share, rent, or sell your information to advertisers, data brokers, or any other third parties for their marketing purposes.

7. Data Security

We implement industry-standard security measures including encryption, secure data centers, and access controls to protect your information. Conversation data and transcriptions are encrypted both in transit and at rest. Google OAuth tokens are encrypted at rest using AES-256-GCM authenticated encryption at the application layer.

8. Data Retention

We retain conversation logs and transcriptions for the duration specified in your account settings. You can delete your data at any time through your dashboard or by contacting us.

Google Calendar data: Free/busy results are not stored. The ID and link of events we create are kept in a temporary cache for up to one hour and then automatically discarded. OAuth tokens are retained for as long as your Google Calendar integration remains connected and are deleted immediately when you disconnect. Booking records (the appointment details we originated, such as customer name, service type, and preferred time) are retained for the lifetime of your account and are deleted when your account or organization is deleted.

9. Your Rights (GDPR & CCPA)

You have the right to:

Access your personal data
Request correction of inaccurate data
Request deletion of your data ("Right to be Forgotten")
Request restriction of processing
Export your data in a portable format (data portability)
Opt out of marketing communications
Know what personal information we collect and how it's used (CCPA)
Request that we do not sell your personal information (CCPA)

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

10. Contact Us

If you have questions about this Privacy Policy, please contact us at:
[email protected]