Privacy Policy

Account and profile data (Providers). When you sign up — typically with Google Sign-In — we receive your name, email address, and profile photo. You may add a display name, headline, biography, address, avatar, timezone, currency, and the services you offer (names, descriptions, durations, prices), together with your availability rules, breaks, and time off.

Booking data (Customers). When a Customer books an appointment, we collect the details needed to create and manage the booking: name, email address, phone number (where a service is delivered by phone), the chosen service, appointment time, and any notes the Customer chooses to share. We process this data on behalf of the relevant Provider.

Voice conversations. The heart of the Service is a voice assistant. When a Customer talks to it, the audio is streamed to and processed by our voice technology partner (ElevenLabs) to conduct the conversation in real time. We receive and retain conversation transcripts, call duration, and related technical metadata, and we use call duration to bill the Provider's minute wallet. Do not share sensitive personal information in a voice conversation that is not needed to make a booking.

Payment and billing data (Providers). Payments — wallet top-ups and subscriptions — are processed by Stripe. We do not receive or store full card numbers. We keep records of your transactions, invoices, wallet balance, credits, and usage.

Support and feedback. If you open a support ticket, reply to a survey, or contact us, we keep that correspondence and its contents.

Technical data. Like most online services, we automatically collect IP address, approximate location derived from IP (country and timezone level), browser and device information, and logs of interactions with the Service. We use strictly necessary cookies for sign-in, session management, and security (CSRF protection).

Providers can optionally connect their Google Calendar so bookings appear in their calendar automatically. If you connect it, we request the Google Calendar Events permission (calendar.events) and store the OAuth tokens Google issues to us.

We use this access only to:

• create calendar events for new bookings, including attaching a Google Meet link where the service is delivered by video;
• update those events when a booking is rescheduled or its details change; and
• remove them when a booking is cancelled.

We do not read, store, or analyse calendar events that were not created by the Service, and we do not use Google user data for advertising. Access can be revoked at any time from your getinloop calendar settings or from your Google Account's security settings, and we delete the stored tokens when you disconnect.

getinloop's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• to provide the Service: host provider profiles, conduct voice conversations, create and manage bookings, send booking confirmations and reminders, and sync connected calendars;
• to operate billing: meter voice usage, maintain minute wallets, process top-ups and subscriptions, and detect and correct billing discrepancies;
• to communicate with you: transactional email and in-app notifications, and — only where you have not opted out — product updates;
• to provide support and respond to enquiries;
• to keep the Service safe: authentication, fraud and abuse prevention, debugging, and security monitoring;
• to improve the Service, using aggregated or de-identified usage information wherever possible; and
• to comply with legal obligations, including tax and accounting requirements.

Where the law requires a legal basis, we rely on the performance of our contract with you, your consent (which you may withdraw at any time), our legitimate interests in operating and securing the Service, and compliance with legal obligations — including, for users in India, the Digital Personal Data Protection Act, 2023, and for users in the European Economic Area or the United Kingdom, the GDPR / UK GDPR.

We do not sell personal data. We share it only in the following circumstances:

• Between Providers and Customers. A Provider sees the booking details of their own Customers (and related voice-conversation outcomes); a Customer sees the Provider's public profile and booking information.
• Service providers (processors). We use a small number of vendors to run the Service: ElevenLabs (voice AI conversations), Stripe (payments), Google (sign-in and, where connected, calendar), Resend (transactional email), and DigitalOcean (cloud hosting and storage). Each processes data only as needed to provide its service to us.
• Legal reasons. Where required by law, regulation, legal process, or to protect the rights, safety, or property of our users, the public, or GETIN TECH LLP.
• Business transfers. In connection with a merger, acquisition, or sale of assets, subject to this policy's protections.

Our vendors may store or process data in countries other than your own, including the United States and the European Union. Where we transfer personal data internationally, we take steps designed to ensure it receives an adequate level of protection, such as contractual safeguards with our processors.

We keep personal data for as long as needed to provide the Service and for legitimate business or legal purposes:

• account and profile data — for the life of the account and a short period after deletion;
• booking records and billing/transaction records — for the period required by tax, accounting, and audit obligations;
• voice conversation transcripts and call metadata — for as long as needed for billing verification, dispute resolution, and service quality, after which they are deleted or de-identified;
• Google Calendar tokens — until you disconnect the calendar or delete your account; and
• support correspondence — for as long as reasonably needed to handle follow-ups.

We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit (TLS) for all traffic, encrypted connections to our databases, restricted access to production systems, secrets kept out of source code, and signature verification on payment and voice-platform webhooks. No method of transmission or storage is completely secure; if we learn of a breach affecting your personal data, we will notify you and the relevant authorities where the law requires.

Depending on where you live, you may have the right to access, correct, update, port, restrict, object to the processing of, or delete your personal data, and to withdraw consent where processing is based on consent. You can exercise many of these directly: edit your profile and settings in the app, disconnect Google Calendar at any time, and manage email preferences from your notification settings.

For anything else — including account deletion or requests concerning voice transcripts — contact us at support@getinloop.ai. If you are a Customer of one of our Providers, we may refer your request to that Provider where they control the data, and we will assist them in fulfilling it. You also have the right to complain to your local data protection authority.

We use strictly necessary, first-party cookies: a session cookie, an authentication cookie, and a CSRF token. These are required for the Service to function and cannot be switched off in our systems. We do not use third-party advertising cookies.

The Service is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it.

We may update this policy from time to time. If we make material changes, we will notify Providers by email or an in-app notice before the changes take effect. The "Effective date" above shows when this policy was last revised.

GETIN TECH LLP
819, Sai Millenium, Kate Wasti, Punawale, Pune 411033, Maharashtra, India
Email: support@getinloop.ai