1. Data controller

The data controller is AI Orchestrator.

For privacy requests and exercising your rights: aiorchestratoor@gmail.com

2. Use of Google APIs and Limited Use requirements

AI Orchestrator's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We request access to Google Calendar and the connected Google account email address solely so registered customers (e.g. professionals and businesses) can:

connect their calendar from the profile area via OAuth;
read availability (free/busy) to calculate bookable slots shown in the chatbot on the connected website or store;
create, update, or cancel appointment events on the customer's calendar when a visitor books or modifies an appointment through the widget.

We do not use Google data for advertising, commercial profiling, or sale to third parties. We do not use it for purposes unrelated to the booking and assistance service described in this policy. OAuth tokens are stored encrypted on our servers and used only for calendar operations required by the service.

Customers can disconnect Google Calendar at any time from their profile; calendar bookings via the widget will be unavailable until they connect again.

3. Types of data processed

Depending on how you use the service, we may process:

Account data: name, email, phone, company, website URL, login credentials (password stored in hashed form).
Chatbot configuration: customization settings, welcome message, booking time windows, embed code.
Conversation data: messages exchanged between visitors and the chatbot on the customer's site or connected Shopify store, including data voluntarily entered by visitors (e.g. name, email, order number for ecommerce support).
Booking data: date, time, appointment duration, notes entered in the booking flow, and references to events created on Google Calendar.
Google Calendar data: connected account email, encrypted OAuth tokens, free/busy availability, and metadata for appointment events created or managed through the service.
Shopify data (if you connect a store): store domain, connection identifiers, product, order, and settings information needed to answer customer requests via the ecommerce chatbot.
Technical data: IP address, system logs, cookies, and site usage data (e.g. message counts, appointments, plan limits).

4. Purposes and legal bases

We process data for the following purposes:

Service delivery (contract performance): account creation and management, chatbot generation, embed widget, bookings, Calendar and Shopify integrations, technical support.
Security and abuse prevention (legitimate interest): platform protection, authentication, detection of unlawful or fraudulent use.
Service improvement (legitimate interest, where applicable): aggregated usage analysis, bug fixes, feature optimization.
Service communications (contract performance / legitimate interest): account notifications, plan limits, relevant updates.
Marketing (consent, where required): newsletters or promotional communications only if you have consented or where permitted by law; you may withdraw consent at any time.
Legal obligations: tax, accounting, or requests from competent authorities.

Where the GDPR applies, the legal bases above include contract performance (Art. 6(1)(b)), legitimate interests (Art. 6(1)(f)), consent (Art. 6(1)(a)), and legal obligation (Art. 6(1)(c)), as applicable.

5. Shopify integration

If you install the Shopify app linked to the same agency account, we process store data needed to display products, answer order questions, and activate the widget in the store theme. Permissions follow Shopify policies and are limited to virtual assistant functionality. Message counts and plan limits are shared between the website and connected Shopify store on the same account.

6. Visitors to customer sites

When a visitor interacts with the chatbot on a customer's website or store, we process messages and entered data on behalf of the customer (website/store owner) to provide assistance and bookings. The customer is responsible for informing their visitors and, where required, establishing appropriate legal bases for widget use on their site.

7. Retention

We retain data for as long as needed to provide the service and meet legal obligations. In general:

account data is kept while the account is active and, thereafter, for the period required by legal obligations or to protect our rights;
Google Calendar tokens are deleted or rendered unusable when you disconnect the calendar or close your account;
conversations and logs may be retained for a limited period for support, security, and usage statistics, unless otherwise required or requested by law.

8. Recipients and processors

We do not sell your personal data. We may share it with providers that help us deliver the service, including:

hosting and cloud infrastructure providers;
Google (Calendar API, OAuth): per Google policies and the Limited Use section above;
Shopify: for ecommerce integration, where installed;
AI model providers to generate chatbot responses;
email services and technical site analytics tools.

These parties process data only on our behalf and under appropriate contractual instructions, where required by applicable law.

9. International transfers

Some providers (e.g. cloud infrastructure, AI, Google) may process data outside your country or the European Economic Area. Where required, we use appropriate safeguards under applicable law (e.g. Standard Contractual Clauses) or rely on adequacy decisions.

10. Security

We implement technical and organizational measures to protect data from unauthorized access, loss, alteration, or disclosure. These include encryption of calendar access tokens, secure authentication, limited system access, and access monitoring. No system is completely risk-free, we encourage strong passwords and keeping credentials confidential.

11. Your rights

If you are in the European Union or a jurisdiction where similar rights apply, you may exercise the following rights, subject to legal limits:

access to personal data;
rectification of inaccurate or incomplete data;
erasure ("right to be forgotten"), where applicable;
restriction of processing;
data portability, where applicable;
objection to processing based on legitimate interest;
withdrawal of consent without affecting prior lawful processing;
complaint to a competent supervisory authority.

To exercise your rights, email aiorchestratoor@gmail.com. We will respond within applicable legal timeframes.

12. Cookies and similar technologies

We use cookies and similar technologies on the platform site for session management, authentication, preferences, and technical analytics. You can manage cookies in your browser settings. The embedded chatbot widget on customer sites may use local storage or session identifiers to maintain conversation context.

13. Children

The service is intended for professionals and businesses. We do not knowingly collect data from children under 16. If you believe a minor's data has been processed, contact us for removal.

14. Changes

We may update this policy. The current version is always available on this page with the last updated date. For material changes, we will notify you by appropriate means (e.g. email or in-app notice) where required.

15. Related documents

For service terms, see our Terms of Service.

Privacy Policy