Privacy Policy

1. Scope and responsibility

Operator (heyoperator.ai) (“we”, “us”, “our”) provides AI-assisted business communications, storefronts, booking, checkout and account tools. This policy covers our websites, embedded widgets, customer and merchant accounts, text messages, telephone features and connected integrations. Operator is the service name used in this policy.

We are responsible for our account administration, billing, security, support and website operations. A business using Operator (“merchant”) also determines how it uses its customers’ information to answer inquiries, arrange services and maintain customer relationships. When we handle that information on a merchant’s behalf, we follow its authorized instructions, subject to our legal obligations. The merchant’s own privacy practices also apply to its handling of information. A merchant’s independent use, exported copies and other systems are not controlled by this policy.

Our Privacy Contact is responsible for privacy questions and requests. Contact our Privacy Contact at privacy@heyoperator.ai. You may contact us about information held by Operator even if you do not have an account.

2. Information we collect and its sources

• Account and business information: names, email addresses, telephone numbers, business details, addresses, service areas, account identifiers, authentication information, preferences and connected-account details. We receive this from you, authorized account users and sign-in providers. Passwords are stored as hashes, not readable passwords.
• Inquiry and transaction information: contact details, service or product selections, answers to booking questions, appointment times, service locations, quotes, deposits, payment and refund records, cancellation details and transaction history. A merchant can receive your inquiry and contact details before you complete a booking or verify a phone number.
• Communications and content: messages, reference images and other uploads, support requests, merchant knowledge sources, call transcripts, summaries and, when recording is enabled, call audio. Merchants may add customer notes. AI-assisted features can extract preferences and constraints to help the same merchant recognize returning customers.
• Billing information: billing contact and address, tax details, plan, credit balance, usage, invoices, payment-provider identifiers and limited payment-method information. Stripe collects payment-card details through its payment interfaces; Operator does not store full card numbers or card security codes in its application database. Do not send those details in a conversation or telephone call.
• Integration information: identity information from Google sign-in; calendar authorization tokens, calendar identifiers and availability when a merchant connects Google Calendar; and data or instructions exchanged with merchant-authorized apps and assistants. We also obtain business listing information from Google Places and websites a merchant asks us to import.
• Technical and activity information: network and device information, IP addresses used for security and rate limiting, page and feature events, referral and campaign information, authentication and consent records, delivery records, call identifiers and durations, AI usage, and operational diagnostics. Our infrastructure and service providers also process technical information necessary to deliver their services.

Information about other people should be provided only when you have authority and an appropriate legal basis to provide it. Avoid sending unnecessary sensitive information, including medical records, government identification, financial account credentials or information about children. Booking questions and free-text messages can reveal sensitive details even when we do not ask for them.

3. Why we use information

We use information to create and secure accounts; publish merchant-selected business content; respond to inquiries; prepare quotes; check availability; arrange bookings and purchases; process payments, subscriptions, credits, refunds and payouts; send service communications; operate integrations; provide customer support; investigate errors, fraud and abuse; maintain records; and meet legal obligations.

We also use website and product activity to understand feature usage, evaluate changes and improve the service. Campaign information may be associated with a merchant’s signup. We do not sell personal information for money. The analytics section explains third-party website measurement separately; “cookieless” does not mean that no information is processed.

4. AI-assisted conversations and customer memory

Operator uses AI services to understand messages and images, answer inquiries, assist merchants, transcribe and summarize calls, and extract relevant booking details or customer preferences. Depending on the feature, relevant conversation history, images, business information, knowledge sources and customer context are transmitted to an AI provider. Audio is transmitted to voice providers during an AI-handled call, including when storage of a call recording is disabled.

Our AI features use OpenAI and may use other configured AI providers for particular features. Telephony providers also process audio to deliver voice features. The information sent depends on the task and may include personal information contained in your messages, images or calls. Provider retention and permitted uses depend on the service, agreement and account settings; disabling an Operator feature does not automatically delete information already processed by a provider. We do not promise zero provider retention or a universal restriction on provider model training. Contact our Privacy Contact for the providers and processing terms applicable to a particular interaction.

AI output can be inaccurate. Pricing, availability and booking actions also use merchant settings and automated application rules. These rules may produce a quote, apply a discount, request merchant approval or decline an unavailable time. Ask the merchant to review an incorrect booking detail or outcome, and contact us about a platform error. Customer memory can retain preferences and constraints for future interactions with that merchant; merchants have controls to disable memory and manage saved facts. Disabling memory is not the same as deleting the underlying conversation records.

5. Calls, recordings and messages

Telephone features process caller and called numbers, call times, routing information, audio, transcripts and summaries as needed to handle calls. When call recording is enabled, recordings are stored through Twilio and made available through the merchant’s account. Merchants can disable audio recording. Recorded audio is subject to the 30-day scheduled cleanup described in section 9. Turning recording off does not turn off live AI audio processing, transcription or summaries, and does not itself delete earlier recordings.

When recording is enabled, the call notice explains that the call is recorded and transcribed to help handle your request. When recording is disabled, the notice describes transcription. Calls can be handled automatically using AI, as described in section 4. If you do not want to use a recorded or AI-assisted channel, end the call and contact the merchant through another available channel. Availability of an alternative depends on the merchant. You can also contact the merchant or our Privacy Contact about an objection or deletion request. This policy does not replace any additional notice or consent required for a particular call, and continuing a call is not treated by this policy as consent to unrelated uses.

Messages can include verification codes, replies to inquiries, booking links, reminders, receipts, missed-call responses and requests for feedback after a service. Message frequency varies with your interactions. Carrier message and data charges may apply. Reply STOP to a text from the service to opt out of further texts through that sending channel, or contact us for help. Opting out can prevent delivery of booking updates; you can use the website or contact the merchant instead. Phone verification by itself is not consent to unrelated promotional messaging.

6. Who receives information

• The relevant merchant and its authorized account users receive customer inquiries, contact details, messages, booking information and available call records so they can respond and deliver the requested service.
• Payment and communications providers include Stripe for payments, subscriptions, connected accounts and payouts; Twilio for calls, recordings, SMS and phone verification; and Resend for email. These providers receive the information needed for the relevant service and may also have independent legal, fraud-prevention or account obligations.
• Technology providers include AI providers described above; hosting and database infrastructure such as Vercel and Neon; the configured file-storage provider; and, when configured, Sentry for restricted operational diagnostics and shared rate-limiting infrastructure. We also use Google for sign-in, business listings and calendar features, and Mapbox for maps and address lookup. When enabled, our Support Board help desk processes support conversations, contact details, account-linkage information and lifecycle tags, such as trial or customer status, on our support subdomain.
• Website measurement includes Vercel Web Analytics, Microsoft Clarity on our public marketing pages, and our first-party event systems, as described below.
• Merchant-authorized apps and AI assistants receive information within the permissions granted by the merchant. Some permissions allow changes as well as reading data. Revoking a connection stops future authorized access but does not retrieve copies already obtained by that provider.
• Other recipients may receive information when you direct us to share it, when reasonably necessary to comply with law or valid legal process, protect rights and safety, investigate fraud or abuse, or evaluate or complete a business transfer, subject to applicable confidentiality and legal requirements.

Merchant-selected storefront details, images and business listings are public when published. Customer star ratings contribute to public aggregate ratings; written review comments and merchant replies are currently available within the service rather than published as public storefront reviews. Booking links and some uploaded-file links allow access to anyone who possesses the link. Keep these links private and do not upload material that requires a more restricted sharing arrangement.

7. Google connections

Google sign-in supplies identity information used to authenticate you. Connecting Google Calendar is separate: we obtain authorization to read calendar availability and create, update or remove booking events. Booking event descriptions and locations may contain customer or service information and become subject to the calendar’s sharing settings.

You can disconnect Calendar in Operator or revoke access in your Google account. Revocation does not automatically remove events already written to a calendar. Our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Google user data is not used for advertising or to train generalized AI models. Human access to Google user data is limited to the circumstances permitted by that policy.

8. Cookies, local storage and analytics

We use cookies and similar browser storage for sign-in sessions, authentication security, onboarding progress, support continuity and device preferences. Blocking necessary storage can prevent those features from working. An embedded merchant widget and the merchant’s own website may have separate storage and privacy practices.

Our first-party marketing-event system records page views, selected button clicks, demo activity, calculator usage, referring domains, campaign tags and coarse device categories. It does not assign a persistent visitor identifier or store raw IP addresses or full user-agent strings in those event records. Network information is still processed for delivery and rate limiting. This event system skips requests carrying supported Do Not Track or Global Privacy Control signals.

Separately, when our support-experience feature is enabled, a browser-storage token identifies an experience group and lets us measure support interactions and relate them to onboarding or a merchant account. This is not part of the identifier-free marketing-event system. The support-experience client does not enroll or send events when it detects supported Do Not Track or Global Privacy Control signals.

Vercel Web Analytics provides additional cookieless page measurement. Our integration removes query strings, replaces booking capability tokens in tracked URLs and excludes merchant back-office, administration and API routes. These controls do not prevent the network requests and technical processing needed to serve the website.

On our public marketing pages only, we use Microsoft Clarity session replay and heatmaps to understand how visitors use the website. Page content is masked from the recording, Clarity runs without analytics or advertising cookies, it does not load when your browser sends a Do Not Track or Global Privacy Control signal, and it stops before you move to sign-in, setup, a booking page or any account area. Microsoft processes this data as our service provider. Contact our Privacy Contact about any request involving this data.

Where applicable law requires consent for optional measurement, that consent must be obtained before the relevant processing. You can contact us to exercise applicable opt-out rights. Browser signals do not stop necessary authentication, security, payment or communications processing.

9. Retention and account deletion

Retention depends on the type of information, the service being provided, merchant settings, legal obligations, disputes and the need to protect against fraud or abuse. Records used to make a decision about a person may also need to be kept for a legally required access period. We do not promise a single deletion period for all records or immediate removal of every copy when an account closes.

Merchant closure disables access and publication and schedules account-profile and selected-content cleanup after a 30-day reopening window. Paid or unresolved bookings may need to be resolved first. Booking, payment, credit, review and audit records are retained separately; closing a merchant account does not erase all customer transaction records.

Customer account deletion removes account access and clears specified identity and conversation fields. It also starts follow-up erasure processing for eligible stored resources. Provider copies, some media and records subject to retention review are not all removed immediately. A pending erasure request is not confirmation of complete deletion. Contact us for the status or scope of a request, including information not covered by self-service deletion.

Call audio is scheduled for deletion after 30 days. For recordings made before October 21, 2026, when this rule took effect, the 30 days count from that date. Cleanup runs in batches and depends on confirming the recording belongs to the relevant account and completing deletion with the recording provider. Failed deletions and records requiring review can take longer; this is not a guarantee that every copy disappears exactly on day 30. Audio deletion does not itself erase transcripts, summaries, booking records or independent copies exported by a merchant. Contact our Privacy Contact about an overdue recording or a request for earlier deletion.

Transcripts, summaries, messages and saved customer preferences have separate retention criteria: their continued relevance to the merchant’s customer relationship, unresolved requests or transactions, applicable access rights, and legal or dispute obligations. They do not automatically expire with call audio. Support and diagnostic records are assessed against their support, security and troubleshooting purposes. Backups, security records, financial records and legally preserved information may remain separately from active account data. Merchant exports and independent provider records may also remain subject to their own obligations. Contact our privacy contact for the retention criteria and available deletion options for a specific category or record.

10. Security and international processing

We use measures intended to protect information, including access controls, scoped account permissions, hashed passwords, protected session cookies, transport encryption and restricted diagnostic logging. If a security incident affects personal information, we assess it and provide notifications required by applicable law. No system is completely secure. Some conversation and file links act as access credentials; protect them as you would a password. Notify us promptly about suspected unauthorized access.

Operator and its providers may process information outside your province, state or country, including in Canada and the United States and other countries where the relevant providers operate. Information can be subject to the laws and lawful access demands of those countries. We do not promise Canadian-only storage. Where transfer safeguards are legally required, the applicable safeguards must cover the relevant processing; contact us for information about the providers, locations and safeguards applicable to your data.

11. Your choices and requests

You can update available profile fields, manage notification and integration settings, and use available account export and closure tools. Self-service exports are not necessarily a complete response to a legal access request: contact us for additional information, including information relating to an inquiry without an account. You may request access, correction, deletion or withdrawal of consent, subject to applicable law and permitted exceptions. Withdrawal does not invalidate earlier lawful processing, and some requested features cannot operate without the necessary information.

Email privacy@heyoperator.ai with the nature of your request and enough information to locate the relevant account or interaction. Do not include passwords, full payment-card details or unnecessary identity documents. We may take proportionate steps to verify identity and an authorized agent’s authority. We will respond within the period required by applicable law, explain any lawful refusal or extension, and provide applicable review or appeal options. We will not unlawfully discriminate or retaliate against you for exercising a privacy right.

12. Regional rights

Canada: Depending on the applicable federal or provincial law, you may request access and correction, withdraw consent subject to legal or contractual restrictions, and challenge our handling of information. You may complain to the Office of the Privacy Commissioner of Canada or the appropriate provincial privacy regulator, including the Office of the Information and Privacy Commissioner for British Columbia. You do not have to give up a statutory complaint right to use our internal process.

United States: Where a state privacy law applies to Operator and your information, rights may include knowing and accessing the categories and specific information collected, obtaining a portable copy, correction, deletion, and opting out of sale, sharing for cross-context behavioral advertising, targeted advertising or certain profiling. California residents may also have rights to limit qualifying uses of sensitive information. The categories, sources, purposes and recipients are described above. We do not exchange personal information for money; whether a particular analytics disclosure is regulated as a sale or sharing depends on the applicable law and provider arrangement. Email our Privacy Contact to exercise applicable rights or submit a request through an authorized agent. To appeal a denial where that right applies, reply to the decision or send a new email explaining the request and why you seek review; we will explain the outcome and any available regulatory complaint route. We honor legally required opt-out preference signals for processing to which those obligations apply.

European Economic Area, United Kingdom and Switzerland: Where the relevant data-protection law applies, you may have rights to access, rectification, erasure, restriction, portability, objection and withdrawal of consent, and to complain to your local supervisory authority. For processing we determine, the relevant grounds are performance of a contract or requested pre-contract steps for necessary account and service delivery; legal obligations for required records and lawful requests; legitimate interests in securing, supporting and improving the service where those interests are not overridden by your rights; and consent where required for optional measurement, communications or sensitive processing. These grounds are purpose-specific, not a blanket authorization for every use. Where we process for a merchant, the merchant determines the applicable basis. You may request human review and contest an automated outcome where the law provides that right. Contact us for details of the international-transfer mechanism applicable to your information. These provisions do not represent that every feature is available or approved in every country.

13. Children

Operator accounts are intended for adults able to enter the applicable agreement. The service is not directed to children under 13. We do not knowingly solicit their personal information. A merchant offering age-restricted services must apply its own age and guardian-consent requirements. If you believe a child’s information has been supplied without appropriate authority, contact us so we can investigate and take appropriate action.

14. Changes and contact

We will update the date when this policy changes. For material changes, we will provide additional notice appropriate to the change and obtain consent where required before using information for a new purpose. A policy update does not remove rights provided by applicable law.

Privacy requests and complaints: privacy@heyoperator.ai
General support: hello@heyoperator.ai