Legal

Privacy Policy

Last updated: 10 August 2026

This policy explains what personal data Booking Assistant processes, why, how it is stored, who it is shared with, and how you can access or remove it. It covers our voice-AI platform at voice.lenacall.ch and, in particular, the calendar booking integration that connects a business’s Google or Microsoft calendar to its AI voice agent, the mailbox integration that lets a business’s AI assistant read and answer the email sent to its own Gmail or Outlook mailbox, and the regulatory identity documents some countries require before a phone number can be activated (Section 7).

1. Who we are

Booking Assistant (“Booking Assistant”, “we”, “us”) is a white-label voice-AI reception platform hosted at voice.lenacall.ch, operated by LenaCall. For the calendar data described below, LenaCall acts as a data processor on behalf of the connected business (the “customer”), which is the controller of its own calendar. You can reach us at your LenaCall contact.

2A. The calendar integration — what we access and why

When a business connects its calendar, its AI voice agent can check real availability and manage appointment events during phone calls, so callers can be booked, rescheduled, or cancelled without a human picking up. To do this we request only the narrowest calendar scopes each provider offers, plus a basic sign-in scope so your dashboard can show which account is connected.

The calendar integration and the mailbox integration described in Section 2B are entirely separate. They use different applications, are connected separately, and are revoked separately: connecting a calendar gives us no access to your email or mailbox contents, and connecting a mailbox gives us no access to your calendar. Neither gives us access to your contacts, your files, or any other data.

Google Calendar

• Calendar scopes requested: https://www.googleapis.com/auth/calendar.events (create, read, update, and delete booking events) and https://www.googleapis.com/auth/calendar.freebusy (read free/busy availability only).
• Sign-in scopes requested: openid and email — Google’s standard, non-sensitive sign-in scopes, used only to obtain the connected account’s email address so your dashboard can show which calendar is linked. They give us no access to your email messages.
• Why: to read your free/busy availability and to create, update (reschedule), and cancel booking events on your calendar, on the connected business’s behalf. The free/busy scope exposes only busy/free time blocks, never the contents of your other events.
• During phone calls the AI agent uses only your free/busy availability to find open slots, plus the booking events it creates or changes — it never reads the contents of your other events. Separately, when you open the calendar view inside your own dashboard, we fetch your events’ times, titles, and locations from the connected calendar solely to display your calendar back to you; we do not store or analyse them, and this data is never used to train any model.

Microsoft Outlook / Microsoft 365

• Calendar scope requested: Calendars.ReadWrite (delegated) plus offline_access.
• Sign-in scopes requested: openid, profile, and email — standard sign-in scopes used only to obtain the connected account’s email address for display; they give no access to your mailbox.
• Why: the same purpose — read availability and create, reschedule, and cancel booking events on the connected business’s behalf.

2B. The mailbox integration — what we access and why

A business can connect its own mailbox so that its AI assistant answers the email its clients send it — the same job the assistant does on the phone, in writing. This is a separate, optional integration, connected from Integrations → Messaging channels, and it uses a different application from the calendar integration above. A business that never connects a mailbox is never asked for any mail permission.

What happens, precisely. When a new message arrives in the connected mailbox’s inbox, the provider notifies us that something changed. We then fetch that message only — its headers and its body — remove the quoted history and signature beneath it, and pass the remaining text to the AI assistant, which composes a reply and sends it from the same mailbox, in the same conversation thread.

• Only mail that arrives after you connect. We record a starting point at the moment the mailbox is connected and read forward from it. We do not read, index, export, or scan the mail already in the mailbox, and there is no bulk access to it at any time.
• Only the inbox. The notification we register is restricted to inbox messages, so mail in Sent, Drafts, and other folders is not delivered to us.
• We do not send unsolicited mail. Every message we send is a reply, in thread, to a message that arrived in the connected mailbox. We never write to an address that has not written first, and we never send on a schedule. Automated messages and bounces are detected and left unanswered.
• Attachments are not downloaded in either direction.

Gmail

• Mail scopes requested: https://www.googleapis.com/auth/gmail.readonly (read the message that just arrived, so the assistant can answer it) and https://www.googleapis.com/auth/gmail.send (send the reply from your mailbox).
• Sign-in scopes requested: openid and email — used only to read the connected mailbox’s own address, which is how we route mail arriving at it to the right business account and show you which mailbox is linked.
• Why a narrower scope is not enough: Google’s metadata-only mail scope returns headers and labels but not the body of a message, and an assistant that cannot read the question cannot answer it. The send scope is already the narrowest Google offers for sending: it permits sending only, and grants no ability to read, modify, or delete anything in the mailbox.
• This is not the calendar application. The Gmail permissions above are requested by a separate application from the one used for Google Calendar. Granting one does not grant the other, and revoking one does not revoke the other.

Microsoft Outlook mail

• Mail scopes requested: Mail.Read and Mail.Send (delegated), plus offline_access.
• Why: the same purpose — read the message that just arrived and send the assistant’s reply from the connected mailbox. As with Gmail, this is a separate application from the Outlook calendar integration.

What we store from your mail

• The conversation. The text of the message that arrived and the reply the assistant sent are stored as a conversation thread in the business’s own dashboard, so the business has a record of what its assistant said on its behalf — the same record it keeps for a phone call or a social-media message.
• A position marker — a provider-issued identifier recording how far we have read, so the same message is never answered twice and mail that arrived before you connected is never read.
• The mailbox address and an encrypted access credential, handled exactly as described in Section 3.
• We do not store copies of your other mail, your folder structure, your contact list, or your attachments.

3. How calendar tokens are stored and protected

• Refresh tokens are envelope-encrypted at rest. The long-lived OAuth refresh token that lets the agent act while a business is not online is encrypted before it is written to our database, using the same encryption rails we use for other tenant secrets. Plaintext tokens are never stored.
• Access tokens are short-lived and never persisted. Each time the agent needs to read availability or write an event, a fresh, short-lived access token is minted on demand from the encrypted refresh token and discarded after use.
• Per-tenant isolation. Each business’s connection is stored under its own tenant and protected by database row-level security, so one business can never see or use another’s calendar connection.
• The agent runtime never handles your tokens. Tokens are decrypted only server-side, in the single booking handler that talks to Google/Microsoft; the voice/telephony layer never receives them.

4. Sharing, AI processing, and subprocessors

We do not sell your data and we do not use it for advertising. For the calendar integration, calendar data flows only between you, the connected business, the calendar provider you chose, and the AI model that runs the voice agent:

• Google LLC — when you connect a Google calendar.
• Microsoft Corporation — when you connect a Microsoft/Outlook calendar.
• Google Cloud (Vertex AI) — the AI voice agent runs on Google’s Gemini models hosted on Google Cloud Vertex AI, in the European Union. During a call, the availability the agent offers and the appointment details a caller provides are processed by the model to conduct the conversation.

AI and your data. The AI that conducts the call runs on Google Cloud Vertex AI, and Google is the only AI provider that ever receives Google Workspace data — calendar or Gmail message content — or Microsoft calendar or mailbox data. We do not send any of it to any other AI or machine-learning service. We use one further AI subprocessor for a single, narrower purpose — ElevenLabs transcribes the audio of a call after that call has ended, and receives nothing else; it is described in its own section below. Under the Vertex AI terms, Google does not use your prompts, calendar data, mail content, or the model’s outputs to train or improve its foundation models. Our use of data received from Google APIs, including any use by AI features, adheres to the Google API Services User Data Policy and its Limited Use requirements, and is never used to develop, improve, or train generalized or foundational AI/ML models.

Beyond the providers listed above we use no additional third-party subprocessors for calendar data. We may disclose data if legally required, or to protect the security and integrity of the service.

Telnyx — telephony and regulatory number registration

Telnyx is the telephony carrier behind the platform’s phone numbers. It is a subprocessor for two separate purposes:

• Telephony. Calls to and from your number are carried by Telnyx, so the call audio and the call’s technical details — the numbers involved, the time, the duration — pass through Telnyx for the call to happen at all.
• Regulatory identity verification. Many countries will not allow a phone number to be activated until the carrier holds identity and address evidence for the business that will use it. Where that applies, the documents and details described in Section 7 are filed with Telnyx, which keeps them as part of the regulatory record for that number.

We do not give Telnyx access to your calendar or to the tokens that connect it, and the documents described in Section 7 are not sent to any AI model.

ElevenLabs — transcription of call recordings

Where a business has call recording switched on, the recording is transcribed after the call ends so that the business has an accurate written record of what was said. That transcription is performed by ElevenLabs, using their speech-to-text service.

• What they receive. The audio of the completed call, and nothing else. ElevenLabs does not receive your Google Workspace or Microsoft calendar data, your calendar tokens, your account details, or the regulatory identity documents described in Section 7.
• Why a second provider. The transcript is used to check the AI agent’s own behaviour — for example, whether a request a caller made was actually recorded for the business. A transcript produced by the same AI provider that conducted the call cannot serve as an independent check of it.
• Where it is processed. ElevenLabs is a provider based in the United States, so this audio may be processed outside the European Economic Area, under the safeguards in their data processing terms. This is different from the voice agent itself, which runs on Google Cloud Vertex AI in the European Union.

If you would prefer that call audio is not sent for transcription, call recording can be switched off for your business, and no recording is made or transcribed. Ask the provider who set your service up, or contact us at your LenaCall contact.

5. Retention

A calendar or mailbox connection and its encrypted refresh token are kept only while the connection is active. When you disconnect, or when a connection is revoked or its business account is closed, the stored refresh token is deleted or permanently invalidated. Booking events that were already written to your calendar remain on your calendar and are managed by you there.

Mail conversations. The message text and the assistant’s reply are kept as a conversation thread in the business’s dashboard, under that business’s own retention settings, for the same period as its other conversation records. Disconnecting the mailbox stops any further mail being read or sent; the mail itself stays in your mailbox throughout and is never removed or altered by us.

Regulatory identity documents. There is no retention period for the documents on our side because we do not keep them (Section 7). What we keep is the reference to each filing, for as long as the phone number it supports is in service — it is the only record of which regulatory filing backs which number. The documents themselves are retained by Telnyx as part of the regulatory record for that number: that retention is the carrier’s, tied to the record and to the rules of the country’s regulator, and is not a period we set or can state on the carrier’s behalf. Deletion at the carrier can be requested — see Section 7.

6. How to revoke access

You can disconnect at any time. Disconnecting inside Booking Assistant immediately stops our use of your calendar or mailbox and permanently invalidates the token we hold. This does not by itself revoke the access you granted on Google’s or Microsoft’s side, so for full revocation you should also remove Booking Assistant’s access in that provider’s own account settings.

⚠️ The calendar and the mailbox are separate grants on separate applications, so revoking one leaves the other in place. If you want both withdrawn, disconnect both — and at the provider, remove both entries.

• In Booking Assistant, for a calendar: open Integrations → Calendar in your dashboard and click Disconnect. We stop using the calendar and permanently invalidate the stored token; this removes our ability to act on your calendar but does not itself revoke the grant on the provider’s side.
• In Booking Assistant, for a mailbox: open Integrations → Messaging channels and click Disconnect on the Gmail or Outlook (email) card. We immediately stop reading the mailbox and stop sending any reply from it, and the stored credential is permanently invalidated.
• At Google: visit myaccount.google.com/permissions and remove Booking Assistant’s access.
• At Microsoft: visit account.microsoft.com/consent/manage and remove Booking Assistant’s access.

7. Other data we process

To run the platform we also process account and sign-in data (such as your email address and authentication codes), and operational records of calls handled by the voice agents (for example call metadata, transcripts, and appointment details captured during a call) on behalf of the business you interact with. This data is used to provide and secure the service, not for advertising, and is isolated per tenant.

Regulatory identity documents for phone numbers

Telecoms regulators in many countries will not let a phone number be activated until the carrier holds evidence of who is going to use it. Where the country of the number requires it, the business buying the number — or the person authorised to act for it — is asked for some combination of:

• a company registration certificate;
• a copy of a passport or government-issued identity document belonging to the authorised representative, or to the end user of the number;
• proof of address — typically a recent utility bill or invoice, which some countries require to be no older than three months;
• details typed into a form: contact name, business name, contact phone number, the address the number is registered to, a company website, and a description of how the number will be used; and
• in a few countries, a registration form supplied by the regulator or the carrier that has to be printed, signed and scanned.

The list is set by each country’s regulator, and only what that list names is asked for. An identity document can carry more information than the check itself needs — a facial image, for example, which may be treated as a special category of personal data under Article 9 GDPR. It is transmitted for the sole purpose of the carrier’s and the regulator’s identity check. We do not read, extract, index or analyse its contents beyond confirming that the file really is the kind of document it claims to be, and it is never sent to any AI model.

We transmit these documents; we do not store them. An uploaded file passes through our server only to be forwarded to Telnyx in the same request. We do not keep it: it is not written to our database, our object storage or our backups, no copy remains once the transfer completes, and our platform offers no way for anyone — including our own staff and support — to view or download it afterwards. What we keep is a reference to it: the carrier’s document identifier, a SHA-256 checksum of the file, its type and size, the verification status the carrier reports, and the file’s name so we can show you which document you sent. Telnyx is the system of record for the documents and for the identity details filed alongside them; our database holds identifiers, not documents.

A filing is made on the Telnyx account of the provider that set your service up, so that provider can see it in their own carrier account. Telnyx is headquartered in the United States, so personal data in a regulatory filing may be processed outside the EEA. Email your LenaCall contact if you would like details of the safeguards that apply to that transfer.

Deleting a filing. To have a filing removed, contact us at your LenaCall contact or ask the provider who set your service up. We instruct the carrier to delete the regulatory record and then the documents filed under it, and we delete our own references to them. Deletion may not be possible while the filing is still supporting a phone number in service, or where the carrier is required to keep the regulatory record; in those cases we will tell you which applies rather than report a deletion that did not happen.

8. Data location and security

Data is stored on infrastructure operated for the platform, protected with encryption in transit, encryption of sensitive secrets at rest, and role-based, per-tenant access controls. We restrict access to the minimum staff needed to operate and support the service.

Regulatory identity documents are protected by not being kept. They are uploaded over an encrypted connection and forwarded to the carrier within the same request, so the only lasting record on our side is the reference described in Section 7. In addition, an upload is capped at 10 MB and limited to a short list of document formats (PDF, PNG, JPEG, DOCX, XLSX), each checked against the file’s actual contents rather than the type it claims to be; and the credentials used to reach the carrier are decrypted at a single server-side point that first verifies the requesting account is entitled to them.

9. Your rights

Subject to applicable law (including the EU/Lithuanian GDPR), you may request access to, correction of, or deletion of your personal data, and you may object to or restrict certain processing. For calendar data, the fastest route is to disconnect (Section 6). For documents filed with the telephony carrier, use the deletion route in Section 7. For anything else, contact your LenaCall contact. You also have the right to lodge a complaint with your local data protection authority.

10. Changes to this policy

We may update this policy as the product evolves. Material changes will be reflected here with a new “last updated” date.

11. Contact

Questions about this policy or your data? Email your LenaCall contact.