Privacy Policy

Information we collect

We collect information you provide directly, information collected automatically, and information from third parties in connection with our Services.

Information you provide directly:

• Contact information — name, email address, phone number, and business name when you fill out a contact form, book a discovery call, or sign up for a plan.
• Account information — login credentials and business profile details when you access the Solys AI client dashboard.
• Business configuration — the business information, FAQs, and settings you provide to configure your AI receptionist.
• Communications — messages you send us via email, contact forms, or support channels.

Information collected automatically:

• Usage data — how you interact with our platform, features used, and session activity.
• Device and browser information — IP address, browser type, operating system, and referring URLs.
• Cookies and similar technologies — as described in Section 8 below.

Information related to end-customers (your patients or clients):

When you deploy Solys AI as your AI receptionist, your patients or customers may interact with the system. We process their conversation data, contact details, and booking information on your behalf as a data processor. You are the data controller for this information.

How we use your information

We use the information we collect to:

• Provide, operate, and improve the Solys AI platform and Services
• Set up and configure your AI receptionist according to your business requirements
• Process appointments, leads, and follow-up sequences on your behalf
• Communicate with you about your account, updates, and support
• Send transactional emails (booking confirmations, notifications) as part of the Services
• Analyse platform usage to improve performance and develop new features
• Comply with legal obligations and enforce our Terms of Service

We do not sell your personal information or use it for third-party advertising.

Information shared with third parties

We share information only as necessary to provide the Services:

• Infrastructure providers — Supabase (database), Railway (hosting), and Vercel (frontend hosting) process data under their own privacy policies and data processing agreements.
• AI processing — Anthropic Claude processes conversation content to generate AI responses. Anthropic's data handling is governed by their usage policy.
• Communication services — Resend (email delivery) and Meta Cloud API (WhatsApp) are used to send messages on your behalf. Twilio is used for voice services on Pro and Scale plans.
• Calendar integration — Google Calendar receives booking data when you connect your calendar through the platform.
• Legal requirements — We may disclose information when required by law, court order, or to protect the rights and safety of Solys AI or its users.

We do not sell, rent, or share your personal data with third parties for their own marketing purposes.

Google API Services User Data — Limited Use

Solys AI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google user data obtained via these APIs is used solely to provide and improve these user-facing features. Any artificial-intelligence or machine-learning processing of this data — such as generating replies with Anthropic's Claude API, or converting text to and from speech — is performed only by service providers whose terms prohibit using it to train generalized models. Neither Solys AI nor any of our service providers uses Google user data to train generalized artificial-intelligence or machine-learning models. We do not sell Google user data, and we transfer it only as necessary to provide or improve these features, for security purposes, or to comply with applicable law. Humans do not read Google user data unless we have your consent for specific messages, it is necessary for security or to comply with the law, or the data has been aggregated and anonymized.

AI agent interactions

When your patients or customers interact with your Solys AI receptionist, their conversations are processed to generate responses, score leads, trigger follow-up sequences, and book appointments. These conversations are stored in your client dashboard and are accessible to you.

Conversation data is used to:

• Generate contextual AI responses in real time
• Build conversation history so the agent remembers returning patients across channels
• Score leads based on intent signals within the conversation
• Populate your CRM dashboard with lead and booking data

Conversation data is never sold or shared with third parties for any purpose beyond delivering the Services. You retain ownership of your customers' data. You are responsible for ensuring your use of the platform complies with applicable privacy laws in your jurisdiction.

Data storage and security

Your data is stored on Supabase (PostgreSQL) hosted on secure cloud infrastructure. All sensitive credentials — API keys, OAuth tokens, and access credentials — are encrypted at rest using AES-256 symmetric encryption (Fernet) before being stored.

We implement the following security measures:

• Encryption at rest for all sensitive credential fields
• HTTPS/TLS encryption for all data in transit
• Multi-factor authentication (MFA) required for all client dashboard access
• JWT-based authentication with session management and concurrent session limits
• CSRF protection on all state-changing API requests
• HMAC signature verification on all inbound webhook payloads
• Role-based access control — each client can only access their own data

No security system is perfect. While we take reasonable steps to protect your information, we cannot guarantee absolute security. In the event of a data breach that affects your personal information, we will notify you as required by applicable law.

Data retention

We retain your data for as long as your account is active or as needed to provide the Services. Specifically:

• Account data — retained for the duration of your subscription and deleted within 90 days of account closure upon request.
• Conversation and lead data — retained for the duration of your subscription. You may delete individual records from your CRM dashboard at any time.
• Billing information — retained as required for tax and accounting purposes, typically 7 years.
• Session logs — active sessions expire after 24 hours. Audit logs are retained for 12 months.

To request deletion of your account and associated data, contact us at privacy@solysai.com.

Your rights

You have the following rights regarding your personal information:

• Access — request a copy of the personal information we hold about you.
• Correction — request that we correct inaccurate or incomplete information.
• Deletion — request that we delete your personal information, subject to legal retention requirements.
• Portability — request your data in a structured, machine-readable format.
• Objection — object to our processing of your information in certain circumstances.
• Withdrawal of consent — where processing is based on consent, you may withdraw it at any time without affecting prior processing.

To exercise any of these rights, contact us at privacy@solysai.com. We will respond within 30 days.

Cookies

We use only essential cookies necessary for the platform to function. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

• Authentication cookies — used to maintain your logged-in session in the client dashboard. These expire when you log out or after 24 hours of inactivity.
• Preference cookies — used to remember interface preferences within your session.

You can control cookie settings through your browser. Disabling essential cookies may prevent the platform from functioning correctly.

Children's privacy

The Solys AI platform is a business-to-business service intended for use by adults operating commercial businesses. We do not knowingly collect personal information from children under the age of 18. If you believe a child has provided us with personal information, please contact us at privacy@solysai.com and we will delete it promptly.

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (to the address associated with your account) and update the "Last updated" date at the top of this page. Your continued use of the Services after changes are posted constitutes your acceptance of the updated policy.

We encourage you to review this policy periodically.

Contact

For any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

This policy is also available at solysai.com/privacy. For our Terms of Service, visit solysai.com/terms.