Privacy policy

Two different relationships

This matters more than anything else on the page, because it decides who you should ask about your data.

• When you deal with us directly — you visit this site, email us, or become a client — we decide how your information is used. Ask us.
• When you call a business that uses our assistant, we handle your information on that business’s behalf and on their instructions. They decide what is collected and how long it is kept. Ask them first; we will help them answer you.

What we collect

From this website

Nothing automatically. There is no analytics, no tracking pixel and no advertising on this site, and it sets no cookies. If you email us, we hold that email and whatever you put in it.

From a call handled by the assistant

Collected on behalf of the business you called:

• your phone number, from caller ID
• your name, and your email address if you give one
• what you booked, with whom, and when
• a recording and a transcript of the call
• whether you agreed to receive text messages, and the wording you were read

From our clients

Business contact details, the details of the service they run, and the email addresses of the people they invite into their dashboard.

Where it goes, and who else handles it

We build on other companies’ infrastructure, so your information passes through theirs. The current list:

Vapi

Runs the voice assistant. Holds call recordings and transcripts, and uses model and speech providers of its own to understand and speak.

n8n Cloud

Orchestrates what happens during a call. Hosted in the EU — see below.

Supabase

Our database, hosted in the United States. Holds call records, transcripts and booking details.

Google

Calendar and email. Appointments are kept in Google Calendar and confirmations are sent by email. See Google Calendar, in detail below for whose account those calendars are on and what we can see.

Twilio

Delivers text messages.

Resend

Sends dashboard sign-in emails.

Vercel

Hosts this website and the client dashboard.

Google Calendar, in detail

Appointments have to live somewhere a salon can see them, and that place is Google Calendar. Because this is the part of the system that touches another company’s account, it gets its own section rather than one line in the list above.

The business connects its own Google account. A salon signs in to Google once, from their dashboard, and grants us a specific set of permissions. Nothing happens to their calendar until they do, and they can withdraw it at any time.

Each person on the team gets a calendar for their appointments. The business chooses, per person, between a new calendar we create for them, or a calendar they already use. Which permissions we ask for depends on that choice.

What every connection asks for

Which Google account this is

openid and userinfo.email — these do not sign anyone in; the dashboard has its own login. They are the only way for us to learn which Google account was just connected, so we can show it back to the business in full, permanently.

Make and manage the calendars we create

calendar.app.created — lets us create a calendar for a staff member, put appointments on it, and read what is on it, including a day marked off. On its own it does not let us see or change anything on any other calendar.

See when someone is busy

calendar.freebusy — lets us ask whether a time is taken. It returns busy and free periods only: not the titles of appointments, not who they are with, not any detail of them.

Only if the business uses calendars it already has

These two are asked for separately, at the moment a business chooses to book into an existing calendar, and not before. A business that lets us create calendars is never asked for them.

List the calendars, to choose from

calendar.calendarlist.readonly — lets us show the business the names of the calendars on their account and whether each one can be booked into, so they can say “this one is Amy’s”. We read the list when they open that choice; we keep only the calendar they pick and its name.

Book into the calendar they chose

calendar.events — lets us add, move and cancel the appointments the assistant books on that calendar, and see when the person is busy or off on it. Google grants this permission for every calendar the account can edit, which is why the limits below matter.

We ask for these and nothing wider. We do not request permission to read your mail, your contacts or your files.

What Google enforces for us

On a calendar we created, the walls are Google’s. calendar.app.created reaches only calendars our app made, and that holds even if our own software is wrong.

On any other calendar a business points us at only to check availability, we can see busy and free. Not titles, not who an appointment is with — calendar.freebusy gives nothing more.

What our own software enforces

On a calendar a business already had and chose for bookings, calendar.events would technically allow more. These limits are enforced by our software, not by Google. We would rather be clear about which is which than let one borrow the other’s credibility.

• We only ever change or cancel appointments we booked. Every appointment we create carries a hidden marker. Our calendar service refuses to move or delete any event without it, whatever the rest of the system asks for — so a personal appointment on the same calendar cannot be touched, even by a bug.
• We only use the calendars the business chose. One per person, picked in their dashboard. If they later switch a person to a different calendar, we keep looking after the appointments we already booked on the old one, and nothing else on it.
• We read timing, not content. For other events on a chosen calendar we read when something starts, when it ends, whether it is all-day, whether it is marked free, and whether an invitation was declined. Titles, guests and locations of other events are never requested from Google. Before changing an appointment we check its hidden marker, and if it is not one of ours we stop and discard what we read. Nothing about other events is stored, given to the assistant or written to our logs.
• The assistant never repeats what it saw. It says “she’s not available Thursday”. It does not say why, because it was not given why.

What we store from Google: the identifier of each calendar we create or the business chose, that calendar’s name as the business saw it, the identifier of each appointment we write, and the token that lets us keep doing so, which is held encrypted and is never shown in the dashboard.

Disconnecting

A business can disconnect Google from their dashboard, or revoke our access from their own Google account settings, at any time and without asking us. Either one stops us immediately. The calendars and the appointments in them are theirs and stay on their account — they simply stop being updated by the assistant, which will no longer be able to take bookings.

What we will never do with Google data

New Day AI’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms, that means:

• We use it only to run the features you can see — booking, moving and cancelling appointments, and knowing when someone is free. When the assistant offers you a time, the free slots it found are part of what it is given in order to say them out loud. No other calendar information is.
• We do not sell it, and we do not transfer it to advertising platforms or data brokers.
• We do not use it to target ads at you, ever.
• We do not use it to train machine-learning models, ours or anyone else’s.
• No person at New Day AI reads it, except where you have asked us to look at something, where we must to fix a security problem, or where the law requires it.

International transfer

Our processing infrastructure is located in both the United States and the European Union. In particular, the system that coordinates a call runs on servers in Stockholm, Sweden, while the assistant, the database, the calendar and the messaging provider are in the United States. Your information is therefore transferred between the EU and the US while a call is being handled.

We are telling you this specifically rather than in general terms because it is true and because a vague sentence would not be.

What we never do

• We do not sell your information.
• Mobile phone numbers and text-message consent are never sold or shared with third parties or affiliates for their own marketing or promotional purposes.
• We do not use call recordings or transcripts to advertise to you.

How long it is kept

Recordings

Held by our voice provider for a limited period — currently about two weeks — after which they are no longer retrievable.

Transcripts

Kept in our database for 90 days, so the business can look back at what was said on their phone line, then deleted automatically. The summary email the business receives after a call includes the transcript unless they have asked for it to be left out; that copy is in their inbox, and they keep it for as long as they choose.

Call records

The record that a call happened — its time, length, outcome, the number it came from, and what it cost — is kept for as long as the business’s account is active. It contains nothing that was said on the call, and it is how the business sees its call history and how we bill accurately.

Appointments

Live in the business’s own calendar and are kept for as long as they keep them. That is their record, not ours.

Consent records

Retained while the relevant appointment record exists, because we have to be able to show that consent was given.

Your choices

You can decline text messages at the moment you are asked, or reply STOP at any time — see our SMS consent and opt-in disclosure. Declining never affects your appointment. Giving an email address is optional and a booking works without one.

To see, correct or delete information held about you, contact the business you called. If you cannot reach them, or you dealt with us directly, contact us at info@newdaycreative.co and we will respond.

Children

This service is for businesses and their customers, and is not directed at children. We do not knowingly collect information from anyone under 13.

Security

Access to a business’s records is enforced in the database itself, so one client cannot read another’s. Sign-in to the dashboard is by emailed link and by invitation only — nobody can create their own account. No system is perfectly secure, and we will tell affected clients promptly if something goes wrong.

Changes

We will update this page when the facts change, with a revised date at the top. Where a change is significant we will tell our clients directly rather than relying on you noticing.