Privacy notice

Effective date: [effective date: to be set]. Version provisional-0.1.

Draft. Provisional draft provisional-0.1, not yet reviewed by a lawyer, not legal advice. For testing with the founders' numbers only.

Who we are

Rosie is an automated AI booking assistant run by Rosfield. You may book with a business through Rosie by text, the booking page or your own AI assistant. Rosfield is paid by the business, never by you.

Rosfield is run by [legal name of the person or company: to be set].

What we collect, and why

Your name, mobile number, and email if you give one. Why: to make and manage your booking and reach you.
The booking: the service, date, time, place, price, and what you agreed to, with the words we showed you.
Your messages with Rosie. Why: to answer you and keep a record of what you agreed.
Payment status. Card and bank details go to Stripe, never to us.
Codes and proof that a request came from you, and the record of your yes to texts, plans and fees.
The visit check: the day after a booking with no check-in, we may ask once if your visit happened. Why: to check the fee count and flag disputes. We use it for nothing else.
Private details (see Sensitive details below) only on the secure page.
For business owners and staff who connect a calendar: busy times only, as set out in Google calendar data.

The business you booked. It sees your booking. It uses your data only for itself.
Service providers that run Rosie, each for its own job: Stripe (payments), Cloudflare (hosting and storage), Anthropic (the AI model that writes Rosie's replies), Linq (iMessage), Resend (email), [map and distance provider: not yet chosen], [owner ID and face check provider: not yet chosen], and [SMS provider: not yet chosen] (text messages).
We do not sell your data, share it for ads, use it to train AI, or join it across businesses. We pass a court order or police request to the business where the law allows.

Text messages and your mobile number

We do not share or sell your mobile number or your text-message opt-in data and consent to any third party or affiliate for marketing or promotional purposes. The categories of sharing above exclude text-message opt-in data and consent: this information is not shared with any third party. The providers that carry Rosie's messages (Linq for iMessage and the SMS provider) receive your number only to deliver Rosie's messages to you.

Rosie texts only a number given for a booking, a number that joined a business's team, or a number that said yes on a forwarded link. Reply STOP to stop Rosie's texts and HELP for help. Message frequency, rates and the rest are in the SMS terms.

Google calendar data

A business owner or staff member can connect a Google calendar so Rosie does not offer times when they are busy. This section covers the information Rosie receives from Google APIs.

What Rosie accesses

Free and busy times (https://www.googleapis.com/auth/calendar.freebusy): when you are busy, never what your events are. Rosie cannot see event titles, descriptions, guests or places.
Its own bookings calendar (https://www.googleapis.com/auth/calendar.app.created): Rosie creates one calendar called "Rosie bookings" and adds, moves and removes the bookings it makes there. It cannot read or change your other calendars.

How Rosie uses it

To offer customers only times when you are free, together with your hours and the bookings Rosie holds.
To keep the bookings Rosie makes for you visible in your own Google calendar.

How it is stored and protected

The permission Google gives Rosie (a refresh token) is stored encrypted. The short-lived access tokens are never stored.
Data moves over encrypted connections and is held on Cloudflare's infrastructure.

Who it is shared with

Google calendar data is not sold, not shared for ads, not used to train AI models, and not transferred to anyone except as needed to run the calendar feature for you or to comply with the law. People at Rosfield do not read it, except with your permission, for security, or to comply with the law.

Limited Use

Rosfield's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Removing access

You can remove Rosie's access at any time in your Google Account settings, or ask Rosie in the chat. Once access is removed, Rosie can no longer read your busy times or write to its bookings calendar, and it stops offering times for you until you connect again. Bookings already made stay. To ask that we delete the stored permission and related records, write to [privacy email: to be set].

Microsoft calendars work the same way: Rosie reads only the start, end and busy status of events and writes only its own bookings. Apple Calendar gets a one-way feed of Rosie's bookings and sends nothing back.

How long we keep it

Payments, fee records, your consent and terms records, and the summaries you said yes to: 7 years, or longer where the trade's rules say.
Your "don't text me" record and the proof of each yes: kept, so we can honor them.
Your messages' text: [period not yet set].
Google calendar data: the busy times Rosie keeps to show open times are refreshed each time Rosie checks your calendar and are cleared when you disconnect the calendar. Longest time kept: [period: to be set]. The permission Google gave Rosie (a refresh token) is deleted when you remove Rosie's access or ask us to delete it.
The face scan a business owner gives to prove who they are: deleted within 30 days. Gate codes: after the last visit. Licence photos: [period not yet set].
Under 13: nothing is kept, unless there is danger.
Copies and deletes of other records follow your request (below).

Your choices and rights

Reply STOP to any text to stop Rosie's texts to that phone, for every business. Reply START to turn them back on.
Ask for a copy or deletion of your records, or a correction. We check it is you, then answer within 45 days (one 45-day extension, with the reason). At a health practice a copy is due within 30 days.
If you live in California or another state with a privacy law, you have rights to know, delete, correct and limit use of sensitive information. We do not sell or share your data for ads, so there is nothing to opt out of. We do not treat you differently for using these rights.
Some records cannot be erased: the "don't text me" record and the proof of each yes.
Washington: where health data is asked outside health care, we ask your yes to collect it and again to share it.

Children and teens

Rosie is not for children under 13. If someone under 13 books alone, Rosie stops, asks for a parent, and keeps nothing unless there is danger. Under 18 booking alone: a link goes to a parent. Where the law and the business allow, a teen may agree alone and the booking is private. Rosie never asks a child's exact age.

Sensitive details

Health, symptoms, a child's details, ID numbers, legal or immigration status, entry codes and money details beyond an amount are never put in a text or an email. They go on a secure page, and each view is logged. For sensitive work, texts say only "your visit", the business's display name, date, time and place.

The AI assistant

Rosie is an automated AI assistant, not a person. Ask "are you a person?" and it says no and offers one. Rosie's AI models do not see private answers kept on the secure page. If you type a private detail into the chat anyway, the AI model sees it once; it is not repeated and is deleted.

How to reach us

Privacy requests, questions and complaints: [privacy email: to be set]. Reply to any booking email to reach Rosie about that booking, or text HELP. [Postal address: to be set].