Privacy policy

The InsertChat Google Calendar add-on receives your Google account identifier, your email address when shared by Google, and identifiers for the event you open. We store the account-to-workspace and receptionist connection and use event identifiers to show matching InsertChat appointment details in the Calendar sidebar.

Connecting a calendar for background booking is a separate authorization through Composio, our integration provider. This connection lets InsertChat access availability and create, update, or cancel appointments for the booking features you enable. Composio processes the connection credentials and Calendar requests on our behalf. Calendar information may be processed by the AI service providers described below when needed to carry out your requested booking features.

In Docs, Slides and Drive, importing a file explicitly sends its identifier, title and selected text, including presentation speaker notes, to InsertChat. We store this content as knowledge for the receptionist you connect. Knowledge content may be processed by the AI service providers described below to create searchable embeddings and answer your requested business questions. Reimporting a changed file updates its existing knowledge source.

The Sheets add-on writes the contacts and bookings you export into add-on-owned spreadsheet tabs. The Forms add-on sends the enquiry fields you map, such as name, email, phone and message, with form and response identifiers to create and deduplicate receptionist contacts. Form delivery runs only after you enable the add-on's submission trigger; disabling it removes that trigger. Existing form triggers stay bound to the receptionist selected when you enabled them.

When you connect Gmail to InsertChat Inbox, we access mailbox identity, messages, threads, attachments and history to synchronize your business inbox, show conversations, and prepare requested replies. We send email when you choose Send or enable reviewed automatic replies for that mailbox. Mailbox data is stored in your InsertChat workspace and may be processed by the AI service providers described below to carry out these inbox features. Gmail OAuth credentials are encrypted on the server. Drive access credentials use an encrypted, short-lived browser session to read files you explicitly open.

Google user data is used for these account-linking, appointment, receptionist knowledge, contact export, enquiry and Inbox features, not for advertising, sale, or training generalized AI models. InsertChat's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

To remove the Calendar sidebar connection, choose Disconnect in the InsertChat add-on. To stop background Calendar access, disconnect the Calendar integration in InsertChat. To stop Gmail synchronization and sending, disconnect that mailbox in InsertChat. You can also revoke Google access through Google Account connections. Previously imported messages, knowledge, contact, booking and connection records remain subject to the retention policy below; contact legal@insertchat.com to request deletion of your personal data.

If you agree to receive text messages (SMS or RCS) from InsertChat, we use your mobile number only to send the messages you asked for, such as answers to your questions, requested information or links, and appointment confirmations and reminders. Message frequency varies. Message and data rates may apply.

• No sharing for marketing: Mobile information will not be sold or shared with third parties or affiliates for marketing or promotional purposes.
• Opt-in data stays with us: Text messaging originator opt-in data and consent are not shared with any third parties, except the messaging providers that deliver the texts.
• Opting out: Reply STOP to any message to stop receiving texts, or HELP for help. You can also contact us through our contact page.

• No Sale of Personal Data: We do not sell or rent customer or visitor personal data.
• Transparent Processing: We disclose the service providers and third-party AI systems used to deliver requested features.
• Robust Security Measures: We use encryption, access controls, monitoring, and contractual protections for service providers.

We collect data to provide, improve, and personalize our services when you:

• Visit our website at https://insertchat.com or associated sites.
• Engage with us through sales, marketing, or events.
• Participate in activities on our Services.

Personal Data Provided by You:

• Voluntary Information: Includes email addresses, passwords, and payment data (processed by Stripe, see Stripe Privacy Policy).
• Account and Authentication Data: Necessary for account creation, access, and maintenance.

Automatically Collected Data:

• Technical and Usage Information: Includes IP addresses, browser details, operating systems, usage data, and interaction logs. This data is collected primarily for security, analytics, and service improvement.

We process your data under the following legal bases, compliant with the GDPR and UK GDPR:

• Consent: Where you have provided explicit consent.
• Contractual Necessity: To fulfill our contractual obligations or pre-contractual requests.
• Legal Obligations: To comply with legal requirements.
• Legitimate Interests: To support our business interests in a manner that is not overridden by your rights.

• Account Creation and Management: To facilitate account creation, login, and maintain your account in working order.
• Service Delivery: To provide and improve the services you request, such as responding to your inquiries and providing support.
• Administrative Communications: To send you important updates and information about our products, services, terms, and policies.
• Security and Fraud Prevention: To maintain the security and integrity of our Services and protect against unauthorized access.
• Legal Compliance: To comply with applicable legal obligations and regulatory requirements.

We retain data only as long as necessary to fulfill the purposes outlined in this notice, or as required by law. Specific retention periods are determined based on criteria such as legal obligations, business needs, and data minimization principles. For example:

• Account Data: Retained as long as you have an account with us.
• Payment Data: Retained in accordance with accounting and tax compliance requirements.

When data is no longer needed, it will be securely deleted or anonymized.

We share data only as needed to operate the service or as required by law:

• Third-party AI providers: When you enable and use AI features, prompts, conversations, uploaded files, knowledge sources, and related account or visitor data may be processed to carry out your requested features. Core receptionist replies and internal text-processing workloads use OpenAI and Anthropic models through Vercel AI Gateway. Google models may process supported image and speech features. Gateway requests require providers that do not train on prompt data when using Gateway-managed credentials; workspace-provided provider credentials remain subject to the workspace owner's provider agreement. InsertChat does not use DeepSeek models or the DeepSeek API. Requests targeting DeepSeek models are blocked before dispatch, including with workspace-provided AI Gateway keys. Google API user data is never sent to DeepSeek. Specialist processing such as reranking, transcription, document extraction, image, audio, or video generation may use Cohere, Groq, Mistral AI, OpenAI, Google, or fal.ai.
• Other service providers: We use vetted providers for cloud hosting and delivery, security, email, analytics and diagnostics, payments through Stripe, and telephony through Telnyx. They process data on our behalf under contractual confidentiality and data-protection obligations.
• Business Transfers: In the event of a merger, acquisition, financing, reorganization, or asset sale, data may be transferred subject to appropriate confidentiality and protection obligations.

InsertChat does not sell personal data or permit third-party foundation-model providers to train their models using customer content submitted through our service.

We implement comprehensive technical and organizational measures to secure your data, including:

• Industry-leading encryption for data in transit and at rest.
• Regular security audits and continuous monitoring.
• Stringent access controls to ensure only authorized personnel have access to data.

Despite our best efforts, no method of electronic transmission or storage is completely secure. Therefore, while we strive to protect your data, we cannot guarantee its absolute security.

Depending on your location, you have various rights regarding your personal data, including:

• Right to Access: To request access to your personal data.
• Right to Rectification and Erasure: To correct or delete your data.
• Right to Restrict Processing and Object: To restrict or object to the processing of your data.
• Right to Data Portability: To request a copy of your data in a portable format.

15.1 California Residents

California Civil Code Section 1798.83 (Shine The Light law) allows California residents to request information about personal data disclosures for direct marketing purposes. California residents can also request the removal of unwanted data posted publicly. Please visit our contact page to exercise these rights.

15.2 Virginia Residents

Under the Virginia Consumer Data Protection Act (CDPA), Virginia residents have specific rights related to accessing, correcting, deleting, and opting out of the processing of their personal data. To exercise these rights, please use our contact page.