Privacy Policy

HeyLucy (“HeyLucy”, “we”, “us”) provides Lucy, an AI phone receptionist for businesses. HeyLucy is operated by its founder as a sole proprietorship based in Iowa, USA. This policy explains what information we collect, why, who we share it with, and the choices you have. Questions: support@heylucy.org.

Who this policy covers

• Business customers who create a HeyLucy account (“you”).
• Callers who phone a business that uses Lucy. For callers, the business is responsible for how it uses their information; we process it on the business’s behalf.
• Visitors to heylucy.org.

Information we collect

From business customers

• Account details: email address and password (stored only as a secure one-way hash).
• Your personal mobile number, used to send verification codes and reset a forgotten password.
• Business details you enter: business name, phone, address, hours, services, staff, FAQs, departments and settings.
• Billing status. Payments (card, digital wallets such as Apple Pay and Google Pay, and bank accounts) are handled by Stripe; we never see or store full card or bank account numbers.

From callers (on behalf of the business)

• Caller phone number, the name they give, the reason for the call and the outcome (for example, an appointment booked or a message taken).
• Appointment details: date, time, service and notes.
• What the caller says is converted to text so Lucy can respond. If a caller leaves a voicemail, the recording and its transcription are stored so the business can review it.

From Google Calendar (only if you connect it)

If you choose to connect Google Calendar, Lucy reads the start and end times of events in your primary calendar so she never books over them, and — if you turn on “Sync appointments” — the event titles and times so they appear on Lucy’s calendar. Lucy also creates, moves and deletes the events for appointments she books. See “Google user data” below.

From website visitors

heylucy.org does not use advertising or analytics cookies. Our hosting providers keep standard technical logs (such as IP address and browser type) for security and reliability.

How we use information

• To answer calls, book and manage appointments, answer questions and take messages for the business.
• To run your account: sign-in, password reset, verification codes and support.
• To keep the service secure and reliable: preventing fraud and abuse, rate limiting, monitoring errors and fixing problems.
• To process payments and comply with legal obligations.

We do not sell personal information, and we do not use it for advertising.

Google user data

HeyLucy’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google Calendar data only to check your availability, show your appointments in Lucy, and keep Lucy’s bookings in sync with your calendar.
• We do not sell Google user data, use it for advertising, or use it to train AI models.
• We do not let people read your Google data, except with your permission, for security purposes, or where required by law.
• Your Google access token is stored encrypted. You can disconnect at any time in Settings → Google Calendar, which removes our access and deletes the calendar data Lucy copied. You can also remove access at myaccount.google.com/permissions.

Who we share information with

We share information only with service providers that help us run HeyLucy, under their own privacy and security commitments:

• Twilio — phone numbers, calls, speech-to-text, voicemail and text-message verification codes.
• Google — Google Calendar, only if you connect it.
• Stripe — subscription payments.
• Render and Vercel — hosting for our servers, database and website.

We may also disclose information if required by law, to protect the rights and safety of our users or the public, or as part of a sale or reorganization of the business (with notice to you).

How long we keep information

We keep account and business information while your account is open. When you close your account, we delete your account, business data, appointments, customers, call logs, messages and calendar connection. Limited records may be kept longer where needed for security, fraud prevention, accounting or legal reasons.

Security

We use encryption in transit (HTTPS), hashed passwords, encrypted Google tokens, verification of requests from Twilio, per-account data separation, rate limits and automated security testing. No system is perfectly secure, so please use a strong, unique password.

Your choices and rights

• You can view and edit your business information in Settings, and delete appointments in Lucy.
• You can disconnect Google Calendar at any time.
• You can ask us for a copy of your data, to correct it, or to delete your account by emailing support@heylucy.org.
• Callers who want their information corrected or deleted should contact the business they called; we will help that business respond.

Children

HeyLucy is a service for businesses and is not directed to children under 13. We do not knowingly collect information from children.

Changes

We may update this policy. If changes are significant, we will notify account holders by email or in the app before they take effect. The date at the top shows the latest version.

Contact

HeyLucy, Iowa, USA — support@heylucy.org