Privacy Policy

Last updated: 25 August 2026

Versión en español de esta política — this English page is a translation of the Spanish original at studio.goodcallia.com/privacidad.

Who we are

Good Call AI is a platform that automates customer service over WhatsApp and other channels for small businesses. Businesses that subscribe use the Studio at studio.goodcallia.com to configure their assistant, review conversations, book appointments and follow up on their sales.

What data we process

We process two separate classes of data and we do not mix them:

Business account data: name, email address, phone number and the configuration of the assistant, together with the conversations the assistant holds with the business's own customers.
Data from the Google accounts a business voluntarily connects from the Gmail Connection and Messaging → Export sections. This is optional: the Studio works without connecting any Google account.

How we use Google user data

Signing in with Google, connecting Gmail and connecting Google Sheets are separate authorizations. Signing in with Google never grants access to mail or files, and disconnecting an integration does not sign the user out.

Good Call AI requests exactly these two permissions, each one only when the business enables the feature that needs it:

Scope What it is used for

gmail.send Sending email from the business's own account, always at their request: the message the account holder writes in the Gmail Connection section of the Studio, and the one they dictate to their voice assistant ("send an email with this week's sales report"). The recipients are chosen by them. We never read, list or search the mailbox: this scope does not allow it. We do not send advertising or unsolicited commercial email.

drive.file Creating a single spreadsheet in the business's own Drive — or opening one they pick themselves with the Google Picker, if they prefer a spreadsheet they already had — and exporting their own conversations into it: date, channel, contact, who wrote and the message. That same spreadsheet is read back to display it inside the Studio. This scope covers only the files Good Call AI creates or that the account holder explicitly selects: no other file in their Drive is visible to us.

Scope	What it is used for
`gmail.send`	Sending email from the business's own account, always at their request: the message the account holder writes in the Gmail Connection section of the Studio, and the one they dictate to their voice assistant ("send an email with this week's sales report"). The recipients are chosen by them. We never read, list or search the mailbox: this scope does not allow it. We do not send advertising or unsolicited commercial email.
`drive.file`	Creating a single spreadsheet in the business's own Drive — or opening one they pick themselves with the Google Picker, if they prefer a spreadsheet they already had — and exporting their own conversations into it: date, channel, contact, who wrote and the message. That same spreadsheet is read back to display it inside the Studio. This scope covers only the files Good Call AI creates or that the account holder explicitly selects: no other file in their Drive is visible to us.

The two connections are independent: connecting Gmail does not grant access to spreadsheets, and connecting the spreadsheet does not grant access to mail. Each one is authorized and revoked separately, and the Studio works without either of them.

Data protection and security

The data a business entrusts to us — and in particular sensitive data obtained from Google APIs — is protected by these specific measures:

Encryption in transit. All traffic, both to the Studio and to the Google APIs, travels over HTTPS with TLS 1.2 or higher. Earlier TLS versions are rejected by the server and there is no unencrypted HTTP access: it is always redirected to HTTPS. Certificates are renewed automatically.
Encryption at rest of Google credentials. Access and refresh tokens are encrypted with AES-256-GCM (authenticated encryption, with a unique initialization vector per token and an integrity tag) before being written to the database. The encryption key is held in a server environment variable, outside the source code and outside version control. A copy of the database on its own contains no usable token.
Sensitive data is not copied to our servers. Mailbox content is never downloaded or stored — the scope we request, gmail.send, does not allow reading it — and from Google Drive we keep only the file identifier of the single spreadsheet the account holder creates or selects. The best protection for sensitive data is not to hold it.
Least privilege. We request exactly two scopes, and only at the moment the business enables the feature that needs them. We deliberately withdrew the broader scopes the application once used (reading mail, access to every spreadsheet, and calendar) and replaced them with narrower alternatives.
Access control and tenant isolation. Every session is identified by a signed token with an expiry; passwords are stored as bcrypt hashes, never in clear text. Every query for Google data is scoped to the owning business identifier, so one business cannot reach another's data. The OAuth state parameter is a signed token that expires after 10 minutes, which prevents a third party from linking a Google account to somebody else's account.
Tokens never reach the browser. They are used server-side only; they are not exposed in any application response, in client-side code, or in URLs.
Reduced attack surface. The database is not published to the internet: it is reachable only from the private internal network where the services run. Administrative access to the servers is limited to a small number of named administrators, each with their own credentials.
Backups. They are held on servers that are not exposed to the internet, with access restricted to the same administrators, and are overwritten within 30 days.
Immediate revocation and deletion. When the user clicks "disconnect", the token is revoked with Google and the record is deleted from our database immediately, with no grace period.
Logging and incident response. Access and integration errors are logged so that incidents can be audited. If a security breach affected a business's Google data, we would notify them within 72 hours of becoming aware of it, together with the measures taken.

Limited Use (Google API Services User Data Policy)

Good Call AI's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, and without exception:

We do not sell Google user data and we do not transfer it to third parties.
We do not use it for advertising or to build marketing profiles.
We do not use it to develop, improve or train artificial intelligence models, our own or third-party ones, and we do not transfer it to any third-party service that would use it for that purpose. No data obtained from a Google API is sent to any artificial intelligence provider: it is never part of a prompt to any model.
We do not send unsolicited commercial email. The gmail.send scope is used only for messages the account holder triggers, addressed to themselves and to the addresses they add. We do not do cold outreach or mailbox warm-up.
No member of our team reads Google user data, except with the account holder's express written permission to resolve a specific incident, to comply with a legal obligation, or in aggregated and anonymized form for internal usage statistics.

Limited Use disclosure. Good Call AI's use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

AI processing

Good Call AI uses artificial intelligence models to draft, transcribe and analyze the messages a business exchanges with its own customers over WhatsApp, Instagram, Facebook and the other messaging channels it connects, and to read receipts the account holder uploads by hand. That is all the information a model ever receives.

Data obtained from Google APIs is not processed with artificial intelligence at all — neither by third-party providers nor by any model of our own. The three scopes we request are write-only or identity-only: gmail.send only sends, drive.file writes to the spreadsheet the account holder creates or picks and reads it back only to show the status of the export, and userinfo.email only returns the address of the connected account. No Google API response is ever included in a prompt.

The isolation is architectural and auditable: the modules that hold Google tokens and talk to Google APIs make no outbound calls to AI providers, and the modules that call AI models never receive Google API data. They are separate services with separate credentials.

Accordingly, no Google data — raw, aggregated, anonymized or derived — is used to create, train or improve any artificial intelligence model, first- or third-party. We do not run self-hosted or offline models on Google data.

Who we share data with

We do not sell or transfer Google user data to anyone. We do not share it with advertisers, data brokers, ad networks, or any third party that would use it for their own purposes.

The only third party involved is the server hosting provider where the Studio and its database run, acting as a data processor on our behalf, under contract and with no right to use the data for its own purposes. There is no other recipient.

How data is stored and how long it is kept

The exported spreadsheet lives in the business's own Drive, not on our servers: it belongs to them and they can delete it whenever they want. We store only that spreadsheet's identifier, so we know which one to export to next time.

From connected Google accounts we store exactly two things: the encrypted tokens and that spreadsheet identifier. We do not copy mailbox content to our servers — the scope we request does not allow reading it — nor any file from Drive.

Retention: Google user data is kept while the integration remains connected. When the user clicks disconnect, the token is revoked with Google and the record is deleted from our database immediately, with no grace period. If a business closes its account, its Google data is deleted within a maximum of 30 days, and any backups that may contain it are overwritten within the following 30 days. After those periods no copy remains.

Deletion can also be requested by writing to our contact address: we carry it out and confirm it within 30 days.

How to revoke access

In the Gmail Connection section of the Studio, the disconnect button revokes the token and deletes the integration. Access can also be withdrawn at any time from the permissions page of your Google Account.

Your rights

You may request access to, rectification, deletion or portability of your data, and object to its processing, by writing to our contact address. We respond within a maximum of 30 days.

Contact

For any question about this policy or about how data is processed: yolandamarcosdominguez@gmail.com

Política de privacidad (español) · Terms of Service · Good Call AI