Privacy Policy

Overview

Project Capital AI is operated by Leo Ebanks, a sole proprietor.

Project Capital AI provides an AI receptionist that answers text messages sent to businesses that use the service. This policy explains what information Project Capital AI processes, why it is processed, and the choices you have.

Information we process

• The mobile phone number you send messages from, and the business phone number you send them to.
• The content of the messages you send and the replies sent back to you.
• Your name, if you choose to provide it in a message.
• Information a business provides about itself, such as hours, services, and answers to common questions.

How information is used

Project Capital AI processes this information as necessary to provide customer-service communications and to operate the service. That includes generating and sending replies to your messages, keeping recent conversation history so that replies make sense in context, and notifying the business when a person needs to follow up with you.

SMS and mobile information

• Mobile phone numbers and SMS consent information are not sold, rented, shared, or disclosed to third parties or affiliates for marketing or promotional purposes.
• SMS consent is not shared with third parties or affiliates for marketing purposes.
• Message frequency may vary depending on your interaction with the business.
• Message and data rates may apply.
• You may reply STOP at any time to opt out of SMS communications.
• You may reply HELP for assistance.

Google Calendar access

A business using Project Capital AI may connect its Google Calendar so that the service can offer appointment times that are genuinely free and record bookings on that calendar. This section describes that access. It applies to the business that connects a calendar, not to people who text the business.

What is read

Project Capital AI reads three things from a connected calendar.

• Busy periods. To find free appointment times, the service asks Google which periods are busy. This returns start and end times only. It does not return event titles, descriptions, locations, or attendees, and Project Capital AI does not request them.
• Changes to events. To notice when a booked appointment is later moved, cancelled or deleted in the calendar, the service periodically asks Google for events that have changed since its last check. For each changed event Google returns, and Project Capital AI temporarily processes, the event’s identifier, its version marker, its start and end times, its title, whether it has been cancelled, whether it is marked as busy or free, and a link to the event in Google Calendar.
• The Google account address of the connected account, read once at connection, so the business can see which calendar is connected.

Most of what is read in the second category is not kept. A changed event that Project Capital AI did not create is discarded at once, and nothing about it is stored. For events the service did create, it stores the event’s identifier and version marker, a derived synchronisation status recording that the event was found changed or deleted, the time that was detected, and, where the event was moved, its new start and end times. Event titles and the link to the event in Google Calendar are never stored. A marker supplied by Google is also stored so that the next check asks only for what has changed since the last one.

What is written

When an appointment is booked, Project Capital AI creates one event on the connected calendar. The event contains the name of the service and the appointment time. It does not contain the customer’s name, phone number, or any part of their messages. Project Capital AI does not delete events from the calendar.

Where this information is stored

Supabase and Vercel process this information on our behalf to provide database, hosting, and application services, subject to our agreements with them. The information is stored in a database operated by Supabase; the application itself is hosted by Vercel, which processes this information transiently while the application runs.

The access credentials Google issues are encrypted by the application before they are sent to the database, and are not readable from the business dashboard.

How this information is used and shared

Raw calendar information — event details and the busy-period results returned by Google — is not sent to the AI model provider or the telecommunications provider. What those providers receive are available appointment times, calculated from the business’s configured schedule together with busy-period information. Those available times appear in AI-generated replies and in the text messages sent to customers. Calendar information is not sold, rented, or shared for advertising or marketing.

Limited use

Project Capital AI’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Calendar information is used only to provide the appointment features described above. It is not used for advertising and it is not sold. It is not used for routine human review, and is accessed by a person only in the limited circumstances described immediately below.

Access by people

Calendar information is processed automatically. It is not presented for routine human review, and the service has no feature that displays calendar contents to staff. A person may access it only where necessary to investigate a fault reported by the business, to address a security issue, or where required by law.

Withdrawing calendar access

A business may withdraw Project Capital AI’s access to its calendar at any time from its Google account, at myaccount.google.com/permissions. Revoking access withdraws Project Capital AI’s authorization and stops further reading from and writing to the calendar once Google has processed the revocation. An access token already issued to the application is short-lived and expires on its own; Google does not publish a guarantee that such a token stops working at the exact moment access is revoked. Project Capital AI does not continue to call a calendar once a request has been refused: the connection is marked unauthorised and no further calls are made until the business reconnects.

Three things do not happen automatically when access is withdrawn, and are stated here rather than left to be assumed:

• Events already created remain in Google Calendar. They can be deleted there by the business.
• The stored connection record — the encrypted credentials, the connected account address, the calendar in use, and the connection’s status — is not deleted by withdrawing access.
• The records linking past appointments to the calendar events created for them are likewise retained, together with the records of changes later detected in those events.

Those records are deleted when the business account is deleted. A business may also ask for them to be removed earlier, upon a verified request and subject to applicable legal, security and record-retention requirements. In that case the stored connection record and the appointment-to-calendar link records are deleted outright, while the service’s own change-history records are kept — they record that a change was detected and when — with the Google-derived details inside them erased: the event identifier, the version markers, the times, and any text returned by the provider. To make such a request, contact contact@projectcapitalai.com.

Service providers

Project Capital AI relies on third-party providers to operate the service: Twilio for sending and receiving text messages, Vercel for application hosting, Supabase for database services, and Anthropic for AI model services. These providers process information to deliver their respective services under the applicable agreements and their own privacy terms.

Project Capital AI does not send Google Calendar information to the AI model provider or the telecommunications provider, other than the available appointment times described under “Google Calendar access” above, and does not use Google Calendar information for advertising.

Google Calendar is a separate third-party service that a business connects to its own account. That access is described under “Google Calendar access” above, and is governed by the authorization the business grants and by Google’s applicable terms.

Retention

Message history and related records are retained so that the business can review its conversations and so that replies remain accurate in context.

Calendar credentials, the connected account address, the records linking appointments to calendar events, and the records of changes detected in those events are retained for as long as the business account exists, and are deleted when it is deleted. Upon a verified request, and subject to applicable legal, security and record-retention requirements, they may be dealt with earlier: the connection record and the link records are deleted, and the change-history records are kept but stripped of the Google-derived details they contain. Withdrawing calendar access in a Google account stops further access but does not by itself remove any of these records, and does not remove events already created in the calendar.

Changes to this policy

This policy may be updated from time to time. The date shown at the top of this page indicates when it was last updated.

Contact

For questions about a specific conversation, you can contact the business you were messaging. You may also reply HELP to any message for assistance, or STOP to opt out of SMS communications.

For questions about Project Capital AI or this policy, contact contact@projectcapitalai.com.