GateKeeperAI · Legal

Privacy Policy

Effective July 24, 2026

GateKeeperAI is an AI phone and web-chat receptionist that answers calls, captures leads, books appointments, and helps manage Google review replies for small businesses. It is operated by VerdictIQ. This policy explains what data we collect, how we use and protect it, how we handle Google user data, and the strict limits we place on the AI services we rely on.

1. Who this policy covers

This policy applies to the GateKeeperAI product, presented at verdictiq.org/gatekeeperai and delivered through the application at gatekeeperai.verdictiq.org. “You” means the business that uses GateKeeperAI. “Callers” means the people who contact your business through the receptionist.

2. Information we collect

Account data. Your name, email, and password (stored hashed).
Business data. Your business name, phone numbers, hours, services, and intake questions.
Caller and lead data. Information callers provide (name, phone, email, request details), plus call recordings and transcripts used to produce your lead summary.
Google user data. When you connect Google Calendar, the availability and event data described in Section 4. When you connect Google Business Profile, your business locations and the public Google reviews described in Section 4.
Usage data. Standard log and diagnostic data (IP address, timestamps, error logs) used to operate and secure the service.

3. How we use information

To operate the AI receptionist: answer calls and chats, collect what a caller provides, and produce a lead summary for you.
To check your availability and to book, reschedule, or cancel appointments on your connected calendar.
To monitor your Google reviews and, if you enable it, draft and publish replies to those reviews on your behalf.
To send you lead notifications, summaries, and account communications.
To secure, maintain, debug, and improve the reliability of the service.

4. Google user data and permissions

GateKeeperAI offers two optional Google integrations, each requesting only the permissions it needs. When you connect Google Calendar, it requests the scopes needed to schedule appointments on your behalf. When you connect Google Business Profile, it requests the single scope Google provides for review management:

Scope	Why we request it
calendar.readonly	Two uses: (a) checking your free/busy times (via Google’s freeBusy endpoint, which returns only busy time intervals) so the receptionist can offer open slots; and (b) displaying your calendar inside your GateKeeperAI dashboard, an owner-only view that reads event details. Event details are shown only to you and are never sent to any AI provider (see Section 5).
calendar.events	Creating the appointment a caller books, and rescheduling or cancelling it. This scope can technically access all events, but GateKeeperAI only creates, updates, or deletes the appointments it books.
userinfo.email	Identifying which Google account is connected.
business.manage	Reading your business locations and the public Google reviews left on them (reviewer display name, star rating, review text), and publishing the replies you approve or enable to those reviews. This is the only scope Google offers for review management; GateKeeperAI uses it solely to read locations and reviews and to post review replies, and it never edits your business information, posts, photos, or any other part of your profile.

We request the narrowest scopes that support checking availability and creating, rescheduling, and cancelling appointments. You can revoke GateKeeperAI’s access at any time from your Google Account permissions or by disconnecting the integration in your GateKeeperAI settings.

5. AI services and Limited Use

GateKeeperAI uses third-party AI services to power the voice and chat receptionist and to draft review replies. The only Google Calendar-derived data ever sent to an AI service is the computed set of free appointment times the receptionist may offer a caller (for example, “Tuesday at 2:00 PM”). Event titles, descriptions, and attendee details are never sent to any AI service. If you enable review replies, the content of a public Google review (reviewer display name, star rating, and review text) is sent to the AI provider solely to draft a reply for that review; drafts for critical reviews are held for your approval before anything is posted.

Provider	Tier	Trains on our data?
OpenAI	Business API (pay-as-you-go)	No — API data is excluded from training by default.
Anthropic (Claude)	Commercial API	No — API data is excluded from training by default.
NVIDIA	Business API	No. Never receives any Google user data.

These are hosted commercial APIs whose terms exclude API inputs and outputs from model training by default. GateKeeperAI does not operate self-hosted AI models. We do not use, transfer, or sell Google user data to train or improve any generalized or foundational machine-learning or AI model. We do not use Google user data for advertising, and we do not sell it or share it with data brokers.

Limited Use. GateKeeperAI’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. How we protect your data

Encryption in transit. All data is transmitted over TLS/HTTPS.
Encryption at rest. Data is stored in a managed Postgres database with encryption at rest; OAuth tokens are stored encrypted.
Access controls. Production data is restricted to authorized personnel and enforced by per-tenant isolation so one business can never see another’s data. Our staff do not access the contents of your calendar except where strictly necessary for security or debugging, on a need-to-know basis.
Least privilege. We request the minimum Google scopes required, and AI services receive only the minimum data needed to complete a task.
Provider retention limits. Our AI providers delete API inputs and outputs from their systems within 30 days by default.

7. Data sharing and subprocessors

We do not sell your data or callers’ data. We share data only with the service providers that operate GateKeeperAI on our behalf, under contract: cloud hosting and database, telephony (Twilio), email delivery, and the AI providers listed in Section 5. We may disclose data if required by law.

8. Data retention and deletion

We retain account, business, and lead data for as long as your account is active. You may request deletion of your data, or delete your account, by contacting us at the address below; we will delete your data except where retention is required by law. Disconnecting Google Calendar or Google Business Profile immediately stops all access under that integration and revokes our stored tokens.

9. Your rights

You may access, correct, export, or delete your personal data, and revoke Google access at any time. To exercise any of these rights, contact us at hello@verdictiq.org.

10. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the effective date above and, where appropriate, communicated to you directly.

11. Contact us

Questions about this policy or your data? Email hello@verdictiq.org.