Privacy Policy

NiteOwl AI Ltd (“NiteOwl”, “we”, “us”) provides Remy, an AI receptionist that answers customer enquiries, books appointments, and captures leads on behalf of the businesses that use it (“Customers”). This policy explains what information we collect, how we use it, and the rights you have over it.

This policy covers three groups of people: visitors to our website (niteowlhq.com), Customers who sign up for and manage a Remy account, and End Users— the customers of our Customers, who interact with Remy through a website chat widget or NiteOwl’s own marketing site.

1. Information we collect

From Customers (business accounts)

• Name and email address, and password or Google account details if you sign in with Google
• Business details you provide: business name, type, description, website, opening hours, and knowledge base content
• Billing information — handled directly by our payment processor, Stripe; we never receive or store your card details ourselves
• Records of your own use of the dashboard, such as leads, bookings, and conversation history

From End Users (customers chatting with Remy)

• Name, email address, and/or phone number, where you choose to provide them in a conversation
• The content of your messages, including any service requested and your preferred appointment time
• Appointment and booking details, where you book, reschedule, or cancel a service

From a connected Google Calendar (optional)

If a Customer chooses to connect a Google Calendar, Remy is granted access to that account strictly to schedule appointments. We request the narrowest permissions Google offers for this — the ability to see the list of calendars, to check availability, and to manage events — and deliberately not permission to read the calendar itself. Remy is therefore unable to see the content of events it did not create, even in principle. We access only the following, and only for that purpose:

• The list of calendars on the account— the name and identifier of each, so the Customer can choose which one Remy should use. We store only the chosen calendar’s name and identifier.
• Free/busy times — the start and end times of periods already occupied on that calendar, so Remy does not double-book. Google returns times only for this permission: no event titles, descriptions, locations, attendees or guests are shared with us. These times are used to answer a single availability question and are never stored.
• Appointments Remy creates— Remy can add, move and cancel calendar events for bookings made through it. It does not read, change or delete any other event on the calendar. For each appointment we store only Google’s identifier for the event we created, so we can move or cancel that same event later.
• Which Google account was connected — the account identifier, email address and display name, so the Customer can see which calendar is linked.

Events created by Remy contain the booking details already provided in the conversation: the service requested, the End User’s name, their email address (added as a guest so they receive the invitation), the service address where one was given, and the appointment time.

Access is granted by the Customer through Google’s own consent screen and can be withdrawn at any time — by choosing Disconnectin Settings → Integrations, which also asks Google to revoke our access and deletes the stored credentials, or from the Customer’s Google Account permissions page. Access tokens are encrypted before storage.

Collected automatically

• Basic technical data (such as IP address) used briefly to prevent abuse of our chat and booking systems — this is not linked to your identity or stored long-term
• Error and performance diagnostics, collected via Sentry, to help us detect and fix bugs

2. How we use information

• To operate Remy: answering enquiries, checking availability, and booking, rescheduling, or cancelling appointments
• To notify a Customer’s business when a new lead, booking, or enquiry needs their attention
• To send transactional emails: booking confirmations, cancellation/reschedule notices, and account-related messages
• To operate and improve NiteOwl’s own product and marketing site, including our sales chat assistant
• To provide customer support, and to detect, investigate, and prevent abuse or security issues
• To process payments and manage subscriptions, via Stripe

3. AI processing

Remy’s responses are generated using OpenAI’s language models. When you chat with Remy — whether as an End User on a Customer’s website, through NiteOwl’s own sales chat, or as a Customer testing your own assistant — the content of that conversation is sent to OpenAI’s API to generate a reply and, where relevant, to identify booking details such as a name, contact method, or requested time. We do not use this content to train OpenAI’s models, and OpenAI processes it under its own API data usage terms, which do not permit training on API-submitted content by default.

Remy is designed to escalate anything it cannot confidently answer to a real person at the relevant business, rather than guess. It does not make medical, legal, financial, or emergency decisions, and should not be relied on for any of these.

4. Who we share information with

We share information only with the service providers who help us run NiteOwl, and only as needed to provide the service:

• Supabase — database hosting and account authentication
• OpenAI — generating chat responses and extracting booking details, as above
• Resend — delivering transactional emails
• Stripe — processing subscription payments
• Vercel — application hosting
• Sentry — error monitoring and diagnostics
• Google Calendar — checking availability and creating, moving and cancelling appointments, where a Customer has connected their calendar

Google user data.NiteOwl’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use calendar data only to provide the scheduling features described above. We do not sell it, use it for advertising or to build advertising profiles, use it to train AI models, or allow anyone to read it — except where the Customer asks us to, where it is needed to investigate a security issue or a fault they have reported, or where the law requires it.

One clarification, because it is easy to assume otherwise: our AI provider never receives your calendar. When Remy tells an End User that a time is unavailable, or offers an alternative, the only calendar-derived information involved is that decision and the suggested times themselves. Event titles, descriptions, locations, guests and attendees are never sent to any AI provider.

A Customer using Remy can see the enquiries, leads, and bookings that come through their own account — that is the core function of the product. We do not sell personal information to anyone, and we do not share it with third parties for their own marketing purposes.

5. International data transfers

Some of the service providers listed above may process data outside the UK or European Economic Area. Where this happens, we rely on appropriate safeguards required by UK data protection law, such as standard contractual clauses, and we choose providers who maintain their own equivalent commitments.

6. Data retention

We keep Customer account and business data for as long as the account is active, and for a reasonable period afterward to allow reactivation and to meet legal or accounting obligations. End User conversation, lead, and booking data is retained by the relevant Customer’s account for as long as that account exists, so the business can maintain its own customer records. Technical rate-limiting data is held only briefly, in memory, and is not persisted.

Google Calendar free/busy times are never stored — they are read to answer one availability question and discarded. Calendar access credentials are deleted as soon as a Customer disconnects the integration. The identifiers linking a booking to the calendar event Remy created are kept alongside that booking, so the appointment can be moved or cancelled later.

7. Your rights

Depending on where you are located, you may have the right to:

• Ask what personal information we hold about you, and request a copy of it
• Ask us to correct inaccurate information
• Ask us to delete your information, subject to any legal or legitimate business reasons we may need to keep it
• Object to, or ask us to restrict, certain processing
• Withdraw consent at any time, where we rely on consent

If you are an End User and want to exercise these rights, you can contact the business you spoke with directly, or contact us and we will help route your request. Customers can access, export, or delete most of their own account data directly from the dashboard, or by contacting us.

8. Security

We use industry-standard measures to protect information, including encryption in transit, access controls restricting who can view Customer data, and row-level security on our database so one Customer’s data is never visible to another. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Cookies

We use only the essential cookies needed to keep you signed in to your account. We do not use third-party advertising or analytics cookies on niteowlhq.com.

10. Children’s privacy

Remy and NiteOwl’s services are intended for business use and are not directed at children. We do not knowingly collect personal information from children.

11. Changes to this policy

We may update this policy as NiteOwl and Remy evolve. We’ll update the date at the top of this page when we do, and where changes are significant, we’ll take reasonable steps to let Customers know.

12. Contact us

Questions about this policy or your data can be sent to contact@niteowlhq.com.