Privacy Policy

Last updated October 26, 2026

Tiffani (“Tiffani”, “we”, “us”) is a receptionist for appointment-based businesses. A business (“owner”) teaches Tiffani about its services, and Tiffani answers the business’s customers in web chat (and by iMessage or SMS, if the business has texting turned on), hands conversations to the owner when needed and, if the owner turns it on, books appointments. This policy explains what we collect, why, who we share it with and how long we keep it.

Information we collect

• Owner account. When an owner signs in with Google we receive their name, email address and Google account identifier, plus the sign-in tokens Google issues. We do not receive their Google password. An owner who signs in with an email and password instead gives us their name and email address; we keep only a one-way hash of the password, never the password itself, and we email them only to confirm the address or reset the password.
• Business content. What the owner adds: business name, knowledge (notes, uploaded text files and imported website pages), hours, services, booking rules, approval rules and the owner’s chats with Tiffani. If the owner adds a calendar feed link (an ICS address), we keep that link and the busy times it contains.
• Web chat. When a customer chats with a business on its Tiffani chat page or website chat bubble, we keep the messages and replies, plus a name, phone number or email only if the customer gives them (a business may require a phone number or email before it confirms a booking). A cookie that lasts 180 days (and, inside a website’s chat bubble, the same random identifier in that bubble’s own storage) lets the customer return to their conversation; it holds no personal information and is not used for advertising. To prevent abuse we keep counters keyed by a one-way hash of the customer’s IP address, deleted after 2 days.
• Text messages. If a business has texting turned on and a customer texts its Tiffani number, we receive their phone number (or Apple iMessage address), the message text, delivery status and timestamps, and we keep the replies sent to them. We do not read or store photos or other attachments; we record only that one was sent.
• Owner phone. If an owner chooses text alerts, their mobile number, verified with a one-time code.
• Calendar data (only if the owner connects Google Calendar; see below).
• Operational data. Usage counts, security and error logs. Error logs never include message text. Our web server’s access log records each request with a shortened IP address (the last part removed, so it no longer identifies one device), the page and the result, for security and troubleshooting.

How we use information

• To answer customers from the knowledge the owner has reviewed and published, and to hand conversations to the owner when Tiffani is unsure or the customer asks for a person.
• To book, move or cancel appointments when booking is on and the customer confirms the exact time.
• To alert the owner about conversations that need them. Alert emails and notifications can include the customer’s first name and a short quote of their message. Copies already delivered to the owner’s mailbox or device are held by the business.
• To run, secure, limit and troubleshoot the service.

We do not sell personal information, use it for advertising, or share customer phone numbers with other businesses on Tiffani. Each business’s data is kept separate from every other business’s data.

Text messages (iMessage and SMS, if enabled)

This section applies only to businesses that have texting turned on.

• Customers start the conversation. Tiffani replies only to people who text a business’s Tiffani number first. It does not send marketing messages or cold outreach.
• Consent. By texting a business’s number you agree to receive replies about your request from that business, sent by Tiffani on its behalf. Message frequency depends on your conversation. Message and data rates may apply.
• Opting out. Reply STOP (or STOPALL, UNSUBSCRIBE, CANCEL, END or QUIT) to stop all texts from that business’s number. Reply START or UNSTOP to receive texts again. Opt-outs apply to the number you texted and are honored before any automated reply.
• Owner alerts are sent only to a phone number the owner verified with a code. The owner can reply STOP to end them.
• For help with an appointment or a reply you received, contact the business directly or email us.

Mobile opt-in data and consent will not be shared with third parties or affiliates for marketing/promotional purposes.

Google Calendar data

Connecting Google Calendar is optional; Tiffani’s built-in calendar works without it. If an owner connects Google Calendar, Tiffani asks only for these calendar permissions:

• See the list of your calendars (calendar list, read-only), so the owner can choose which calendars block booking times and which calendar receives copies of Tiffani bookings.
• View your availability (free/busy), so Tiffani never offers a customer a time the owner is already busy. Free/busy shows only busy time ranges, not event titles or details.
• View and edit events, used only to create, move and cancel the appointment events Tiffani books in the calendar the owner chose, and to read back those same calendars to confirm a booking was saved and to detect a conflicting event. Tiffani never sends calendar invitations or emails from your calendar.

We use Google Calendar data only to provide these booking features to the owner who connected it. Google Calendar data is not sent to AI model providers: availability is computed by Tiffani’s own code, and only the resulting open times are offered to a customer. Access tokens are encrypted at rest. We do not use Google user data for advertising, do not sell it, do not transfer it to third parties except as needed to provide the service or as required by law, do not use it to develop, improve or train generalized AI or machine-learning models, and do not let people read it except with the owner’s permission for support, for security purposes, or where the law requires.

Tiffani’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. An owner can disconnect Google Calendar in Tiffani at any time; we then revoke Tiffani’s access at Google and delete the stored access tokens immediately. Appointments Tiffani already copied into the owner’s calendar stay there, as the owner’s own events. Access can also be revoked at myaccount.google.com/permissions. To have all Google data we hold deleted, email us at the address below.

Service providers

We share data only with providers that help us run Tiffani, and only as needed:

• Hostinger hosts the server and database that run Tiffani, in the United States.
• OpenRouter and the AI model hosts it routes to (which may be in the United States or other countries) process message text and business knowledge to draft replies. We send only what a reply needs, and every request asks for zero-data-retention hosts that do not store it or use it to train AI models.
• Cloudflare runs our domain’s DNS, receives email sent to our addresses, delivers owner alert and sign-in emails (which can quote a customer’s message, as described above), checks that the service is up, and stores our encrypted backups.
• Browser push services (Google, Mozilla, Microsoft or Apple, depending on the owner’s browser) carry an owner’s alert notifications, if the owner turns them on. The contents are encrypted so these services can’t read them.
• Sendblue carries iMessage and SMS messages to and from business numbers, if texting is turned on.
• Google provides sign-in and, if connected, Google Calendar.

Tiffani’s servers and database are in the United States. AI processing, email delivery and backup storage may happen in other countries through the providers above.

We may also disclose information if required by law or to protect the safety of people or the service.

How long we keep data

• Conversation history, business knowledge and bookings are kept while the business uses Tiffani, so the owner can review what was said and booked.
• When a business stops using Tiffani, or a customer asks the business or us to delete their messages, we delete the data from the live database within 30 days of the request. If the owner connected Google Calendar, deleting the business also revokes Tiffani’s access at Google. Backups are encrypted and deleted on a schedule, so deleted data is gone from every backup within 60 days.
• Opt-out records are kept as long as needed to keep honoring them.
• Server logs are kept for security and troubleshooting: application logs for 14 days, and web server access logs (with shortened IP addresses) for no more than 15 days.

Security

Data is encrypted in transit. Each business’s records are isolated in the database, staff access is limited, and calendar tokens are encrypted. No system is perfectly secure; we will notify affected owners of a breach as the law requires.

Your choices

Owners can view, edit and unpublish their knowledge, disconnect their calendar and ask us to delete their account. Customers can opt out by replying STOP and can ask the business or us to access or delete their messages. We respond to requests made under applicable privacy laws, including the California Consumer Privacy Act. Tiffani is not directed to children under 13.

Changes and contact

We will post changes here and update the date above. Questions or requests: privacy@tiffani.app.