Who we are
Susan ("Susan", "we", "us", "our") is an AI business manager that small business owners run over WhatsApp. Susan is operated by [LEGAL ENTITY NAME], [REGISTERED ADDRESS] ("the operator"). This policy explains what information Susan handles when you use the service at hiresusan.co.uk, how we use it, and the choices you have.
For any privacy question, or to request access to or deletion of your data, contact us at me@kartikarora.in.
The data Susan handles
Depending on which features you connect, Susan handles:
- Account and contact details — your name, business name, phone number and email, so we can identify your account and communicate with you.
- WhatsApp messages — the conversations between you and Susan, and between Susan and your leads/customers, so Susan can answer, act and learn your business.
- Business information you provide — documents, website content (fetched on your instruction), services, prices and preferences Susan uses to represent your business.
- Google account data — see "Google user data" below — when you connect Gmail and/or Google Calendar.
- Billing data — usage records and payment status. Card details are handled by our payment processor (Stripe); we never see or store full card numbers.
- Technical data — basic logs needed to operate, secure and debug the service.
Google user data
Connecting your Google account is optional and initiated by you. If you connect it, Susan requests only the following access, and uses it only to provide features you have asked for:
- Gmail — read (gmail.readonly): to read your inbox so Susan can summarise messages, surface customer leads, and draft replies for you.
- Gmail — send (gmail.send): to send email on your behalf. Susan can read and send but can never delete, archive or modify your mail (we deliberately do not request gmail.modify).
- Google Calendar (calendar): to read your availability and create or update events when Susan books appointments for you.
- Basic Google profile (email, openid): to identify which Google account is connected.
How we use and protect Google user data
Susan uses Google user data solely to provide and improve the features described above for you, the connected user. To generate summaries, drafts and replies, the relevant message content may be sent to our AI processor (OpenAI) via its API purely to produce that output for you; it is not used by us or by OpenAI to train or improve generalised AI/ML models.
Google user data is not used for advertising. We do not sell it. No human at the operator reads your Gmail or Calendar content except with your consent, where necessary for security or to comply with the law, or on data that has been aggregated and anonymised.
Access tokens are stored encrypted, isolated per tenant, and are only used to serve your account. You can disconnect at any time (see "Your choices").
Limited Use disclosure
Susan's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. In particular, Susan does not use Google user data to develop, improve or train generalised or non-personalised AI and/or ML models.
Service providers (subprocessors)
We share data with a small number of providers only as needed to run the service, each under contractual confidentiality and data-protection terms:
- OpenAI — AI processing (understanding messages and generating replies, summaries and content).
- Google — Gmail and Calendar access you connect, and Google Workspace document generation.
- Twilio and Meta (WhatsApp) — delivering and receiving WhatsApp messages.
- Firecrawl — fetching website content when you ask Susan to learn from a URL.
- Resend — sending transactional email from the platform.
- Zernio — publishing and reading insights for social media accounts you connect.
- Stripe — payment processing and billing.
- Railway — cloud hosting of the application and databases.
Data retention
We keep your data for as long as your account is active and as needed to provide the service. When you disconnect an integration or close your account, we delete or anonymise the associated data within a reasonable period, except where we must retain limited records to meet legal, tax or security obligations.
Your choices and rights
You can disconnect Google (or any other integration) at any time by asking Susan, and you can additionally revoke Susan's access from your Google Account security settings at myaccount.google.com/permissions.
Subject to your local law, you may have the right to access, correct, export or delete your personal data, and to object to or restrict certain processing. To exercise any of these, contact me@kartikarora.in and we will respond within the time required by applicable law.
Security
We protect your data with encryption of sensitive credentials, tenant isolation at the database level, access controls and time-boxed, signed authorisation flows. No system is perfectly secure, but we work to protect your information and to notify you and the relevant authorities of any breach as required by law.
Children's privacy
Susan is a business tool and is not directed to children. We do not knowingly collect personal data from anyone under 16.
Changes to this policy
We may update this policy from time to time. When we make material changes we will update the date below and, where appropriate, notify you. Continued use of Susan after an update means you accept the revised policy.
Contact
Questions about this policy or your data: me@kartikarora.in. This policy is governed by the laws of [GOVERNING JURISDICTION].