Privacy Policy

System Engineering SH.P.K., [to be added before launch] (“Holdbeep”, “we”) is the controller of the personal data of the people who sign up for and use Holdbeep (account holders and their team). Contact: [to be added before launch].

For information a business enters about its own customers and callers (names, phone numbers, appointment details), the business is the controller and Holdbeep is its processor. If you are a customer of a business that uses Holdbeep, please contact that business first about your data.

• Account: your name, email address, sign-in method (email and password, or Google) and sign-in times. Passwords are never stored by us in readable form; they are handled by our authentication provider. If you sign in with Google we receive your verified email and name, never your Google password.
• Your business: the profile, services, prices, opening hours, answers, policies and booking links you enter or import and approve, and the web pages or documents you ask us to read for suggestions.
• Appointments and callbacks: customer name, phone, email, requested time and notes that you or Beepy record.
• Call and conversation facts: when it happened, how long, the outcome and the last four digits of the number. Holdbeep does not record calls and does not keep audio or transcripts.
• Voice in your browser: when you talk to Beepy, your microphone audio is streamed to our voice AI provider to produce Beepy’s reply. We do not store the audio.
• Calendar connections (when you choose to connect one): access tokens, stored encrypted on our servers, and the busy and free times needed to offer slots.
• Billing: your plan, subscription status, invoices and usage. Card details go directly to Paddle and never reach us.
• Team and security records: who was invited, roles, an audit log of important actions (such as inviting someone or closing a business), and proof that you accepted these documents (which version and when).

We do not sell personal data and we do not show advertising. We share data only with providers that help us run Holdbeep, each only for that purpose:

• Supabase: database, file storage and sign-in;
• Paddle: payments, subscriptions and invoices (also an independent controller for the payment itself);
• OpenAI: the voice and language AI that powers Beepy, which receives the live conversation and the approved business information it needs to answer;
• Google and Microsoft: only if you connect a calendar, and only what you authorise;
• Telephony provider: only once phone answering is switched on, and we will update this Policy before then;
• our hosting and email-delivery providers, to serve the site and send service emails.

We may also disclose data where the law or a valid legal request requires it. Some of these providers are in other countries; where personal data leaves your region we rely on the safeguards the law provides, such as standard contractual clauses.

• Your business information, appointments and call facts stay while the business exists. When an Owner closes the business they are deleted.
• Your login (email, name, sign-in records) is deleted when you delete your account. Other people in a business keep their access and the business keeps its data.
• Invoice records are kept for 7 years after a business closes, as accounting law requires, and a minimal audit record for 2 years (what happened, when, by which user id).
• Proof of acceptance of these documents is deleted with your login.
• Deleted data can remain in encrypted backups for a limited time until they expire.

A short summary is also in Settings under Security & Account, in “How your data is handled”.

Depending on where you live you may have the right to access, correct, delete, restrict or object to the use of your data, to receive a copy, to withdraw consent you gave, and to complain to your data protection authority.

• You can see and edit your details in Settings, and delete your login or close your business there yourself.
• There is no self-service data export yet: write to [to be added before launch] and we will help.
• If you are a customer of a business using Holdbeep, contact that business; we will help them respond.

Holdbeep uses only the cookies it needs to work: your sign-in session, the business you last selected, and a short-lived cookie while you sign in with Google or connect a calendar. We do not use advertising or cross-site tracking cookies, so there is no cookie banner to dismiss.

Data is encrypted in transit; access to each business’s data is restricted in the database to its members and by their role; calendar tokens are encrypted; destructive actions such as closing a business or deleting an account require you to confirm your identity again. No system is perfectly secure. If a breach affects your data we will notify you and the authorities as the law requires.

Holdbeep is for businesses and is not directed at anyone under 18. We do not knowingly collect data from children.

We will update this Policy when what we do changes, for example when phone answering starts. The version and date are at the top, and for material changes you will be asked to accept the new Terms and Policy version before continuing.

Questions or requests: [to be added before launch].