Your information, handled with care.

Who is responsible

The operator identified below is responsible for account, billing, support and security data. Your business generally controls its callers’ information; NeverMiss processes that information on your instructions. A data processing agreement and an approved subprocessor schedule are required before handling real callers.

What we handle and why

Account data includes your name, business, email, verified phone, sign-in identifiers, approved service information, billing references and support messages. It supports the subscription, our relationship with you, security and applicable legal obligations.

Caller data may include caller ID, a confirmed callback number, name, location, requested service, preferred time, call duration, outcome and a summary. Your business must document its lawful basis and give callers suitable privacy information. Contractual necessity does not automatically cover every caller processing activity. We do not sell caller information or use it for unrelated marketing. Stripe hosts payment collection; this application does not store full card numbers.

Calendar preferences include your chosen provider, optional calendar account email, booking mode, appointment types, working days and hours, timezone, team size, appointment length, buffers, notice, booking window and notes. Saved rules determine eligible appointment times. Saving or changing preferences does not authorise provider access, and turns automatic bookings off until the owner reviews and enables them again.

When an owner authorises Google Calendar or Microsoft Outlook, we store the provider, account email, primary calendar identifiers, consent status and encrypted access and refresh tokens on the server. We read calendar availability and process appointment times, customer names, callback numbers, optional email addresses, requested services, provider event references and booking status to check times and create customer-confirmed events. Tokens are not supplied to the browser or included in organisation exports. Calendar access can include information beyond the appointment itself under the provider permissions shown during consent.

AI, recordings and summaries

The receptionist identifies itself as AI. Audio is processed by voice and telephony providers during the conversation. Recording and stored transcripts are disabled by default; metadata and enquiry summaries can still contain personal information. Enabling recording requires an appropriate lawful basis, caller notice, approved provider settings and retention controls.

AI can make mistakes. Review enquiries and booking records. Automatic booking requires explicit customer agreement and a verified provider event; an uncertain result must be checked before you promise a time. Do not ask callers for card details, passwords or unnecessary sensitive information. The service is not intended for decisions with legal or similarly significant effects about callers.

Providers and international transfers

The intended providers are Supabase for accounts and database, Retell for voice AI, Twilio for numbers and routing, Stripe for billing, Resend for operational email, Google or Microsoft when calendar access is authorised, and the selected host. Hosted ChatGPT sign-in may also supply an account identity. The final processing schedule must list the providers actually connected.

Account regions, subprocessors, contracts and any transfers outside the EEA must be reviewed before launch, including appropriate safeguards and transfer assessments where required. This preview does not promise EU-only processing. Request the approved processing schedule from the privacy contact below.

Retention and deletion

Browser drafts and sample records remain on your device until you clear the storage. Connected service records need an agreed retention schedule. Optional stored transcripts default to 30 days; deletion runs only when the scheduled job is configured and working.

The build does not automatically delete all leads, call summaries, audit logs or provider copies after 30 days. Account deletion creates an operator review request and pauses answering. Provider deletion, backups, required financial records and confirmation need further handling. Calendar booking history is not automatically deleted when you disconnect; existing events remain in the provider calendar. Disconnecting stops future NeverMiss bookings and clears the stored connection credentials. Provider consent removal may require a separate action in your Google or Microsoft account. The operator must approve and publish retention periods for booking records, consent and other service data before live use.

Your rights and choices

You can request access, correction, deletion, restriction, portability or objection where the relevant right applies. Consent can be withdrawn without affecting earlier lawful processing. Business owners can export organisation records and request deletion review from the connected dashboard. Proportionate identity checks may be needed.

Callers should normally contact the business they called, which controls the enquiry. Contact the privacy address below for account matters or help identifying the responsible business. You can complain to Ireland’s Data Protection Commission at dataprotection.ie or your local supervisory authority.

Security and service messages

Organisation access checks, signed webhooks, server-held provider secrets and hosted checkout are included. They require correct configuration and verification; no service promises absolute security. Restrict access to mailboxes receiving enquiry details. Operational emails support the service. Marketing and optional tracking need a separate lawful basis and any required consent. Material privacy changes will be published and communicated where appropriate.