Privacy Policy

Booked55 ("we," "us," or "our") operates the Booked55 platform, including the web application, website, API, and related services (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our Service.

We are committed to protecting your privacy and handling your data with transparency. Please read this policy carefully. By using the Service, you acknowledge that you have read and understood this Privacy Policy.

1. Information We Collect

1.1 Information You Provide

• Account information: Name, email address, password, and organization details when you register. If you choose to get your two-factor authentication codes by text message, also your mobile number.
• CRM data: Contacts, companies, deals, events, tasks, activities, pipelines, campaigns, newsletters, sequences, notes, tags, and files you upload. For each contact this can include their name, email addresses, phone numbers, employer, job role, social profiles, where and when you met, notes you write about them, and files you attach.
• Contacts imported from your device: If you choose to add people from your phone's address book, the app reads your contacts on your device so you can pick who to import. Only the people you actually select are sent to us — we do not upload your address book, and we do not read it in the background. You can revoke this access at any time in your phone's settings.
• Voice input: If you press the microphone button on a note or description field, your device records while you hold it on and streams the audio to our speech-to-text provider, which returns text. The recording is never stored — by us or, once transcribed, by them — and only the text lands in the field you were typing in. There is no background listening and no wake word, and you can revoke microphone access at any time in your browser or phone settings.
• Recorded meetings: If an administrator turns on meeting recording for your organization and you choose to record your meetings, a notetaker joins the video meetings on your connected calendar that your choice covers and records them. The recording, the transcript made from it, and a written summary of the call are saved against that meeting's task — and they contain what everyone in the meeting said, not only you. Section 10 covers this in full: who can turn it on, how people are told, and how to skip a meeting.
• Data about other people: Most CRM data is personal information about your contacts rather than about you. You decide what to record about them, and you are responsible for having a lawful basis to do so — we process it on your instructions. See Section 14.
• Communication data: Email content when you use our Gmail integration, campaign messages, and email templates.
• Payment information: Billing details processed through our third-party payment provider. We do not store full credit card numbers on our servers.
• Support communications: Messages you send to our support team.

1.2 Information Collected Automatically

• Usage data: Pages visited, features used, clicks, and navigation patterns within the platform.
• Device information: Browser type, operating system, device type, and screen resolution.
• Log data: IP address, access times, referring URLs, and error logs.
• API request logs: For security, debugging, and abuse detection we log requests to our API — the endpoint, method, status, response time, your user, session and organization identifiers, IP address, browser, and the request and response content. Because that content is the CRM data of the request, these logs can contain personal information. They are automatically deleted after 90 days.
• Session records: When you log in we store the session, your IP address, browser, and operating system, so you can review and revoke active sessions.
• Cookies and similar technologies: We use cookies for authentication, preferences, and analytics. See Section 8 for details.

1.3 Product Analytics (PostHog)

We use PostHog, a product analytics service, to understand how users interact with our website and web application. PostHog helps us improve the Service by collecting information about your use of the platform, including:

• Page views: Which pages and screens you visit within the Service.
• Clicks and interactions: Buttons clicked, links followed, and navigation paths through the platform.
• Session recordings: PostHog does not record your screen inside the logged-in app, on the web or in the mobile app, because those screens can show email from a connected mailbox. Our error-monitoring provider, Sentry, does not record your screen either. On the public marketing website PostHog records sessions only after you accept analytics cookies.
• Feature usage: Which features you use and how often, to help us prioritize product improvements.
• AI features: What each AI feature is sent and what it answers: your conversations with the AI assistant (your messages, its replies, the steps it worked through, and the CRM records it read or changed along the way), and the inputs and results of the other AI features, such as a drafted email or a meeting summary. We keep these to find and fix the AI's mistakes. Section 9 says what is recorded and what is never recorded.

On the public marketing website, PostHog only sets cookies and records sessions once you have accepted analytics cookies in the consent banner. Until then it runs without any cookies or local storage and sees only anonymous page views for that visit.

PostHog data is used solely for product analytics and improvement. We do not use PostHog data for advertising, and we do not sell analytics data to third parties. When you are logged in, PostHog may associate analytics events with your account identifier and email address. PostHog's privacy policy is available at posthog.com/privacy.

1.4 Visitor Tracking and Advertising on Our Marketing Website

On our public marketing website (booked55.com pages such as the home page, blog, and pricing) we use two advertising and marketing technologies. Both run only after you accept advertising cookies in the consent banner, and neither is present in the logged-in web application.

• Google Ads conversion measurement (the Google tag): lets us see whether a visit that came from one of our Google ads led to a sign-up, so we can tell which ads are worth running. Google sets cookies for this and receives your IP address and the page you visited. Until you consent, the tag sends Google only cookieless, aggregated signals (Google "consent mode") that cannot identify you. The same tag runs on the sign-up and onboarding pages of the dashboard (dashboard.booked55.com) so that a completed sign-up can be counted; it honours the choice you made here and asks nothing further. Google's privacy policy is available at policies.google.com/privacy, and you can also opt out of personalised advertising at adssettings.google.com.
• Apollo.io website tracker: records the pages a visitor views along with their IP address and uses it to infer the company a visitor may be browsing from, so we can understand which businesses are interested in Booked55. Apollo's privacy policy is available at apollo.io/privacy-policy.

You can change your choice at any time from the "Cookie settings" link in the website footer, or here: Manage cookie preferences. Declining does not affect your use of the product.

1.5 Information from Third-Party Integrations

When you connect third-party services (such as Gmail or Google Calendar), we access data as authorized by you through OAuth. We only request the minimum permissions necessary for the integration to function. You can disconnect these integrations at any time from your account settings.

Booked55's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process your CRM data as directed by you (contact management, pipelines, campaigns, etc.)
• Enable AI-powered features such as email drafting, company search, and contact enrichment
• Send transactional emails (account confirmations, password resets, billing receipts)
• Text you a sign-in code, if you chose to get your two-factor authentication codes by text message
• Provide customer support
• Monitor and analyze usage trends to improve user experience
• Detect, prevent, and address security issues and abuse

We do not sell your personal information. We do not use your CRM data or relationship data to train AI models for use by other customers or third parties.

3. Legal Bases for Processing (EEA/UK Users)

If you are located in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases:

• Contract performance: Processing necessary to provide the Service you signed up for.
• Legitimate interests: Analytics, security monitoring, and service improvements, where these do not override your privacy rights.
• Consent: Where you have given explicit consent, such as connecting third-party integrations or opting into marketing communications.
• Legal obligation: Where we are required to process data by applicable law.

4. Data Sharing and Disclosure

We may share your information in the following circumstances:

• Subprocessors: Third-party companies that process data on our behalf so the platform can function. Each is contractually obligated to protect your data and may only use it to provide services to us. They fall into seven categories: infrastructure and storage, AI providers, contact data enrichment, meeting recording, email, calendar and messaging integrations, payment processing, and analytics and monitoring.
• Analytics provider: We share usage and interaction data, and what our AI features are sent and answer, with PostHog as described in Sections 1.3 and 9.
• Within your organization: Other users within your Booked55 organization can access shared CRM data as configured by your organization's admin.
• Event organizers, with your consent: If you join Booked55 through an event organizer's link, you are asked whether to share anonymous event statistics with that organizer. The box is never ticked for you. Some organizers' links are only for people who agree to share, and you can sign up for Booked55 without that link instead. If you agree, what you did at that event is counted in totals we give the organizer, such as how many attendees exchanged contacts, how many followed up, and how many meetings and new customers followed. The organizer does not receive your name, job title, company or email, the identity of anyone you met, deal amounts, meeting times and locations, notes or email content, or anything that is not attached to that event. Sharing ends one year after the event unless another date is set for it, and you can turn it off at any time in your profile under Privacy.
• Anonymous event totals: For an event run with Booked55, we give the organizer totals that identify no one, such as how many people joined through its link. A total covering fewer than 5 people is withheld.
• Legal requirements: When required by law, regulation, legal process, or governmental request.
• Business transfers: In connection with a merger, acquisition, or sale of assets, with notice to affected users.

Apart from the event sharing described above, we do not share your CRM data with other Booked55 customers or use it for cross-account purposes, and we do not sell personal information to anyone.

5. Data Retention

We retain your personal information and CRM data for as long as your account is active or as needed to provide the Service. Specific retention periods:

• Account and CRM data: Retained while your account is active. When you delete your organization, records are marked deleted immediately and removed or anonymized within 90 days, except where we must keep them for legal, accounting, or regulatory reasons.
• Uploaded files: When you delete a file, or delete your organization, the file becomes inaccessible immediately and is permanently erased from our storage provider within 30 days.
• Meeting recordings, transcripts and summaries: The transcript and the summary live on the meeting's task and follow the rule above for CRM data; the video stays with our recording provider until the task is deleted, you ask us to remove it, or the organization is deleted, at which point that organization's recordings are deleted there as well.
• API request logs: Automatically deleted 90 days after they are written. The transcript and summary of a meeting are removed from these logs before they are written.
• AI records in PostHog: The content (messages, replies, steps, records, and each AI feature's input and result) is deleted after 30 days. What remains after that is which AI model answered, how long it took and how much it used, without the content. Deleting a chat or a record in the app does not remove it from PostHog sooner.
• Sessions: Expire automatically, and you can revoke any active session yourself at any time.
• Billing records: Retained as long as required by tax and accounting law, typically seven years.

You may request deletion of specific data at any time by contacting us at the email address listed below. You can also delete individual contacts, files, and other records directly in the app.

6. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data, subject to legal retention requirements.
• Portability: Request your data in a structured, commonly used, machine-readable format.
• Restriction: Request that we limit processing of your data in certain circumstances.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time.

For California Residents (CCPA)

If you are a California resident, you have the right to know what personal information we collect, request its deletion, and opt out of the sale of personal information. We do not sell personal information. To exercise your rights, contact us using the details in Section 15.

For Canadian Residents (PIPEDA)

If you are a Canadian resident, you have the right to access your personal information, challenge its accuracy, and withdraw consent for its collection, use, or disclosure. We collect and use personal information only for purposes that a reasonable person would consider appropriate in the circumstances. To exercise your rights, contact us using the details in Section 15.

7. Data Security

We implement technical and organizational measures designed to protect your personal information, including encryption of data in transit (TLS/SSL), access controls, and regular security reviews. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. For more details on our security practices, see our Security page.

8. Cookies and Analytics Technologies

We use the following types of cookies and similar technologies:

• Essential cookies: Required for authentication, security, core platform functionality, and to remember the cookie choice you made. These cannot be disabled.
• Analytics cookies (PostHog): PostHog sets cookies and local storage entries to track page views, user sessions, and feature usage across our website and web application. These help us understand how the Service is used so we can improve it. On the marketing website PostHog may also record sessions, as described in Section 1.3, and these are set only with your consent.
• Advertising cookies (Google Ads, Apollo.io): On the marketing website only, and only with your consent, as described in Section 1.4. They let us measure whether our advertising leads to sign-ups and which companies are interested in Booked55. We do not sell your data and we do not use these cookies to show you Booked55 ads on other sites (retargeting).

When you first visit booked55.com you are asked which non-essential cookies you allow. Nothing non-essential is set until you answer, and "Reject non-essential" is always available with one click. Your choice is stored for 180 days and can be changed at any time from the "Cookie settings" link in the website footer or here: Manage cookie preferences.

Inside the logged-in application, analytics runs as described in Section 1.3. Nothing records your screen there.

9. AI Features and Your Data

Booked55 uses artificial intelligence throughout the product. AI features include:

• The AI assistant — a chat assistant inside the app that can read and modify your CRM data on your instructions.
• Email and campaign drafting, rewriting, and review.
• Business-card scanning — images you scan are read by an AI vision model to extract contact details.
• Contact and company enrichment and AI-assisted company search.
• CSV import mapping, data cleanup, pipeline coaching reports, and task suggestions.
• Dictation — when you press the microphone button on a note or description field, what you say is streamed to a speech-to-text provider and returned as written text.

These features are powered by third-party AI providers, not by models we run ourselves. When you use an AI feature, the data needed for that specific request — which may include contact details, email content, notes, uploaded files, images you scan, or audio you dictate — is transmitted to one of those providers to generate the result. We currently use Anthropic, AssemblyAI, Cerebras, Google, Perplexity, and — for recorded meetings only — Recall.ai; the Subprocessors page records which one is used for what.

Under our agreements with these providers, your data is processed solely to fulfil your request and is not used to train their models, nor to train models for other customers or third parties.

Most AI features run only when you invoke them. Four run in the background, and this is the complete list:

• Meeting recording. While an administrator has it turned on, the text of a calendar invitation is read to find its meeting link when we cannot find one any other way, and every recorded call is transcribed and summarised without anyone asking each time — that is the point of the feature, and Section 10 describes it.
• Replies to your email. While a Gmail or Outlook mailbox is connected with read access, mail sync runs on it. When a contact answers an email you sent through Booked55, the new text of their reply and up to 1,500 characters of your own email are sent to Cerebras to work out what the reply means: a positive, neutral or negative answer; an automatic reply such as an out-of-office or "I have left the company" notice; or a request to stop receiving email. When Cerebras is unavailable, Google's Gemini (2.5 Flash) is used instead. And when you answer an email a contact sent you, the first 1,500 characters of your reply are sent to Cerebras to write a one-sentence summary, which is saved as a note on the contact's timeline.
• Pipeline coaching emails. A weekly and a monthly coaching report on your pipelines is written by AI and emailed to you. This is on by default; you can turn it off, or change how often it arrives, under "Pipeline Coaching Emails" on your profile page in the app.
• Stage task suggestions. If an administrator turns on AI for a pipeline stage and gives it a prompt, the follow-up tasks created for contacts in that stage are written by AI from the contact's record and recent activity.

Nothing else in the CRM is put through AI in the background. If you prefer that none of your data is sent to an AI provider, leave meeting recording off, do not connect a mailbox, turn off coaching emails, do not turn on AI for a pipeline stage, and do not use the AI features; the rest of the CRM works without them.

The microphone is on only while you are dictating. It starts when you press the microphone button and stops when you press it again, when you leave the field, or when you switch away from the app. There is no background listening and no wake word. The audio is streamed directly from your browser or phone to our speech-to-text provider; we never receive or store a recording, and only the resulting text is saved — into the field you were typing in, and nowhere else. Your device will show its own recording indicator whenever the microphone is live.

AI output can be wrong. Enrichment results, drafted emails, extracted card details, and analysis are generated by statistical models and may be inaccurate or incomplete. Review AI output before relying on it, especially before sending it to a client or saving it as a record about a person.

What the AI is sent and answers is recorded so we can improve it. Each conversation with the AI assistant (your messages, its replies, the steps it took, and the CRM records it read or changed on the way) is recorded in PostHog, our analytics provider, and so are the inputs and results of the other AI features: for example a drafted email, the details read from a business card, enrichment research, a coaching report, or a meeting's summary with the transcript it was written from. A small number of Booked55 staff read these records, and automated checks score them, to find where the AI made a mistake and fix it. The content is deleted after 30 days (Section 5). It is never used for advertising and never sold.

Your email, calendar and social messages are never recorded. When the AI reads email you received in a connected Gmail or Outlook account, your calendar events, or your social messages (to classify a reply, to find a meeting link, or because you asked the assistant about a contact's emails), we record only which model ran, how long it took and how much it used. The same goes for what Booked55 makes from them: the task and summary written for a reply, and the task or meeting made from a calendar event, including a meeting's summary and transcript. Once the assistant reads any of these in a chat, the rest of that chat is recorded the same way, without its content. Pictures and files you give the AI are not recorded either.

Human review of safety concerns. If a conversation with the AI assistant suggests a risk of harm to you or someone else, our system may notify a member of the Booked55 team so a person can review it. This alert is a safety measure, separate from the quality review described above.

If you connect Booked55 to external AI clients through our MCP (Model Context Protocol) server, data shared with those clients is governed by the respective client's privacy policy in addition to this one. You control which tools and data are exposed through the MCP integration.

10. Meeting Recording and Transcription

This is off unless an administrator turns it on for the organization, and it then stays off for each person until they choose it themselves. In their profile each person picks whether the notetaker joins none of their calendar meetings (where everyone starts), only the meetings where a contact in Booked55 is invited, or all of them. For the meetings that choice covers, a notetaker joins the video meetings on that person's connected calendar — Zoom, Google Meet, Microsoft Teams, Webex and GoTo — records the call, and afterwards a transcript and a written summary appear on the meeting's task in Booked55. A person can also record a single meeting from its task. A person can change their choice at any time, and an administrator can turn the feature off for the organization at any time; either withdraws the notetaker from meetings it has not yet joined.

Everyone in the meeting is recorded, not only Booked55 users: the audio, video, screen share and chat of the call, and the display names of the people in it. If the meeting has guests from another company, their words are in that recording and in the transcript stored on the task.

How people are told. The notetaker appears in the participant list under a name that says it records — for example Acme Notetaker (recording), powered by Booked55 — and as soon as it joins it posts a message in the meeting chat saying the meeting is being recorded and transcribed. On Zoom the host is also asked to allow recording before anything is captured. Webex and GoTo do not let a participant post chat, so on those platforms the notetaker is visible in the participant list but cannot announce itself in writing.

What is never recorded. A calendar meeting outside what its owner chose to record, unless they press Record on that meeting themselves, a meeting the user declined, a meeting marked “Don't record” on its task, a calendar entry with no one else invited, an all-day entry, anything longer than eight hours, and anything without a supported video link.

Who decides, and who is responsible. The organization that turns recording on decides which meetings are recorded and for what purpose; we record and transcribe on its instructions, as its processor (Section 14). Recording laws differ by country and, in the United States, by state — some require every participant's consent. The organization is responsible for having a lawful basis and for giving whatever notice or obtaining whatever consent the law requires where its people and their guests are. The chat message is notice that recording is happening; it is not, by itself, consent.

Who processes it. The joining, recording and transcription are done by Recall.ai in the United States, which holds the recording and the transcript it produces; the written summary is generated by Cerebras from that transcript. Both are listed on our Subprocessors page, and neither uses the material to train its models.

If you were in a recorded meeting and want the recording, transcript or summary removed, ask the organization that recorded it — it controls that record and can delete it. You can also write to us at the address in Section 15 and we will pass the request on, or act on it directly where we are required to.

11. International Data Transfers

Your data may be processed in countries other than your country of residence, including the United States and Canada. When we transfer data internationally, we implement appropriate safeguards to protect your information, including contractual obligations with our service providers.

12. Children's Privacy

The Service is not intended for individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 16, we will take steps to delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through a notice on the Service prior to the change becoming effective. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

14. Your Contacts' Data (Controller and Processor)

Booked55 is a CRM, so most of the personal data in it is about people who never signed up for Booked55 — your contacts. It matters who is responsible for that data:

• For your own account data (your name, email, billing details, how you use the app) we are the controller — we decide how it is used, and this policy governs.
• For the CRM data you enter about your contacts and companies, you are the controller and we are your processor — we store and process it on your instructions and do not decide what it is used for.

As controller of your CRM data, you are responsible for having a lawful basis to collect and store information about your contacts, for telling them how their data is used where the law requires it, and for responding when one of them asks to access or delete their information. We will help you meet those requests — you can edit and delete contact records directly in the app, and you can contact us for assistance.

If you are a contact stored in someone's Booked55 account and want your information accessed, corrected, or deleted, the fastest route is to contact the business that holds your details, since they control that record. You may also write to us at the address below and we will forward your request to them and assist.

15. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data rights, or have a privacy concern, please contact us:

Email: [email protected]
Website: booked55.com/contact

If you are located in the EEA and believe we have not adequately addressed your data protection concern, you have the right to lodge a complaint with your local data protection authority.