BOOKING BUTLER PRIVACY POLICY
Last updated: 2026-10-20
WHO WE ARE
This Privacy Policy is issued by Market Leader Technologies Corporation, a Delaware corporation doing business as Booking Butler ("Booking Butler," "we," "us," or "our"). Our address is 73 Greentree Dr, Dover, DE 19904, United States.
This policy covers:
- our website, www.bookingbutler.ai
- the Booking Butler web application, app.bookingbutler.ai
- the Booking Butler iOS and Android apps
Together we call these the "Services." Words we capitalize, such as Customer Data, End User, and End User Data, mean what they mean in our Terms of Service at https://www.bookingbutler.ai/terms.
If you connect a Google account, such as Gmail, also read the Google User Data section below. It controls over the rest of this policy for data we receive from Google APIs.
THE SHORT VERSION: TWO GROUPS OF DATA
We handle personal information in two separate groups, and different rules apply to each.
Group 1: Website visitors, marketing contacts, and account holders. We are the controller. This is information about people who visit www.bookingbutler.ai, people we market to, and the businesses and staff who hold Booking Butler accounts (login, billing, and support details). We decide how it is used, and you exercise your rights directly with us. Cookies, pixels, analytics, and advertising apply only to website visitors in this group.
Group 2: Customer Data and End User Data inside the platform. Our customer is the controller and we are the processor. This is everything a business puts into or runs through Booking Butler: its contacts, calls, messages, emails, appointments, documents, and the information of the people who call, text, email, or chat with that business. We process it on the business's behalf, under its instructions and the Data Processing Addendum in Exhibit B of our Terms. We never sell it, we never use it for advertising or cross-context behavioral advertising, and we process it only to provide, secure, and support the Services.
If you spoke with an AI assistant and want your information deleted, contact the business you were trying to reach. That business controls your data. If you contact us instead, we will forward your request to them and tell you we have done so. See Section 9.
PART A: WEBSITE VISITORS, MARKETING CONTACTS, AND ACCOUNT HOLDERS (WE ARE CONTROLLER)
1. INFORMATION WE COLLECT
1.1 Information you give us
| Category | Examples |
|---|---|
| Account and identity | Name, business name, email, phone number, username, password, job title |
| Business profile | Business address, hours, services offered, website URL, industry, staff names and roles |
| Billing | Billing address, plan, transaction history, last four digits and card brand. Full card numbers are collected and stored by Stripe, not by us. |
| Support and sales | Messages you send us, demo requests, call notes, survey responses |
| Marketing | Newsletter signups, event registrations, email and text preferences |
We do not ask for, and do not want, Social Security numbers or other government identification numbers.
1.2 Information collected automatically on our website
Device and browser type, operating system, IP address, referring URL, pages viewed, links clicked, timestamps, cookie and session identifiers, and approximate location derived from IP address.
1.3 Information collected automatically in the app
When you use app.bookingbutler.ai or our mobile apps, we collect the technical information needed to run and secure them: device and browser type, operating system, IP address, session identifiers, features used, and crash and error reports. We do not use advertising cookies, pixels, or advertising SDKs in the app, and we do not track you across other companies' apps or websites.
Mobile app permissions. With your permission, our mobile apps may access:
- Notifications, to alert you to calls, messages, and tasks.
- Microphone, and phone state on Android, to place and receive calls in the app.
- Camera and photo library, to take or choose photos to send in messages and to save photos you receive.
- Contacts, only when you choose to import contacts into Booking Butler.
- Bluetooth and NFC, to connect to supported card readers and to take tap-to-pay payments.
- Location, while the app is in use, only to confirm that an in-person payment is taken from a supported region.
You can withdraw any of these permissions in your device settings.
1.4 Information from other sources
Business information from public web sources during onboarding, when our system reads your website to propose a business profile; information from integrations you connect, such as Google or Microsoft (see the Google User Data section); and payment and fraud signals from Stripe.
2. HOW WE USE GROUP 1 INFORMATION
We use it to: create and administer accounts; provide, secure, and improve the Services; process payments and prevent fraud; provide support; send service and administrative messages; send marketing where permitted, subject to your opt-out; measure website performance and the effectiveness of our own advertising; and comply with legal obligations, including telecommunications and messaging registration requirements.
3. COOKIES, PIXELS, ANALYTICS, AND ADVERTISING (WEBSITE ONLY)
On www.bookingbutler.ai we use:
- Strictly necessary cookies, for security and to make the site work.
- Analytics, through Google Analytics, to understand how visitors use the site.
- Advertising pixels, through Meta, to measure and improve our own ads on our marketing pages. We do not place advertising pixels on our Privacy Policy, Terms of Service, Acceptable Use Policy, or subprocessors pages.
These tools may collect the identifiers and internet activity described in Section 1.2. This is the only information we share for advertising. No information from inside the platform, whether account data, Customer Data, or End User Data, is used for advertising.
Your choices. You can block or delete cookies in your browser settings. We treat a Global Privacy Control signal from your browser as a request to opt out of sharing for targeted advertising for that browser.
4. LEGAL BASES (EEA, UK, AND OTHER APPLICABLE JURISDICTIONS)
| Purpose | Basis |
|---|---|
| Providing the Services to a customer | Performance of a contract |
| Billing and fraud prevention | Contract; legal obligation; legitimate interests |
| Security, logging, and abuse prevention | Legitimate interests |
| Website analytics and advertising | Consent where required; otherwise legitimate interests |
| Marketing to business contacts | Consent, or legitimate interests where permitted |
| Regulatory registration (10DLC, tax) | Legal obligation |
You may object to processing based on legitimate interests. See Section 13.
PART B: CUSTOMER DATA AND END USER DATA (CUSTOMER IS CONTROLLER, WE ARE PROCESSOR)
5. WHAT WE PROCESS FOR OUR CUSTOMERS
When a business uses Booking Butler, the following flows through our systems on its behalf:
- Voice. Recordings of inbound and outbound calls, transcripts, caller phone number and caller ID name, and call details such as time, duration, routing, transfers, and hold time.
- Messaging. SMS and MMS content and attachments, email content, headers, threads and attachments, and web chat transcripts and uploaded files.
- Contacts and CRM. Names, phone numbers, email addresses, addresses, custom fields, tags, notes, and conversation history.
- Scheduling. Appointment times, services, assigned staff, and calendar availability.
- Conversation memory. Summaries of earlier conversations with the same contact, used so the business can pick up where it left off.
- Knowledge base. Documents the business uploads, such as PDFs, Word files, and scanned images, and the text extracted from them.
- Consent records. Opt-in and opt-out events by channel and purpose, with timestamps, source, and suppression status.
- Payments. Invoice line items, amounts, payment status, and Stripe transaction identifiers.
6. HOW WE USE CUSTOMER DATA AND END USER DATA
We process Customer Data and End User Data only:
- to provide, secure, support, and maintain the Services;
- on the customer's documented instructions, including through how the customer configures the Services; and
- as required by law.
We never sell Customer Data or End User Data. We never use it for advertising or share it for cross-context behavioral advertising. We do not use it for our own marketing, and we do not combine it with data from other sources except as the law allows. These commitments come from Section B2 of our Data Processing Addendum.
6.1 Call recordings and voice data
Calls handled by the Services are recorded and transcribed by default. Recording law varies by state, and some states require every party's consent. The business operating the AI agent is responsible for giving the disclosure the law requires. We provide disclosure prompts and recommend turning them on for every channel.
We do not create voiceprints and do not use voice recordings to identify or authenticate individuals. We do not use voice data for biometric identification under the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act, or similar laws.
Our AI agents speak with synthetic voices licensed from ElevenLabs. They are not recordings of the business owner or staff unless a customer has separately supplied, and obtained consent for, a voice.
6.2 Data we ask customers not to send us
Our Terms prohibit customers from putting government identification numbers, financial account numbers, full payment card numbers, health information covered by HIPAA without a signed agreement, and data about minors into the Services. See Section 10 of our Terms.
7. ARTIFICIAL INTELLIGENCE
To provide AI features, we send the content needed for each feature to these AI providers:
| Provider | What it does for us |
|---|---|
| OpenAI | Language model responses, summaries, drafting, and document understanding |
| Anthropic | Language model responses, summaries, drafting, and document understanding |
| ElevenLabs | Text-to-speech for AI voice agents |
| AssemblyAI | Speech recognition and call transcription |
These providers process data only to provide those features to us, as our service providers.
We do not use Customer Data to train general-purpose AI models, and our contracts with these providers prohibit them from training their models on it. This matches Section 9.5 of our Terms.
Automated decisions. The Services answer messages, book appointments, and route calls automatically. These are operational actions, not decisions with legal or similarly significant effects on a person. We do not use the Services to make automated decisions about credit, housing, insurance, employment, or education, and our Terms prohibit customers from doing so.
8. RESELLERS
If you are a client of an agency that resells Booking Butler under its own brand, that agency can administer your account and see its data. For your data, the agency is a processor and we are its subprocessor. The agency is responsible for its own privacy disclosures to you.
9. IF YOU TALKED WITH AN AI AGENT
If you called, texted, emailed, or chatted with a business and reached a Booking Butler AI assistant:
- The business you contacted controls your information, not us. Send access and deletion requests to that business.
- If you contact us instead, we will forward your request to that business within 10 business days and tell you we have done so. We generally cannot act on it ourselves without the business's instruction.
- To stop receiving messages, reply STOP to a text or use the unsubscribe link in an email. This is honored right away and across channels, no matter who controls the data.
- If a business does not respond, you may complain to your state attorney general or, in the EEA or UK, your data protection authority.
PART C: RULES FOR BOTH GROUPS
10. WHO WE SHARE INFORMATION WITH
10.1 Service providers and subprocessors
We share information with service providers that help us run the Services, such as cloud hosting (Amazon Web Services), website hosting (Vercel), telephony and messaging (Twilio), payments (Stripe), the AI providers in Section 7, email and calendar integrations you connect (Google, Microsoft), and website analytics and advertising measurement (Google, Meta). They may use the information only to provide their services to us.
The current list of subprocessors that handle Customer Data and End User Data is at https://www.bookingbutler.ai/subprocessors. We give customers at least 30 days' notice before adding one.
10.2 Between businesses and the people they talk to
Information you give an AI agent is made available to the business you contacted. That is how the service works.
10.3 Mobile and SMS data
No mobile information, including SMS opt-in consent data, is shared with third parties or affiliates for marketing or promotional purposes. Sharing with subcontractors that support the service, such as our messaging carrier, is allowed for that purpose only.
10.4 Other disclosures
We may disclose information: to comply with law, subpoena, or court order; to carriers and regulators where required for messaging registration or abuse investigation; to enforce our Terms; to protect rights, safety, and property; to professional advisors under confidentiality; and in a merger, acquisition, financing, or sale of assets, with notice to affected customers.
10.5 Aggregated and de-identified data
We may create aggregated and de-identified statistics, for example about how the Services perform, that do not identify any customer, user, or End User. We do not try to re-identify this data and require the same of anyone we give it to. This does not apply to data received from Google APIs.
11. RETENTION
| Data | Retention |
|---|---|
| Customer Data after your account ends | Available for export for 30 days after termination, then deleted within 90 days |
| Backups | Deleted on our backup cycle, currently 35 days |
| Call recordings, transcripts, and message content | Set by the customer; platform default 12 months, maximum 24 months |
| Synced Gmail data | Deleted within 30 days after you disconnect Gmail or delete your account |
| Conversation memory summaries | Life of the contact record, unless deleted sooner |
| Uploaded knowledge documents | Until the customer deletes them |
| Account and business profile | Life of the account, then deleted as above |
| Consent and opt-out records | 5 years after the last interaction, to prove compliance |
| Invoices and payment records | 7 years, for tax and accounting |
| Security and access logs | 12 months |
| Marketing contacts | Until you unsubscribe, then a suppression record only |
We may keep information longer where the law requires it, or for fraud prevention and legal claims. Opt-out and suppression records outlive other data, because deleting them would let us contact someone who asked us not to.
12. SECURITY
We use encryption in transit and at rest, role-based access controls, least-privilege administrative access, audit logging, secure development practices, vendor security review, and periodic testing.
No system is perfectly secure, and we cannot promise that no one will ever get past our safeguards. Report a suspected vulnerability or incident to security@bookingbutler.ai.
13. YOUR RIGHTS
13.1 U.S. state privacy rights
If you live in California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to: confirm whether we process your information; access it; correct it; delete it; get a portable copy; opt out of sale, sharing for targeted advertising, and certain profiling; limit use of sensitive personal information; and not be discriminated against for using these rights.
These rights apply to Group 1 information. For Customer Data and End User Data, send your request to the business that controls it (see Section 9).
What we collect, and what we sell or share. In the last 12 months we collected the following categories of personal information. "Shared" means shared for cross-context behavioral advertising.
| Category | Examples | Sold or shared? |
|---|---|---|
| Identifiers | Name, email, phone number, IP address, cookie and device identifiers | Website visitors only: cookie identifiers and IP address shared with advertising partners. Not sold. |
| Internet or network activity | Pages viewed and links clicked on our website; feature use and error reports in the app | Website visitors only: website browsing activity shared with advertising partners. Not sold. |
| Customer records | Billing address, transaction history | No |
| Commercial information | Plan, purchases, payment history | No |
| Approximate location | Location derived from IP address | No |
| Precise location | Mobile app location while in use, only to confirm an in-person payment region | No |
| Audio and electronic information | Support calls and messages with us | No |
| Professional information | Job title, business name and role | No |
| Account login | Username and password | No |
We do not sell personal information. The only personal information we share for advertising is website visitor identifiers and internet activity from www.bookingbutler.ai. Customer Data, End User Data, and the content of calls, emails, and text messages are never sold or shared.
Sensitive personal information. The only sensitive personal information we collect is account login credentials and, in the mobile app, precise location for payment checks. We use them only to provide and secure the Services and not to infer characteristics about you.
How to use your rights: submit a request at https://www.bookingbutler.ai/privacy-requests or email privacy@bookingbutler.ai. To opt out of sharing for targeted advertising, use that page or turn on Global Privacy Control in your browser. We will verify your identity before acting and respond within the time your state's law requires, generally 45 days, with one extension where allowed. An authorized agent may submit a request for you with proof of authorization.
Appeals. If we decline your request, you may appeal by emailing privacy@bookingbutler.ai with "Appeal" in the subject line. We will answer in writing. If we deny the appeal, you may complain to your state attorney general.
13.2 EEA, UK, and Swiss rights
Access, correction, erasure, restriction, portability, objection, withdrawal of consent, and the right to complain to your data protection authority. Withdrawing consent does not affect processing already done.
13.3 Canada
Access and correction rights under PIPEDA, and the right to withdraw consent, subject to legal and contractual limits.
13.4 Marketing opt-out
Use the unsubscribe link in our emails, reply STOP to our texts, or email privacy@bookingbutler.ai. Service and billing messages continue while your account is active.
13.5 Account deletion
Delete your account at https://www.bookingbutler.ai/account-deletion or by emailing privacy@bookingbutler.ai. Export your data first. See Section 11 for what happens afterward.
14. CHILDREN
The Services are for business use by adults. We do not knowingly collect information from anyone under 18, and our Terms prohibit customers from submitting data about minors. If you believe we hold information about a child, contact privacy@bookingbutler.ai and we will delete it or pass the request to the customer that controls it.
15. INTERNATIONAL TRANSFERS
We operate in the United States, and our service providers may process information in other countries. We do not currently offer the Services to customers in the European Economic Area or the United Kingdom. If that changes, we will put an appropriate transfer mechanism in place and update this policy.
16. CHANGES
We will update this policy as our practices and the law change. We will announce material changes by email or in-product notice at least 14 days before they take effect. The "Last updated" date always shows the current version.
GOOGLE USER DATA
This section controls over the rest of this Privacy Policy for data we receive from Google APIs. If anything elsewhere in this policy or in our Terms conflicts with this section, this section applies.
Booking Butler's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
- What we access: If you connect a Gmail account, we read and store emails exchanged with your contacts (or only contacts already in Booking Butler, if your organization enables that setting), and we send emails you write or approve in Booking Butler.
- How we use it: Only to display those emails in your CRM, send email on your behalf, and power AI drafting features you choose to use.
- Sharing: Only with service providers needed to run these features, such as hosting and AI processing providers, who process it solely on our behalf. We do not sell Google user data, use it for advertising, use it to train generalized AI or machine learning models, or include it in aggregated or de-identified data used for other purposes.
- Human access: Our staff do not read your Google user data unless you give us permission, it is needed for security purposes such as investigating abuse, or it is required by law.
- Deletion: When you disconnect Gmail or delete your account, we delete your synced email data within 30 days.
17. CONTACT
Market Leader Technologies Corporation, doing business as Booking Butler 73 Greentree Dr, Dover, DE 19904, United States
Legal: legal@bookingbutler.ai Privacy: privacy@bookingbutler.ai Security: security@bookingbutler.ai Support: support@marketleadertechnologies.com
Privacy requests: https://www.bookingbutler.ai/privacy-requests Account deletion: https://www.bookingbutler.ai/account-deletion Subprocessors: https://www.bookingbutler.ai/subprocessors
End of document.