Bookmaker Privacy Policy

2.1 When we are the controller

We decide why and how the following personal data is used, so we are the controller (under the NDPA, the "data controller"; under US state laws, the "business"):

• account holders and team members: their account, sign-in and profile details;
• visitors to our website and public pages;
• billing contacts and purchase records;
• sign-in security, fraud prevention and abuse prevention data;
• pricing-region evidence (see section 17);
• support conversations with us;
• our own security and audit logs, including records of what our staff do in the Service.

2.2 When we are the processor

For Customer Data, the Customer decides why and how it is used. The Customer is the controller and we are its processor (under US state laws, its "service provider" or "processor"). We process Customer Data to provide the Service to that Customer, on its instructions as set out in our Terms of Service, including the Data Processing Terms in Annex A (https://bookmaker.celartech.com/terms#dpa).

We also use limited parts of Customer Data for our own legitimate purposes that are needed to run the Service safely and lawfully. These are: keeping the Service secure, preventing fraud, spam and abuse (for example, monitoring email bounce and complaint rates), counting usage against plan limits, billing, and meeting our legal obligations. We do not use Customer Data for advertising.

The Customer is responsible for having a lawful basis to collect Customer Data and put it into Bookmaker, and for giving the people concerned any notices the law requires.

2.3 If a business sent you something through Bookmaker

If you received an invoice, quotation, signing request, call or text message from a business that uses Bookmaker, that business controls your data. Please contact that business first with any question or request about your data. If you contact us instead, we will pass your request to the business where we can identify it, and help it respond. We may also handle requests ourselves where the law requires us to, for example a request to stop calls or texts (see section 6.6).

3.1 Data you give us

• Sign-up details. Your name, email address and password, the name of your organisation, its country and its base currency. You must use a password of at least 12 characters. We store only a scrambled form of it (a "hash"), never the password itself.
• Profile and workspace details. Your organisation's legal name, email, phone, website, tax number, business number, address, country, currency, time zone, logo, brand colours, fonts, signature and stamp images, and default payment instructions (such as bank details you want shown on invoices). Also the names, emails and roles of team members you invite.
• Two-factor authentication. If you turn on two-factor authentication (2FA), we store an encrypted secret for your authenticator app and scrambled (hashed) copies of your recovery codes.
• Billing details. Your billing email and, where Stripe asks for them, a billing address and tax ID. You enter card details only on pages run by Stripe. Bookmaker does not receive or store your full card number.
• Customer Data. Everything you put into the Service about your customers and others (see section 2.2).
• AI inputs. Messages you type to the assistant, descriptions or sample files you give to template design, and documents you ask the signing AI to draft or summarise.
• Communications. What you send us when you contact support or email us.

3.2 Data we collect automatically

• Sessions and cookies. A session cookie keeps you signed in. We store only a hashed form of the session token, with your user and Workspace, its expiry and when it was created. See section 10.
• Sign-in and security records. Failed sign-in counts, temporary account locks, and short-lived rate-limit records keyed to a hashed form of your network (IP) address. These help stop password-guessing.
• Acceptance of our Terms and acknowledgement of this policy. When you accept our Terms of Service and acknowledge this Privacy Policy (when you sign up, continue with Google to create an account, create an account to accept an invitation, or agree in the Service, for example to an updated version), we record which version of each was shown to you, when, and how, with your browser's user agent (up to 400 characters) and, where available, a keyed hash of your IP address (never the address itself).
• Audit logs. For each change made in the Service, we record who made it, what changed, when, the route and result, your browser's full "user agent" string and the browser, operating system and device type read from it, the referring page, an approximate country, a keyed hash of your IP address and the first part of your IP address (the network prefix, not the full address). Details of what changed are encrypted, or left out. See section 14.
• Activity feed. Your Workspace's activity feed shows team members what happened in the Workspace (for example, "invoice sent").
• Country and region evidence. Our network provider tells us which country a request comes from. We record the country of the network you sign up from. When paid plans are switched on, we also record the country of each sign-in, and of each User's first visit each day, with a keyed hash of the IP address (never the address itself). We use this for regional pricing (see section 17).
• Technical and error logs. Error messages, request identifiers, the page or route, the status and timing, and the User and Workspace involved. Before storing these logs, we filter out fields that hold passwords, tokens, cookies and keys, bank, card and account numbers, tax and business numbers, national ID and passport numbers and dates of birth, and we scan messages for credentials. Other details, such as names, phone numbers or addresses, can appear in an error message.
• Analytics. Only if you accept analytics cookies, through Google Analytics: which pages are viewed (record IDs and query strings are removed from the page addresses sent to Google), and standard device, browser and approximate location information that Google Analytics collects. See section 10.3.
• Document views. When someone opens a Customer's document through its customer link, we record that the document was viewed and when it was first opened.
• Usage counts. How many e-signature requests, AI messages, AI template imports and email recipients a Workspace (and, on the Free plan, its creator) has used in a period.

3.3 Data we receive from others

• Google sign-in. If you choose "Continue with Google", Google sends us your Google account ID, email address, whether Google has verified that email, and your name. We do not receive your Google password. We do not store your Google profile picture or any Google access token.
• Stripe. Stripe tells us about payments, subscriptions, invoices, refunds, disputes and fraud warnings. That includes amounts, currencies, Stripe reference IDs, and whether a payment succeeded.
• Email providers. Our email provider tells us when an email bounces or is marked as spam.
• Customers. Customers give us Customer Data, for example a lead's details and consent record sent from the Customer's web form or CRM.
• Integrations you connect. If you connect Google Calendar or HubSpot to AI Calling, we receive the calendar availability and contact information needed for the features you use.

3.4 What we use it for and our lawful basis

If you are in the European Economic Area (EEA), the United Kingdom (UK), Nigeria or another place with similar laws, we must have a lawful basis for each use of your personal data. The table below sets these out for data we control. For Customer Data, the Customer decides the lawful basis.

We do not currently send marketing emails. If we start, we will ask for your consent where the law requires it, and every marketing email will include a way to unsubscribe.

Where we rely on consent (for example, for analytics cookies), you can withdraw it at any time. That does not affect what we did before you withdrew it.

Where we rely on legitimate interests, we have weighed our interests against your rights. You can ask us for details, and you can object (see section 15).

3.5 Data we do not ask for

We do not ask for special categories of data, such as health information, racial or ethnic origin, religious beliefs or biometric data. Bookmaker does not create voiceprints from call audio. Please do not put such data into the Service unless you have a lawful basis to do so and it is needed.

If you do not give us the information marked as required, we cannot create your account or provide the related feature.

5.1 Where AI requests go

Depending on the feature and on how the Service is configured, AI requests go to one of these:

• Our private AI server. We run an open-source model on a server we control (see section 11). Requests reach it through an encrypted private tunnel. No outside AI company receives this data. This server logs only request IDs, status and timing.
• OpenRouter. OpenRouter, Inc. is a service that routes AI requests to many model providers ("upstream providers"). These can include, for example, NVIDIA, Google, dots.ai and, for search indexing, OpenAI.

For paid models, we ask OpenRouter to route the request only to providers that do not keep it or use it for training ("data collection: deny"). Free models may be served by providers that log requests or use them to improve their models. You can contact us to ask which provider the Service currently uses for each feature.

5.2 What each AI feature sends

We keep:

• Assistant chats until the User deletes them or the Workspace is deleted. Each User can keep up to 100 chats. Chats are private to the User within the Workspace.
• Document-drafting conversations: unfinished or abandoned ones are deleted 7 days after they were last used. A conversation that produced a document is kept, with up to 40 messages, until the Workspace is deleted.
• Search index entries (text excerpts and their numerical representations) while semantic search is on. If a Workspace's plan no longer includes semantic search, they are deleted 90 days later.
• A log of each signing AI request: Workspace, User, purpose, model, token count and cost. This log does not hold the text.

5.3 Connected AI apps

On plans that include it, a User can connect an outside AI app (for example Claude, ChatGPT, Cursor or VS Code) to Bookmaker. The User approves the connection on a consent screen and chooses its permissions. The app can only do what the User's role allows. The app then receives whatever data it reads from Bookmaker. That app's provider is not our processor; its own terms and privacy policy apply. A User can disconnect an app at any time. Bookmaker does not send data to an AI model as part of these connections.

6.1 Who is responsible

For calls and texts, the Customer is the controller. It decides whom to call or text, why, and what the agent says. It is responsible for meeting the laws on calls, texts and recordings that apply to it. In the US these include the Telephone Consumer Protection Act, state telemarketing and call-recording laws, and do-not-call rules. We provide tools to help (section 6.4). We do not check numbers against the US National Do Not Call Registry. The Customer must do this where the law requires it.

6.2 What is collected

• Leads and contacts. Name, phone number, email, company, notes and time zone.
• Permission evidence. Each phone number's permission to be called or texted: how and when it was given, the exact statement agreed to, the web page it came from and, where the Customer's form or CRM provides them, the IP address and browser details of the person who gave it. Bookmaker stores this IP address as received.
• Call records. Phone numbers, times, duration, outcome and call events, transfers and bookings.
• Call audio and transcripts. Live call audio is processed so the agent can listen and reply. Calls are recorded only where recording is on and the Service has recording storage set up. Payment card numbers are always removed from transcripts, and ID numbers are removed by default.
• Text messages. Follow-up texts, verification codes for a Customer's own phone number, and replies including opt-outs.
• Opt-outs. Numbers that have asked not to be contacted.

6.3 Which providers handle call data

Depending on configuration:

• Telnyx carries calls and texts, and briefly holds recordings until Bookmaker copies them, after which Telnyx's copy is deleted.
• Deepgram turns speech into text and the agent's replies into speech. Inworld may also turn replies into speech.
• Google (Gemini API) generates the agent's replies from the agent's instructions, the Customer's business information and the live transcript. OpenAI or Groq are used instead if the Customer selects them or as a fallback. We use Gemini only under Google's paid API terms, under which Google does not use the content to improve its products.
• Cloudflare R2, or our own servers, store recordings privately. Members get a link that works for 10 minutes.

For tests and demonstrations, some Workspaces may use a test setup instead. This uses speech software running on our servers, our private AI server, Groq, or a free OpenRouter model requested with "data collection: deny".

If a Customer connects Google Calendar, HubSpot or its own webhook address, call outcomes and booking details go to that service on the Customer's instructions. These services are chosen and controlled by the Customer.

6.4 Notices and safeguards built in

• Every call starts with a statement that the caller is an AI. This cannot be switched off.
• When recording is on, a recording notice follows (by default, "This call may be recorded for quality."). The Customer can change its wording.
• Automatic calls go only to numbers with recorded, unwithdrawn permission, or for existing-customer campaigns, to existing customers with a prior business relationship.
• Calls are not placed outside 08:00 to 21:00 in the recipient's local time. If the time zone is unknown, the call is held for manual review.
• Automatic attempts are limited to 3 per number in any 7 days, at least 4 hours apart.

6.5 How long call data is kept

• Recordings: deleted after the period the Customer sets, and in any case after no more than 30 days.
• Transcripts: deleted after the period the Customer sets, and in any case after no more than 90 days.
• Other call data (leads, call records, permission evidence, bookings): kept for as long as the Workspace exists, unless the Customer deletes it sooner.
• Opt-outs: kept for as long as the Workspace exists, so they keep being honoured. They are never lifted automatically. A Workspace owner can remove an entry, but that does not restore the permission that was withdrawn.

6.6 Stopping calls and texts

Reply STOP to any text, or tell the agent during a call that you do not want to be contacted. Your number is then blocked for both calls and texts from that Customer, and pending calls are cancelled. Texts always include "Reply STOP to opt out." You can also email us at [email protected] and we will pass your request on.

6.7 Text messaging

We do not sell, rent or share mobile phone numbers, or text-messaging opt-in data or consent, with third parties or affiliates for their marketing or promotional purposes. Mobile information is shared only with the service providers listed in section 11.1 that help us deliver the Service, such as our carrier, and with services the Customer chooses to connect (section 6.3). It is never shared for anyone's marketing or promotional purposes. Reply STOP to opt out. Message and data rates may apply. Message frequency varies.

10.1 Strictly necessary cookies

These cookies are needed for sign-in, security and features you ask for. They cannot be switched off without breaking the Service.

10.2 Preference cookies and browser storage

10.3 Analytics cookies (Google Analytics)

We use Google Analytics 4, provided by Google, to understand how the Service is used. If you accept analytics cookies, it runs on our website and on most signed-in pages. It does not run on customer document links, signing pages, invitation, password-reset and email-verification pages, or our internal pages.

Your choice. Google Analytics does not load, and sets no cookies, until you accept analytics cookies. The first time you open a page where it can run, our cookie banner asks you to accept or reject them. We ask everyone, wherever they are. If you reject them, or make no choice, Google Analytics does not load. We remember your choice for 1 year in the bookmaker_consent cookie (section 10.2), and then ask again. You can change your choice at any time through the "Cookie settings" link in the footer of our website, our help centre and the signed-in app. If you change it to reject, we switch Google Analytics off in that browser and delete its _ga cookies.

We send page views ourselves. Google Analytics also sends some automatic events of its own, such as the start of a visit and how long a page was in use. In the page address and title sent to Google with all of these, we replace record IDs with "[id]", drop query strings and fragments, and use that redacted address as the title. When you arrive from another of our pages, its address is left out. Google's advertising features are switched off: advertising storage, ad user data and ad personalisation are all set to "denied". We have also switched off Google signals and Google Analytics data sharing, and Google processes this data for us under its data processing terms. Google Analytics data is kept for no more than 14 months.

Google Analytics sets its own cookies. According to Google, these are normally _ga and _ga_<ID>, which last up to 2 years. Google Analytics also collects your IP address to estimate your general location and device and browser information. Google's privacy policy is at https://policies.google.com/privacy.

10.4 How to control cookies

• Most browsers let you block or delete cookies. If you block strictly necessary cookies, you will not be able to sign in.
• Google Analytics stays off unless you accept it in our cookie banner. You can accept or reject Google Analytics cookies, or change your choice, through the "Cookie settings" link in the footer of our website, our help centre and the signed-in app. If you delete the bookmaker_consent cookie, the banner asks you again.
• You can also stop Google Analytics in your browser with Google's opt-out add-on at https://tools.google.com/dlpage/gaoptout, or by blocking cookies from google-analytics.com and googletagmanager.com.
• See section 19 for Do Not Track and Global Privacy Control.

11.1 Service providers (sub-processors)

We use the providers below to run the Service. They may use the data only to provide their service to us, under their data processing terms with us, except as stated in section 11.2. Some providers are used only when a particular feature is switched on.

You can ask us at any time for the current list of the specific third parties we have disclosed personal data to.

11.2 Independent controllers

• Stripe. Where Stripe acts as the seller of record for our plans ("Stripe Managed Payments"), Stripe sells the plan to you, takes payment, and handles sales tax, VAT, fraud and disputes. It is then a separate controller of your purchase and payment data, under its own privacy policy (https://stripe.com/privacy). In all cases, Stripe also uses payment data for its own legal, fraud-prevention and compliance duties as an independent controller.
• Google, for your Google account when you use "Continue with Google".
• Services you connect. Connected AI apps, HubSpot, Google Calendar and webhook addresses receive data because a Customer or User chose to connect them.

11.3 Within your Workspace and to recipients

Other members of your Workspace can see records and activity according to their roles. Documents, emails, texts and calls you send go to the recipients you choose, together with your business details.

11.4 Our staff

A small number of authorised staff can access the Service to provide support, keep it secure, investigate problems and enforce our Terms. To work inside a Workspace, staff must open a support session and record a reason. The session acts as one member, with that member's permissions, and staff can view and change records in it. It ends after 30 minutes. Staff cannot download PDFs, export data, reset passwords, change billing, use the assistant, or launch calls or campaigns during a support session. Changes made in a session appear in the Workspace's activity log under that member, and each session is logged by us. Staff in a support session are not asked to accept our Terms or acknowledge this policy, and cannot do so for the member.

11.5 Legal requests and protection

We may disclose personal data if we believe in good faith that it is needed to:

• comply with a law, regulation, court order or lawful request from a public authority;
• enforce our Terms;
• detect or prevent fraud, security problems or abuse;
• protect the rights, property or safety of Celar, our Customers, Users or the public.

Where the law allows, we will tell the affected Customer before disclosing Customer Data. We may challenge requests we consider unlawful or excessive.

11.6 Business transfers

If Celar is involved in a merger, acquisition, financing, reorganisation, bankruptcy or sale of all or part of its business, personal data may be transferred as part of that transaction. The new owner will be bound by this policy, or we will tell you before your data becomes subject to a different policy.

11.7 With your instructions or consent

We share personal data in other ways when you ask us to or agree to it.

15.1 Rights we offer everyone

Privacy laws differ from place to place. Some only apply to larger companies or to consumers rather than businesses. We will honour the following rights where the law that applies to you gives them to you, and we will consider requests from anyone else in good faith and act on them where reasonably practicable, subject to the limits and exceptions the law allows:

• Access: confirm whether we process your personal data and get a copy of it.
• Correction: fix inaccurate or incomplete data. You can change most account details yourself in Settings.
• Deletion: ask us to delete your personal data.
• Portability: where the law requires it, get a copy of personal data you gave us in a structured, commonly used, machine-readable format, and have it sent to another provider where that is technically feasible. You can also export customers, products, documents and reports yourself in CSV, PDF and other formats.
• Restriction: ask us to limit how we use your data while a concern is sorted out.
• Objection: object to uses based on our legitimate interests. We will stop unless we have compelling grounds or need the data for legal claims.
• Withdrawing consent: where we rely on consent, withdraw it at any time.
• Questioning automated decisions: see section 17.
• Knowing who receives your data: ask for the list of specific third parties we have disclosed your personal data to.
• No unfair treatment: we will not treat you differently, charge you more or offer a lower level of service because you used these rights.

If your request is about Customer Data (for example, you are a customer of a business that uses Bookmaker), please contact that business. We will help it respond (section 2.3).

15.2 EEA, UK and Switzerland

Under the EU and UK General Data Protection Regulation (GDPR) and the Swiss data protection law, you have the rights in section 15.1. You also have the right to complain to a data protection supervisory authority, in particular in the country where you live or work or where you think the law was broken. In the UK, this is the Information Commissioner's Office (ico.org.uk). We would welcome the chance to sort out your concern first.

15.3 Nigeria

Under the Nigeria Data Protection Act 2023 (NDPA), you have the rights in section 15.1. You can also complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

15.4 California

This section applies to California residents to the extent the CCPA applies to us. It is our notice at collection under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA).

Categories of personal information we have collected in the past 12 months:

We collect this information from the sources in section 3, for the purposes in sections 3.4 and 4, and keep it for the periods in section 13.

We do not sell or share personal information, and have not done so in the past 12 months. We do not knowingly sell or share the personal information of anyone under 16. We use sensitive personal information only for purposes permitted by the CCPA, so the right to limit its use does not apply.

You have the right to know what we collect, use and disclose, and to access it; to delete it; to correct it; to opt out of sale or sharing (we do not sell or share, but you may still ask); and not to be discriminated against for using these rights. You can use an authorised agent (section 16).

15.5 Minnesota

To the extent the Minnesota Consumer Data Privacy Act applies to us, you have the rights in section 15.1, including the right to:

• opt out of targeted advertising, the sale of your data, and profiling that leads to decisions with legal or similarly significant effects. We do not sell personal data, and we do not use it for targeted advertising or for such profiling;
• question the result of a profiling decision: to be told the reason for the decision, to review the personal data used, to correct it if it is wrong, and to have the decision looked at again using the corrected data;
• get a list of the specific third parties to which we have disclosed your personal data.

If we decline your request, you can appeal (section 16). If you are not satisfied with the result of your appeal, you can contact the Minnesota Attorney General (ag.state.mn.us).

15.6 Other US states

Residents of other US states with consumer privacy laws (such as Colorado, Connecticut, Virginia, Texas and Oregon) have the rights in section 15.1, including the right to appeal. If we decline your appeal, you can contact your state's attorney general.

17.1 Pricing region (Nigeria status)

Businesses based in Nigeria can use Bookmaker's core plans at no cost ("Nigeria status"). To decide whether a Workspace qualifies, Bookmaker compares:

• the country declared when the Workspace was created;
• the country of the network used to sign up and sign in, as reported by our network provider (from the IP address; for this purpose we store only the country and a keyed hash of the IP address);
• how long a member has been an owner, how often the Workspace's country has changed, and where its members sign in from.

Based on these signals, a Workspace may be given Nigeria status, kept as "pending", or flagged for review. A pending Workspace that is not confirmed after 30 days gets an email, and loses pending status 14 days later if nothing changes. Decisions to withdraw Nigeria status from a Workspace that has it are made by a person, not automatically, and we give owners 30 days' notice. A network country can be wrong, for example when you use a VPN. If you think a decision is wrong, an owner can ask for a review, or you can email [email protected]. A member of our staff will review the evidence and decide.

17.2 Other automatic safeguards

• Account locks and rate limits. These are temporary and lift on their own.
• Email sending suspension. Sending stops when a Workspace's spam complaints exceed 0.3%, or its hard bounces exceed 5%, of its latest 500 emails. A person reviews and lifts the suspension.
• Fraud and dispute holds. Where Stripe reports an early fraud warning or a payment dispute, the affected plan may be refunded, paused or ended, and new purchases blocked for a period. Contact us to have this reviewed.

You can contest any of these decisions, give your point of view, and have a person look at it, by emailing [email protected].