Privacy Policy

Who this covers

Just a Good Guy is software that small businesses use to answer their website chat, phone and texts, take bookings and host their website. There are two kinds of people whose information we handle:

• Business owners and their staff, who have accounts with us.
• Their customers and website visitors, who chat, call, text or book with a business that uses us.

Each business decides what it collects from its own customers and controls its customer records. If you are a customer of a business that uses Just a Good Guy, that business is your first point of contact for questions about your information.

Website visitors

Visit counting without cookies

The widget on a business's website counts page views and how many people open it. It does not use cookies, and on a normal page view it stores nothing on your device.

To count unique visitors, we combine your internet (IP) address and browser type with a secret and the current date, and keep only a shortened, one-way hash of the result. Because the date is part of the hash, the same visitor gets a different value every day, so visits cannot be linked from one day to the next. We do not keep your IP address for this. For each visit we also keep the page's path (without anything after a ?) and the referring page, up to 300 characters.

Raw visit records are deleted after 18 months.

What the widget stores in your browser

Only after you open the chat or submit a form, the widget saves two values in your browser's local storage, for that business only: a random visitor code it creates, and the id of your current conversation. They let the chat carry on after a page reload, and let the business's receptionist recognise you on that browser if you verified who you are earlier. You can remove them by clearing your browser's site data.

Fonts

The widget and our pages load the Figtree font from Google Fonts unless a website turns that off. Like any web request, this tells Google your IP address.

Chats, calls and texts

Website chat

When you chat with a business's receptionist, we store the messages you send and the replies, the address of the page you were on (up to 300 characters), the visitor code from your browser, and a hash of your IP address made with the same day-changing method as visit counting. The hash is used to limit abuse, for example to stop one source from holding too many bookings. The business can read the conversation and reply to you.

Phone calls

When you call a business's Just a Good Guy number, we store your phone number (from caller ID), the call's length, and the text of the conversation. Twilio turns speech into text and text into speech for us. Our system stores the text of what was said; it does not save the call audio.

Text messages

When you text a business's number, we store your number and the messages in both directions. Texting STOP (or STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT) marks you as opted out with that business, and we stop sending you texts on its behalf. Texting START, UNSTOP or YES opts you back in.

Texts you agree to

Next to your mobile number, when you book, ask for a call-back or send a message, there's a box to get texts about it. It starts unticked and you don't have to tick it to book. If you tick it, or tell the receptionist yes when it asks, that business texts you about it: booking confirmations, reminders, changes, and replies to your questions. We record when and how you said yes. If you text a business first, it replies by text. How many texts depends on your bookings, usually a few for each one. Message and data rates may apply. Reply STOP to stop or HELP for help, at any time.

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. No mobile information is shared with third parties or affiliates for marketing or promotional purposes, and text-message opt-in details and consent are never shared with anyone. Your number is used only to message you on behalf of the business you contacted.

WhatsApp and email

If you message a business on WhatsApp or by email, we store your WhatsApp number or email address and the messages in both directions, the same as texts. Sending STOP on WhatsApp stops further WhatsApp messages from that business.

Messages sent on a business's behalf

Confirmations, reminders, verification codes and waitlist offers use fixed wording. The AI does not write them.

Customer details that businesses keep

When you book, ask for a call-back or send a message, the business gets a customer record with what you gave: your name, phone number and email, and for visits at your home, your address. The record also holds:

• your bookings, call-back requests and messages, and any notes you added
• notes the business writes about you, and tags
• things you told the receptionist about yourself that you'd want remembered, such as a preference or an allergy, if the business has that turned on
• figures worked out from your bookings: number of visits, no-shows, amount spent, and your usual service, person and time
• whether you've opted out of texts

The receptionist only talks about your existing bookings after it has checked who you are: by your phone number when you call or text, or by a 6-digit code sent to your phone or email in web chat. Codes are stored only as a hash and expire after 10 minutes.

Businesses can view, change and export their customer records, and delete them (see Deletion).

Business accounts

For owners and staff we store your name, email, optional phone number, and your password as a salted scrypt hash (we can't read it). When you sign in we set one cookie, which keeps you signed in for up to 30 days of inactivity. With each sign-in session we keep the IP address and browser type, for security. If you enable alerts on a device, we store that device's push subscription.

If a staff member adds a link to their personal calendar so that their own events block booking time, we read that calendar every 10 minutes and keep the start and end times of busy events for the next 120 days, with a shortened title (up to 100 characters).

We also keep the files a business uploads: website versions, and logos, photos and documents sent with a website request.

Who else handles your information

We don't sell personal information, and we don't use it for advertising.

How it's protected

• Passwords are stored as salted scrypt hashes. Secret API keys, verification codes and server connection keys are stored only as hashes.
• Webhooks sent to a business's own systems are signed, so they can check the request came from us.
• Requests from phone and payment providers are checked against their signatures.
• Each business can only reach its own data. The AI receptionist acts only for the business whose website, number or link was used.

How long we keep it

• Visit records: 18 months.
• Sign-in sessions: removed when they expire. Sign-in links and verification codes are removed a day after they expire.
• Backups: a copy of the database is made once a day and the last 7 are kept.
• Customer records, conversations and bookings: kept for the business until the business deletes them.

Deletion

If you're a customer of a business, ask that business to delete your details. When a business deletes a customer, we replace the name with "Deleted customer", remove the phone number, email, aliases, tags and the business's notes, and delete everything the receptionist saved about them. Anonymous booking counts are kept so the business's figures still add up.

Deleting a customer does not currently change the text of past conversations, booking notes, or the address saved on past visits. If you typed personal details into a chat or text, ask the business to remove those conversations as well. To do before launch: describe how those are removed.

If you have a business account, To do before launch: add the contact address and the process for closing an account and deleting its data.

Changes

If we change what we collect or how we use it, we'll update this page and the date below.

Last updated: add the date when this page is approved.