Privacy
Privacy Notice
This notice explains how Book Well LLC ("Book Well," "we," "us," or "our") handles personal information through our website, client software, AI-assisted telephone reception, booking, support, and related services. A Book Well business client may also provide its own privacy notice and acts as the primary decision-maker for customer and prospect information processed on its behalf.
For details about the providers that help us operate the service, see our Subprocessors page. For information about using our website and software with a disability or requesting assistance, see our Accessibility Statement.
Information we collect
- Account and contact information, including name, work email, role, login activity, and authentication security data.
- Client business configuration, locations, service areas, booking rules, phone numbers, calendar settings, and notification preferences.
- Customer and prospect information supplied during calls or inquiries, such as name, email, phone number, service or property address, requested service, timing, access notes, and message content.
- Communication data, including call identifiers and metadata, messages, transcripts, summaries, qualification answers, and recordings only where recording is enabled and lawfully disclosed.
- Booking data, such as appointment type, date, time, location, attendees, status, and provider identifiers.
- Billing and subscription data from Stripe. Book Well does not receive full payment-card numbers.
- Device, security, and diagnostic data, including IP address, browser data, request logs, error data, fraud signals, product events, and consent or preference state.
Sources of information
We collect information directly from client users, customers, prospects, and website visitors; from calls, messages, forms, and booking activity; from a client's authorized integrations; automatically from devices and security systems; and from the service providers listed below when they operate the service for us.
AI-assisted voice service
Book Well uses automated and artificial-intelligence systems to answer calls, ask approved intake questions, summarize conversations, and, when authorized by the client, offer eligible appointment times. The system may use speech recognition, language models, and synthetic voice technology. It is instructed not to invent pricing or availability and routes exceptions for human follow-up. AI output can be inaccurate; clients should review consequential information before relying on it.
How we use information
We use information to provide and secure the service; authenticate authorized clients and staff; answer, route, and summarize inquiries; schedule and manage appointments; send requested communications; administer subscriptions; prevent abuse; troubleshoot; measure service performance; comply with law; and enforce our agreements. We do not sell personal information or share it for cross-context behavioral advertising, as those terms are defined under applicable U.S. state privacy laws. We do not use customer call content for targeted advertising.
How information is disclosed
Information is available to the Book Well client whose workflow received it and to authorized Book Well personnel who need access for support, security, or operations. We also disclose limited information to service providers that host or operate the service, including Supabase, Stripe, Telnyx and its voice/AI infrastructure, Cal.com, Resend and email-delivery infrastructure, PostHog, Sentry, Vercel, Google Cloud, and Cloudflare. The maintained list and purposes appear on our Subprocessors page. We may also disclose information when required by law, to protect rights and safety, or as part of a corporate transaction subject to appropriate safeguards.
SDKs, cookies, and similar technologies
Supabase supports authentication and application data; Cloudflare Turnstile checks public forms for abuse; Cal.com loads when a visitor chooses to open scheduling; Sentry receives scrubbed error and performance diagnostics when enabled; and PostHog receives a limited, allowlisted set of pseudonymous product events from authenticated client accounts when product analytics is enabled. A user can disable product analytics for their account in Settings, and a workspace owner can disable it for the entire workspace. Browser Global Privacy Control signals also suppress browser analytics. Automatic page, text, form, keystroke, session-replay, heatmap, advertising, and cross-site behavioral capture are disabled in our application configuration. These providers may process limited device, request, and diagnostic information needed to deliver their functions. Book Well does not send PostHog names, email addresses, telephone numbers, service addresses, message or call content, transcripts, booking notes, payment details, or third-party integration identifiers.
Retention and deletion
We retain information only while needed to provide the service, meet documented business and legal requirements, resolve disputes, prevent fraud, and maintain security. Our standard schedule keeps website inquiries for up to 90 days; active client and customer operational data for the subscription term and ordinarily up to 90 days after verified closure; raw webhook payloads for up to 30 days; scrubbed error records for up to 90 days; security and audit logs for up to 12 months; and PostHog product-analytics events for up to 12 months. Call recording is disabled by default; if a client lawfully enables it, the approved notice, consent, and shorter recording-retention configuration apply. Integration credentials are revoked when the integration is disconnected or the account closes. Required billing, contract, tax, fraud, chargeback, and legal-hold records may be retained longer under the applicable legal or accounting schedule. Deleted primary data can remain in time-limited backups until the provider backup lifecycle expires and is not restored for ordinary use.
To request access, correction, export, or deletion, email support@getbookwell.com. We verify the requester and, where Book Well processes data for a client, may route the request to that client.
Security and international processing
We use access controls, tenant isolation, encryption in transit and for stored integration credentials, signed webhooks, rate limits, monitoring, and least-privilege operational processes. No system is completely secure. Providers may process information in countries other than where it was collected, subject to their contractual transfer safeguards.
Your choices and rights
Depending on location, a person may have rights to access, correct, delete, restrict, object, or obtain a copy of personal information, and to appeal or complain to a regulator. These rights can be limited by law. We will not discriminate against a person for exercising an applicable privacy right. An authorized agent may submit a request where permitted by law, subject to verification of the agent's authority and the requester's identity. Marketing messages include an opt-out method; service and security messages may still be sent when necessary.
Children, changes, and contact
Book Well is a business service and is not directed to children. We will post material changes here and update the effective date. Questions, security reports, and privacy requests for Book Well LLC may be sent to support@getbookwell.com.