Privacy Policy

Effective Date: September 2, 2026 · Last Updated: September 5, 2026

Static review version: This page contains the complete policy in the initial HTML response and does not require JavaScript. The standard website version is available at /privacy-policy.

1. Our Role & Platform Structure

ecoboutique.ai ("the Platform"), operated by Ecoboutique LLC DBA Eco Boutique Labs ("EcoBoutique," "we," "us"), provides AI-driven voice agents and physical kiosks to third-party business clients ("Sub-Businesses").

• As a Service Provider: We process data on behalf of Sub-Businesses.
• As a Controller: We manage the platform infrastructure and the security of your data.

Each Sub-Business is responsible for its own specific privacy practices, but this policy governs the baseline standards of our technology.

2. Voice & AI Analytics Disclosure

When you interact with our AI voice agents at a kiosk or via phone:

• Audio & Transcripts: We collect audio recordings and text transcripts to fulfill your requests (e.g., "Send me a payment link").
• Acoustic & Sentiment Analysis: Our AI analyzes tone and sentiment to ensure the agent is responding helpfully and to provide quality assurance reports to the Sub-Business.
• Data Minimization: We use automated PII-redaction tools to identify and mask sensitive data, such as credit card numbers or birthdates, from stored transcripts.
• No LLM Training: We do not use your individual voice data or transcripts to train the underlying Large Language Models used by our AI partners.

3. SMS Messaging & “One-to-One” Consent

Our AI agents can transition a voice call to a text-based guided experience.

• The Request: By asking the AI agent to “text me the link” or “send me a payment invite,” you provide Prior Express Written Consent to receive a one-time or session-based SMS from the Sub-Business.
• Purpose: Messages are strictly transactional—containing links to complete payments, confirm bookings, or open a guided web chat.
• Opt-Out: You can stop receiving messages at any time by replying STOP. All messages are subject to your carrier's standard message and data rates.
• Interactive UI: Once you click a link, further communication occurs via our secure web-based chat interface.

4. Interactive Guided Experience & Payments

• Session Continuity: When you move from a phone call to our web UI, we use a unique session ID to keep your experience seamless.
• Payment Security: We do not store credit card numbers on our servers. All payments are processed through PCI-DSS compliant third-party gateways such as Stripe or Adyen. Our AI agent never hears or records your full credit card digits.

5. Multi-Tenant Data Separation

We maintain strict logical separation between the data of different Sub-Businesses. Your data collected via “Sub-Business A” will never be shared with or accessible to “Sub-Business B.”

6. Your 2026 Privacy Rights (CCPA/GDPR/BIPA)

Under current 2026 regulations, you have the right to:

• Request Access/Deletion: See or delete the data collected during your session.
• Opt-Out of Automated Decision-Making: Request human intervention if an AI decision significantly impacts you.
• Biometric Rights: If our kiosks use voice-printing for identification, we will ask for separate, explicit biometric consent before processing.

To delete your account and associated data, use the contact form on our standard website or the Delete Account button in your dashboard settings. We will complete deletion within 30 days.

7. Mobile Information & SMS

When you opt in to receive SMS from Eco Boutique, we collect your mobile phone number and a record of your consent, including the date, time, and consent language shown to you.

We use this information only to send the messages described in our SMS / Messaging Terms: lead and account notifications, service and booking updates, and concierge links you request.

No mobile information, including your phone number, will be shared with third parties or affiliates for marketing or promotional purposes. Text-messaging originator opt-in data and consent are not shared with any third parties.

We share phone numbers only with messaging service providers we use to deliver your messages, such as Twilio and Telnyx, strictly to send the messages you opted into, and where required by law.

You may opt out at any time by replying STOP. We retain consent records for four years to document compliance, after which they are deleted.

8. Lead Data

Lead information captured by our AI is shared strictly with the specific business owner you are contacting to facilitate your request.

9. Google API Services — Calendar Integration

When a Sub-Business owner connects their Google Calendar to Digital Concierge, they explicitly authorize us, via Google's standard OAuth 2.0 consent flow, to access their calendar on their behalf.

Scopes Requested:

• https://www.googleapis.com/auth/calendar
• https://www.googleapis.com/auth/calendar.events

What We Access:

• Free/busy availability windows on the Sub-Business owner's selected calendar, used by our AI voice agent to offer accurate appointment slots during customer phone calls.
• Calendar event create, read, update, and delete operations limited to events created by Digital Concierge on behalf of the Sub-Business owner.

How We Use This Data:

• Solely to schedule, reschedule, confirm, or cancel appointments generated by the Sub-Business's AI voice agent during live customer interactions.
• We do not read, store, transmit, or analyze calendar events that were not created by Digital Concierge, beyond free/busy metadata needed to determine an open booking slot.

How We Store This Data:

• OAuth refresh tokens are stored encrypted in our authentication partner's vault, Nango, and are never exposed to the Sub-Business's browser or to end customers.
• Booking metadata is stored in our encrypted Postgres database hosted on Supabase and logically isolated per Sub-Business.

Retention & Deletion:

• A Sub-Business owner can disconnect Google Calendar at any time from Settings → Integrations, which revokes our OAuth token via Nango and deletes the corresponding integration record.
• Account deletion revokes all integration tokens and removes booking metadata within 30 days.

Google Limited Use Compliance: Digital Concierge's use of information received from Google APIs adheres to the Google API Services User Data Policy, including Limited Use requirements. We do not use Google user data to train generalized AI/ML models, transfer it except as necessary to provide prominent user-facing features with consent, use it for advertising, or permit human access except with affirmative consent, for security, to comply with law, or for aggregated and anonymized internal operations.

10. Service Providers / Subprocessors

We share Sub-Business and end-customer data with service providers strictly to operate the Platform:

• Supabase — database hosting and authentication
• Stripe — payment processing
• Resend — transactional email delivery
• Nango — OAuth integration token vault
• Google (Calendar API) — for Sub-Businesses that connect Google Calendar
• Anthropic, OpenAI, Deepgram, ElevenLabs — AI/voice infrastructure; these providers do not retain or train on data passed through their APIs under our enterprise data terms

Each provider is bound by a Data Processing Agreement that limits its use of data to what is necessary to provide its service.

11. User-Initiated AI Concierge Messaging

You may start an AI concierge request by sending a keyword, question, instruction, or media file to a phone number published by Eco Boutique or an identified Sub-Business. You may also start through a QR code that opens your messaging app. We use the content you send to understand your request, select the appropriate specialized agent, and provide the information, service, or digital result you requested.

Requests may include asking a question, requesting research or recommendations, creating or revising digital content, submitting an image or video, starting an application, or asking about an opportunity. These examples are illustrative; available agents and request types may change without changing the purpose of this program.

We collect the originating mobile number, message content, attached media, timestamps, delivery information, routing decisions, and the related conversation and result. We use this information only to operate, secure, support, and improve the requested concierge service; maintain continuity across SMS and the linked web session; and send request-specific acknowledgments, clarifying questions, status updates, and completion notices.

A user-initiated request does not enroll you in unrelated or recurring promotional text messages. Any ongoing marketing SMS program requires a separate, clearly disclosed opt-in.

Message frequency varies with your activity and the complexity of the request. Message and data rates may apply. Reply STOP to opt out or HELP for help.

12. Media, Generated Content & Request Data

If you send an image, video, audio file, document, or other content, we and the identified Sub-Business may process it to fulfill your request, generate or revise a result, provide support, prevent abuse, and maintain a record of the interaction. Submit only content you have the right to use, and do not send sensitive personal or financial information unless the experience specifically requests it through a secure form.

AI-generated results and associated request data may be stored for the period reasonably necessary to deliver the result, preserve session continuity, resolve disputes, comply with law, and enforce our terms. You may request access or deletion as described in Section 6, subject to legal and operational retention requirements.

13. Linked Web Sessions & Branded Links

Some SMS replies contain a unique Eco Boutique or branded web link. The link lets us associate the browser session with the request and mobile number that initiated it so you do not have to repeat the same information. We may record when the link is created and opened, along with ordinary security and device information, to operate the session and prevent misuse.

We use opaque identifiers in these links rather than placing your phone number or request text in the URL. Links may expire and should not be forwarded because a person who receives the link may be able to access the associated session. Payment and other sensitive actions may require additional verification and are completed through secure third-party services.

Contact

Questions about this policy may be sent to support@ecoboutique.ai.