freddie Privacy Policy
Version 1.0 · published [PUBLICATION DATE]
freddie is an AI voice assistant that answers phone calls on behalf of businesses, answers callers' questions and books meetings into the business's calendar. This policy explains what personal data we process, why, on what legal basis, who we entrust it to and what rights you have. It covers the website usefreddie.com and the application app.usefreddie.com.
The Polish version is binding. This English version is provided for information.
1. Who is responsible for your data
The data controller is Jakub Wojdyło, a natural person operating the freddie service.
Contact for anything related to personal data: kontakt@usefreddie.com
We have not appointed a Data Protection Officer, as one is not required in our case.
Two roles. Depending on whose data it is, we act in one of two roles:
- As controller we process data of website visitors, application users (owners and employees of businesses that use freddie) and people who write to us.
- As processor we process data of people who call businesses that use freddie. The business you call is the controller of that data, and we act on its behalf. See section 6.
2. What data we process as controller, why, and on what basis
| Situation | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| You visit usefreddie.com | IP address, browser type, date and time, page address (server logs) | operating and securing the website | Art. 6(1)(f) — our legitimate interest in running the site and preventing abuse |
| You have an account | e-mail address, password (stored only as a hash), business name, account creation date | signing in and providing the service | Art. 6(1)(b) — contract |
| You configure your assistant | content you enter yourself: assistant instructions, knowledge base, opening hours, meeting types, phone numbers, e-mail and SMS rules | running the assistant according to your settings | Art. 6(1)(b) — contract |
| You connect Google Calendar | see section 3 | checking availability and saving booked meetings | Art. 6(1)(b) — contract |
| You write to us | e-mail address, message content and any data you include | replying and handling your request | Art. 6(1)(f) — our legitimate interest in answering messages |
We do not use any analytics, advertising or tracking tools on the website or in the application.
An e-mail address and password are required to create an account; without them we cannot provide the service. Everything else is voluntary, to the extent you want to use a given feature.
3. Google user data
We describe this separately because access to your Google Calendar is the most direct view of your data that we have.
What we access and why. When you connect your calendar, you ask Google to grant us the permissions below. On Google's consent screen you can tick or untick each of them separately.
| Scope | What it lets us see or do | Why |
|---|---|---|
openid, email | your Google account's stable identifier and its e-mail address | to recognise the connected account and show you its address in the app |
calendar.calendarlist.readonly | the list of your calendars: name, whether it is your primary calendar, and your access level | so you can choose which calendars the assistant checks for conflicts and which one it writes meetings to |
calendar.freebusy | only the time ranges in which you are busy — no titles, descriptions, locations or attendees | so the assistant never offers callers a time you already have something planned |
calendar.events.owned | creating, changing and deleting events on calendars you own | to put a meeting booked by the assistant into your calendar, and later move or cancel it |
What we do not do. We do not read the content of your events: titles, descriptions, locations or attendee lists. We use calendar.events.owned only for events we created ourselves for booked meetings.
What we store. Your Google account's identifier and e-mail address, the list of your calendars with your settings (which to check, which to write to), the scopes you granted, and access tokens. The refresh token, which lets us act without you signing in again, is stored encrypted (AES-256-GCM) in a database in the European Union. We do not store your busy time ranges in our database — we fetch them from Google at the moment they are needed.
What we share, and with whom.
- From your busy time ranges we compute free slots. During a call, the free slots — dates and times only — are passed to the voice assistant, which runs on the ElevenLabs platform, so it can offer them to the caller.
- When a caller books a meeting, we create an event in your Google Calendar: the meeting type, the time, the caller's name and — if they gave one — their e-mail address as an attendee.
- We do not share Google user data with anyone else, unless required by law.
Artificial intelligence. We do not use data received from Google to train, fine-tune or improve any artificial intelligence or machine learning models — neither our own nor anyone else's. The assistant uses it only during a call, to offer a time.
What we never do with Google user data. We do not sell it. We do not use it for advertising, including personalised or retargeted advertising. We do not transfer it to data brokers or information resellers. We do not use it to determine creditworthiness. No one on our team reads this data unless you explicitly ask us to (for example when reporting a problem), it is needed for security (such as investigating abuse), or the law requires it.
How to disconnect. In the app, go to Kalendarz → Dostępność → Ustawienia and disconnect the Google account. We then immediately delete the connection, the list of calendars and the tokens, and ask Google to revoke our access. You can also revoke access directly at Google, at myaccount.google.com/permissions. Events we have already written to your calendar stay there — they are yours.
Compliance with Google's policies. freddie's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.
4. Who we entrust data to
We use the providers below. They process data on our behalf, under data processing agreements, and only to the extent needed to run freddie.
| Provider | For | Data | Where |
|---|---|---|---|
| Supabase | database and sign-in | all application data | European Union |
| Vercel | hosting the website and application | network traffic and server logs | the application runs in Frankfurt; US company |
| ElevenLabs | the voice assistant: speech recognition, language model, speech synthesis | caller's number, call recording and transcript, assistant configuration, free slots | USA |
| Resend | sending e-mails (e.g. call summaries) | recipient's address and message content | USA |
| Twilio (Twilio Ireland Limited) | sending text messages | recipient's number and message content — nothing else | Ireland |
We may also disclose data to public authorities where the law requires it.
5. Transfers outside the European Economic Area
Some providers (ElevenLabs, Resend, Vercel) are US companies, so data may be transferred to the United States. Such transfers rely on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, for providers certified under the EU-US Data Privacy Framework, on the Commission's adequacy decision (Art. 45 GDPR). Twilio processes and stores data in Ireland, but its technical support may access it from outside the EEA; in that case it is protected by Twilio's Binding Corporate Rules and Standard Contractual Clauses. You can obtain a copy of these safeguards by writing to the address in section 1.
6. If you call a business that uses freddie
If you spoke to a freddie assistant, the controller of your data is the business you called. We process it on that business's behalf and on its instructions.
- At the start of the call we tell you that the call is recorded and that you are speaking with an AI assistant.
- What data: your phone number, the recording and transcript of the call, and anything you say during it — for example your name, e-mail address, the reason for your call, a meeting time.
- Why: so the business can handle your request — answer you, book a meeting, send a confirmation by e-mail or text message.
- How long: up to 24 months from the call, unless the business deletes it sooner or stops using freddie.
- Your rights (section 8) are exercised primarily with the business you called. If you write to us, we will pass your request to that business and help carry it out.
The assistant holds the conversation and can book a meeting, but it does not make decisions about you that produce legal effects within the meaning of Art. 22 GDPR.
7. How long we keep data
| Data | How long |
|---|---|
| account and assistant configuration | until the account is deleted |
| Google Calendar connection | until you disconnect the calendar or delete the account |
| callers' data (section 6) | up to 24 months from the call, shorter at the business's request |
| server logs | briefly, on the hosting provider's cycle |
| correspondence with us | while handling the matter, then until any claims become time-barred |
When an account is deleted, we delete all of that business's data from our database, including callers' data. Data may remain in backups until they are overwritten.
8. Your rights
You have the right to:
- access your data and receive a copy,
- rectify inaccurate data,
- erase your data,
- restrict processing,
- data portability for data you provided to us, in a machine-readable format,
- object to processing based on our legitimate interest,
- lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.
To exercise any of these rights, write to kontakt@usefreddie.com. We will reply within one month. You can also ask us to delete your account the same way.
9. Cookies
We use only cookies that are strictly necessary for the application to work, so we do not ask for consent to set them:
- session cookies — keep you signed in to the application,
- calendar connection cookies (
kalendarz_google_state,kalendarz_google_powrot) — protect the Google connection flow against forgery and remember which page to return to. Valid for 10 minutes.
We do not use analytics or advertising cookies.
10. Security
Connections to the website and application are encrypted (HTTPS). Google access tokens are encrypted in our database. Each business's data is isolated from every other business's data at the database level, and access by our team is limited to the minimum necessary.
11. Children
freddie is a service for businesses and is not intended for anyone under 16.
12. Changes to this policy
When we change this policy, we update the date at the top of the page. We will notify users of significant changes — such as a new purpose of processing or a change of controller — by e-mail or in the application before they take effect.