Privacy Policy

Personal information

• •Contact information such as your name, email address and phone number
• •Business information such as your company name and job title
• •Account registration information (user name, password)
• •The content of your inquiries

Information collected automatically

• •Device information (device type, operating system, device ID)
• •Service usage history and access logs
• •How you view the materials we send when you request them (when you open them, and which pages you view and for how long)
• •IP address and browser type
• •Location information (only with your consent)

Payment information

• •Payments are processed through Apple's or Google's payment systems. We do not directly collect or store payment information such as credit card numbers.

Information you enter in the AI recommendation feature (bookmi Order)

• •Text you enter into the AI recommendation feature (such as food preferences and requests)
• •If you use voice input, the recorded audio and its transcription
• •Your conversation history with the AI (including menu information referenced during the conversation)
• •This information is collected only if you agree to use the AI recommendation feature and actually enter it. You do not need to enter personal information such as your name or contact details.

• •Providing, operating and improving our services
• •Creating and managing accounts
• •Responding to inquiries
• •Following up with people who request materials or contact us (including contacting you based on how you viewed the materials we sent)
• •Sending important notices (such as service changes and security notifications)
• •Marketing activities (only with your consent)
• •Transcribing voice input and generating food recommendations in the AI recommendation feature
• •Analyzing and compiling statistics on service usage
• •Preventing fraud and ensuring safety
• •Complying with legal obligations

• •With your consent
• •When required to respond to a request based on laws and regulations
• •With service providers to the extent necessary to provide our services (such as cloud services and analytics tools)

Third-party services

• •Analytics services (such as Google Analytics)
• •Cloud hosting services
• •Payment processing services (through Apple or Google)
• •AI service provider (OpenAI, L.L.C.): text, audio and conversation content you enter in the AI recommendation feature are sent only for transcription and response generation
• •AI service providers (Anthropic, PBC and OpenAI, L.L.C.): text you enter in the free tools on our website (such as review reply drafts and Japanese business documents) is sent only to generate the text (normally to Anthropic, and to OpenAI only when Anthropic is unavailable) and is not stored by us

Data we access

• •Basic Google account information (email address, name and profile picture; scopes: openid, userinfo.email, userinfo.profile), to display and identify the connected account.
• •Permission to send email via Gmail (gmail.send), to send the emails that the user writes and instructs bookmi to send (follow-up emails to customer contacts the user selects, and test emails to themselves) from the user's own Gmail account. This permission does not allow us to read, search, modify or delete the user's inbox or existing emails, and we do not do so.
• •Google Calendar (calendar.events, calendar.app.created, calendar.events.freebusy, calendar.calendarlist.readonly; only if the user connects Google Calendar), to (1) import meetings that include guests from outside the user's company, from the user's own calendars that the user selects, as activities (sales meeting records) in bookmi, only when the user turns this on in settings; (2) create an event with a Google Meet link when the user asks, and update or delete that event when the user reschedules or cancels the activity; (3) when the user turns this on in settings, export the user's own sales activities, whereabouts and leave registered in bookmi to the calendar the user selects (their main calendar, a shared calendar they can edit, or a "bookmi" calendar that bookmi creates when the user asks), and update or delete those events when they are changed or cancelled in bookmi; (4) check the free/busy times of the user and of colleagues who share their free/busy information with the user, to suggest meeting times and to schedule visits made together; and (5) list the user's calendars so that the user can choose where to import from and export to.
• •We do not read the contents of events on any calendar other than the user's own calendars selected for import, and we do not change or delete any event that bookmi did not create. Exported events never include internal notes, and bookmi never invites customers or other people as guests. For colleagues we see only when they are busy, never what their events are. bookmi does not change calendar sharing settings and does not delete calendars.
• •The OAuth access token and refresh token required for these connections.

How we use it

• •We use Google user data only to provide and improve the user-facing features described above (sending email and syncing calendar events) that the user uses in bookmi.
• •We do not sell Google user data.
• •We do not use Google user data for serving advertisements, including personalized, retargeted or interest-based advertising.
• •We do not use Google user data to develop, improve or train generalized AI and/or machine-learning models.

Storage and protection

• •Access and refresh tokens are stored encrypted on our servers and are used only to provide the connected features. Data in transit is protected with SSL/TLS.
• •For each email sent from bookmi, we store the recipient, subject, body, time sent, sender address and the Gmail message and thread IDs as a send history and customer activity record, so that the user and members of their business account who have permission can refer to it as a business record.
• •For meetings imported from Google Calendar and events created from bookmi, we store the title, time, location, meeting link, guests' email addresses, display names and responses, and the Google event ID as an activity record. Guests' email addresses are used only to link the meeting to contacts, customers and deals that the business has registered in bookmi.
• •For events exported from bookmi, we store the ID of the destination calendar and the Google event ID so that we can update or delete them later. The IDs of the calendars the user selects for import and export are stored as settings. Free/busy information and the calendar list are fetched only when shown on screen and are not stored.

Sharing and human access

• •We do not transfer Google user data to third parties, except as necessary to provide the features the user requested (including processing by our cloud service providers), for security purposes (such as investigating abuse), to comply with applicable laws, or as part of a merger, acquisition or sale of assets with the user's prior consent.
• •Our staff do not read Google user data, except with the user's explicit consent for specific data, for security purposes (such as investigating abuse), to comply with applicable laws, or when the data is aggregated and anonymized for internal operations.

Disconnecting and deleting data

• •Users can disconnect their Google account at any time in bookmi under Settings > Email (Gmail) and Settings > Google Calendar. When they do, we ask Google to revoke the tokens and delete the stored tokens. Imported meeting records (activities) remain as business records and can be deleted by the user or their business at any time. Exported events stay in Google Calendar and are no longer updated or deleted by bookmi after disconnecting; the user can delete them in Google Calendar at any time, or delete the "bookmi" calendar as a whole.
• •Users can also revoke bookmi's access at any time from "Third-party apps & services" in their Google Account (https://myaccount.google.com/connections).
• •Send history and related data are deleted in accordance with Section 7 (Data Retention). To request deletion of specific data, contact us as described in Section 12.

• •Data encryption (SSL/TLS)
• •Access control
• •Regular security assessments
• •Information security training for employees

• •Right of access: you can request a copy of the information we hold about you
• •Right to rectification: you can request correction of inaccurate information
• •Right to erasure: you can request deletion of your information
• •Right to restrict processing
• •Right to data portability: you can receive your data in a portable format
• •Right to withdraw consent: you can withdraw consent to marketing and other uses at any time

Deleting your account and data

• •You can delete your account from the settings page in the app. After your account is deleted, all of your personal data will be deleted in accordance with the retention period above.