Privacy Policy

Who we are and what this covers

Project Setter AI ("Project Setter", "we", "us", "our") provides an AI call answering, lead qualification and appointment booking service for home service contractors.

This policy applies to:

• The website at projectsetter.com, including the demo form, chat widget and newsletter sign-up.
• The app at app.projectsetter.com, where customers sign in to configure their agents and review calls, leads and appointments.
• The service — the calls, text messages, emails and bookings our AI agents handle for the businesses that use us.

Our customers are businesses. When we handle information about the people who call those businesses, we do so on the business's behalf — section 6 explains what that means for callers.

Information we collect

Information you give us on the website

Information from customers using the app

• Account details: your name, email address and sign-in credentials. If you choose to sign in with Google, we receive the name, email address and profile picture on your Google account.
• Business details: company name, phone numbers, trades, service area, business hours, pricing guidance, emergency and transfer rules, greetings, knowledge base content, and the team members you invite.
• Billing details: plan, billing contact and payment history. Card details are collected and stored by our payment processor, Stripe — we never see or store your full card number.
• Support and usage: messages you send our support team, and information about how you use the app (such as settings changed and features used) so we can keep it working and fix problems.

Information from calls and messages the service handles

When our agents answer or make calls, or exchange texts and emails, on behalf of a customer, we process:

• The caller's phone number and caller ID name.
• What the caller tells the agent — for example their name, address, email address, the problem they need fixed, when they are available, and notes such as a gate code.
• Call audio recordings, transcripts and AI-generated call summaries.
• Call details such as date, time, duration, outcome and whether the call was transferred.
• Text messages and emails sent to and from callers and leads, such as booking confirmations, follow-ups and leads' replies.
• The appointments the agent books.

Information from services you connect

• Calendars: if you connect Google Calendar, we access the calendar data described in section 3. If you connect an Outlook calendar, we use it in the same way through Microsoft.
• Email: if you connect a Gmail or Outlook mailbox for Speed to Lead, we send your lead follow-up emails from it. With Outlook, we also read new inbox messages to find replies from your leads, keep only those replies and discard the rest without storing them. We do not read Gmail: replies to emails sent from a Gmail mailbox, or from our shared sender, reach us through a Project Setter reply address listed on each email (see section 3).
• Field service and CRM tools: if you connect HubSpot, Jobber, Housecall Pro or LEAP, we exchange the customer, lead, call and appointment records needed to recognize callers, log their calls, book appointments and pick up new leads there.

We only access a connected service after you authorize it, and you can disconnect it at any time.

Information collected automatically

• Log data: our hosting provider records IP address, browser and device type, pages requested, referring page, date and time, and errors. We use this to run the website and app securely and to diagnose problems.
• Cookies and local storage: see section 9.

Google user data

This section explains how Project Setter AI accesses, uses, stores and shares data we receive from Google. There are three separate connections, and each asks for your permission on its own Google screen: signing in with Google, connecting Google Calendar, and connecting a Gmail mailbox for Speed to Lead. Signing in with Google does not give us access to your calendar or your email. Before the app sends you to Google to connect Calendar or Gmail, it shows a notice explaining what we will do with that access, and you have to tick "I agree" to continue. Step-by-step help with disconnecting and deleting your data is at projectsetter.com/google-data.

What we access

• Google Sign-In (basic profile): your name, email address and profile picture, used to create and secure your account.
• Google Calendar (the calendar.events.owned permission, which Google shows as "See, create, change, and delete events on Google calendars you own"), only after you choose to connect it on the Appointments screen, an agent's Talk screen or in Business setup, and agree to our notice there. We use only your primary calendar. Agents published by a member of your team check and book that person's calendar. Reading: for the dates being checked or shown, Google returns your events to our servers. To work out when you are free, we use only each event's start and end time and whether it is marked busy or free. On the Appointments screen we also show you each event's title, time, location, description (shortened) and link; only you see your calendar there, not other members of your workspace. Creating: we add each appointment our agents book, with the details the customer gave (such as name, phone number, address and what they need) and, if they gave an email address, that address as a guest. We ask Google not to send invitations or updates, although, depending on the guest's own Google settings, the appointment may still appear in their calendar. Checking again: before we text a customer a confirmation or reminder, we read that appointment again to check it still exists and when it is. Changing and deleting: our agents do not change or cancel events. We delete events only when you click Remove agent bookings on the Appointments screen, and then only the events Project Setter created. We never change or delete events we did not create. We do not read your list of calendars, your other calendars, or your sharing or calendar settings.
• Gmail (the gmail.send permission, which Google shows as "Send email on your behalf", plus your email address), only after a workspace admin clicks Connect Gmail in Speed to Lead → Setup, agrees to our notice there and chooses a mailbox (it can be a shared inbox such as office@). Google tells us that mailbox's email address, and we send your follow-up emails from it, each to one lead who contacted you, so they appear in its Sent folder. The emails are your templates or your own wording; by default someone on your team approves each one before it is sent, unless you turn on automatic sending. This permission only lets us send. We cannot read, search, change or delete any email in your Gmail mailbox.

We request only the access needed for these features. We do not access Google Drive, Contacts or any other Google service.

How we notice replies without reading Gmail

Every email we send for you from a Gmail mailbox, or from our shared sender, names two reply addresses: your business address and a Project Setter reply address, which emails sent from Gmail show as "your business name (ProjectSetter)". When a lead clicks Reply, the reply arrives in your inbox as usual, and the lead's email program also sends a copy to the Project Setter address, where our email provider Resend receives it for us. That copy comes from the lead, not from your Gmail account, so it is not Google user data — we explain it here so it is clear how Speed to Lead knows a lead answered.

If the sender is one of your open leads from the last 60 days, we save the new part of the reply (up to 4,000 characters, without attachments) with its subject and sender on that lead's timeline, stop the lead's scheduled follow-ups and draft a suggested answer for your team to review before anything is sent. Anything else sent to that address is ignored and not saved in Project Setter. If your workspace has no contact email set, emails from our shared sender name only the Project Setter address, so replies to them come only to us and appear on the lead's timeline in the app.

How we use it

• To check when you are free, so agents offer callers and leads only times your calendar shows as open — on calls, in text messages and in emails.
• To add the appointments our agents book to your calendar, and to check that a booked appointment is still there, and when, before we text the customer a confirmation or reminder.
• To show you your own schedule, with your agents' bookings marked, on the Appointments screen, and to remove your agents' bookings when you ask.
• To send your lead follow-up emails, and the answers your team approves, from your own Gmail mailbox.

The appointments agents book, and the open times they offered, also appear in the call records and lead timelines that members of your workspace can see.

We do not use Google user data for advertising, we do not sell it, and we do not use it to determine credit-worthiness or for lending purposes. We do not use Google user data, including data from Google Workspace APIs such as Calendar and Gmail, to develop, improve or train generalized or non-personalized artificial intelligence or machine learning models, and we do not train any AI models on it.

AI processing

When an agent checks availability, the language model that powers it receives only the open times and remaining capacity we work out from your calendar, with the date and time zone — never the titles, descriptions, locations or guests of your own events. When an agent books, the model receives the details of the appointment it just created: its time, the title the agent gave it and its calendar link. On phone calls, including Speed to Lead calls, the model is run through Cartesia, our voice provider. In test calls in the app, when we read a call's transcript afterwards to fill in the caller's details, and in Speed to Lead text and email conversations, we reach it through OpenRouter, which passes each request to the company hosting the model (Anthropic, or Anthropic's models on Amazon Web Services, Google Cloud or Microsoft Azure). These providers process the data only to run the conversation, and we do not allow them to use it to train their models.

We do not read Gmail, so no Gmail content reaches any AI provider. Suggested answers to lead replies are drafted from the reply the lead sent to our reply address, never from your Gmail mailbox. If you connect business software such as HubSpot, an agent can also look up a caller's appointments stored there; that information comes from your business software, not from Google.

How we share it

We do not transfer Google user data to anyone except: (a) to provide the features described above, through the service providers listed in section 8: Cartesia, and OpenRouter with the model companies named above (open times and the appointments agents create); Twilio (the date and time of booked appointments in confirmation and reminder texts, and open times offered to leads by text); the service that sends your lead emails — your connected Gmail or Outlook mailbox, or Resend for our shared sender (open times, when your email or the answer you approve includes them); Clerk (your Google sign-in and the access tokens for your calendar); and our hosting and database providers (storage); and, if you connect one, your business software (the appointments agents book); (b) to comply with applicable law; (c) as part of a merger, acquisition or sale of assets, with notice to you; or (d) with your explicit consent. Callers and leads never see your event titles, descriptions, guests or other event details; they only ever see open times and their own appointment.

No person at Project Setter reads your Google user data unless you ask us to (for example, to troubleshoot a booking), it is necessary for security purposes such as investigating abuse, it is required to comply with law, or the data has been aggregated and anonymized for internal operations.

How we store and protect it

• Calendar: the access tokens for your calendar are held by our sign-in provider, Clerk. We fetch a short-lived token from Clerk when we need it and keep it only briefly in server memory. We do not keep copies of your calendar events. For each appointment our agents book, we store its calendar event ID, start time and time zone, the customer's phone number for confirmations and reminders, the text messages we send about it, and the booking details in the call record and the lead's activity log. Call records can also include the open times the agent offered.
• Gmail: the mailbox's access and refresh tokens are encrypted (AES-256-GCM) separately for each workspace in our database, together with the mailbox's email address. We keep a copy of each email we send on the lead's timeline, with Gmail's message and thread IDs, so an answer can stay in the same thread.
• All of it is encrypted in transit (HTTPS/TLS) and at rest, and is accessible only to the systems and personnel that need it to run the features above.

Disconnecting and deletion

• Google Calendar: remove Project Setter AI's access at myaccount.google.com/permissions. From then on we cannot read or change your calendar, and your agents can no longer check it or book into it. Appointments already created stay in your calendar, because they are your events; to remove them first, click Remove agent bookings on the Appointments screen.
• Gmail: click Disconnect in Speed to Lead → Setup or in Settings. We delete the mailbox's tokens and address immediately and stop sending from it. Disconnecting does not withdraw the permission inside your Google account; to do that, remove Project Setter AI at myaccount.google.com/permissions. Removing it there withdraws every permission that Google account gave Project Setter AI, including calendar access if the same account is connected to your calendar.
• Records of booked appointments, reminder texts, lead timelines (including copies of emails we sent and replies leads sent to our reply address) and call records stay in your account until you close it or ask us to delete them; you can also export calls and delete individual calls in the app. Email brian@projectsetter.com and we will delete the Google user data we hold within 30 days; we also delete it within 30 days of account closure.

Step-by-step instructions are in Managing and deleting your Google data.

How we use information

• To provide the service: answer and route calls, qualify callers, follow up with new leads by call, text and email, book appointments, send confirmations and reminders, transfer urgent calls according to your rules, and show calls, recordings, transcripts, leads and bookings in your dashboard.
• To run your account: set it up, sign you in, provide support and respond to your requests.
• To bill you and prevent payment fraud.
• To keep things secure and working: detect and prevent abuse, investigate faults and monitor reliability. We look at a specific call only when you ask us to, or when it is needed to fix a problem or investigate misuse.
• To improve the service: using usage information and aggregated statistics, such as how often calls end in a booking.
• To communicate with you: demo follow-up, service and security notices, and — if you subscribed or it is otherwise permitted — our newsletter, which you can unsubscribe from at any time.
• To meet legal obligations and enforce our Terms of Service.

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases: performing our contract with you; our legitimate interests in running, securing and improving the service and marketing it to businesses; your consent, for texts and the newsletter, which you can withdraw at any time; and compliance with legal obligations.

AI and call processing

Calls are answered by AI voice agents. During a call, a speech recognition service turns the caller's voice into text, a large language model works out what to say next based on the conversation and the business's settings, and a voice service turns the reply back into speech. That means call audio, transcripts and the business information the agent needs — such as hours, service area and open time slots — are sent to those providers while the call is happening. After the call, the agent pulls out structured details such as name, address and job type to create the lead or booking.

For Speed to Lead, agents also call new leads, and the same kind of language model writes text-message replies to leads and drafts suggested answers to leads' email replies (from a connected Outlook inbox, or sent to our reply address). To do that it receives the lead's form details, the text and email conversation with that lead, your business settings and knowledge and, when it checks your calendar, open times. A person on your team reviews every suggested email answer before it is sent.

• We do not use call recordings, transcripts, customer data or Google user data to train generalized AI models, and we do not authorize our AI providers to use them for that purpose.
• AI can mishear or make mistakes. Every call is recorded and transcribed so the business can check exactly what was said and correct any booking.
• The agent follows the booking and transfer rules the business sets. It does not make decisions about callers that have legal or similarly significant effects.

If you called a business that uses Project Setter

If you called or texted a contractor that uses Project Setter, we handle your information on that business's behalf, as its service provider (a "processor" in some laws). The business decides what is collected, how it is used and how long it is kept, and its own privacy policy applies.

To access, correct or delete a recording or your details, contact the business directly. If you contact us instead, we will pass your request to the business and help it respond.

Businesses that use Project Setter are responsible for telling callers that calls may be recorded and answered by an AI assistant, and for getting any consent the law requires.

Text messages

• From us: if you leave your number in our chat widget and agree to receive texts, we text you about your enquiry. Message frequency varies. Message and data rates may apply.
• On behalf of a business: when an agent books an appointment, it may text the caller a confirmation or reminder on the business's behalf.
• Reply STOP to any message to opt out, or HELP for help.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, other than the messaging providers that deliver texts on our behalf.

Who we share it with

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share it only in these cases:

Service providers

Companies that run parts of the service for us, under contracts that limit their use of the data to providing those services:

Other cases

• With the business you called: caller information belongs to the business whose line the caller reached, and is available to them in their dashboard.
• With services you connect: when you connect a calendar, mailbox, CRM or field service tool, we send it the bookings, emails, call logs and lead details you have told us to.
• For legal reasons: when required by law, subpoena or court order, or when necessary to protect the rights, safety or property of our users, the public or Project Setter.
• Business transfers: if we are involved in a merger, acquisition or sale of assets, subject to this policy's protections and with notice to you.
• With your consent, or in aggregated or de-identified form that cannot reasonably be used to identify you.

Cookies and similar technologies

• Website: we do not use advertising cookies, analytics trackers or retargeting pixels. If you book a demo, the embedded Calendly calendar sets its own cookies. If a demo request fails to send, a copy is kept in your browser's session storage so it can be retried; it is cleared when you close the tab.
• App: we use cookies that are strictly necessary to sign you in and keep your session secure, local storage for preferences such as light or dark theme, and Stripe's cookies to prevent fraud during checkout.

You can block or delete cookies in your browser settings, but you will not be able to sign in to the app without its essential cookies.

How long we keep it

Deleted data can remain in encrypted backups for a limited period before it is overwritten. We may keep information longer where the law requires it or to resolve a dispute.

How we protect it

We use administrative, technical and organizational safeguards suited to the data we hold, including encryption in transit (HTTPS/TLS) and at rest, access limited to the people and systems that need it, and sign-in handled by a dedicated identity provider. No system is perfectly secure; if a breach affects your personal information, we will notify you and the relevant authorities as the law requires. More detail is on our Security page.

Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you, and get a copy in a portable format.
• Correct information that is inaccurate.
• Delete your information.
• Object to or restrict certain processing.
• Withdraw consent you have given, such as for texts or the newsletter.

Customers can export calls and delete individual calls from the app. To close your account, or for anything else, email brian@projectsetter.com. We will respond within 30 days. We may need to verify your identity before acting on a request, and we will not treat you differently for exercising your rights.

You can unsubscribe from marketing emails with the link in any email, and stop texts by replying STOP.

California and other US state privacy rights

Residents of California and other states with consumer privacy laws have the rights described above, plus the following disclosures. In the past 12 months we have collected these categories of personal information, from the sources and for the purposes described in sections 2 and 4:

• We disclose these categories to the service providers listed in section 8 for business purposes.
• We have not sold personal information or shared it for cross-context behavioral advertising in the past 12 months, and we do not knowingly do so for anyone under 16. We treat Global Privacy Control browser signals as a valid opt-out request.
• We use sensitive personal information only to provide the service, not to infer characteristics about you.
• You may use an authorized agent to make a request on your behalf; we may ask for proof of their authority and verify your identity.
• If we decline your request, you can appeal by replying to our decision. We will respond to appeals within 45 days.

Visitors outside the United States

Project Setter is built for businesses in the United States, and information is processed and stored in the United States, where data protection laws may differ from those in your country. Where we transfer personal data from the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. If you are in the EEA or UK, you also have the right to complain to your local data protection authority.

Children

Our website and app are for businesses and are not directed to children under 16. We do not knowingly collect personal information from children through them. If you believe a child has given us personal information, contact us and we will delete it.

Changes to this policy

We will update the "Last updated" date at the top of this page whenever we change this policy. If a change is material, we will tell customers by email or in the app before it takes effect. We will not use personal information in a materially different way than described here without your consent.

Contact us

Questions about this policy, or a request about your data: email brian@projectsetter.com. We aim to reply within one working day.