Privacy Policy

Last updated: June 18, 2026

This policy explains what Tasmio collects and why. It's written to be honest and practical, but it isn't legal advice — if you serve customers in the EU/UK (GDPR) or California (CCPA/CPRA), a one-time review by a privacy lawyer is worth doing, and update the entity name once Tasmio is formally registered.

1. Who we are

Lobby ("the Service") is operated by Tasmio, currently run as a sole proprietorship and not yet incorporated ("Tasmio," "we," "us"). This policy covers the information we handle when you use the Service, both as our customer and as a caller whose call our customer's AI receptionist answers.

2. Information we collect

From customers (account holders):

Account details — your name, email address, and password (stored only as a secure hash, never in plain text).
Business profile — business name, address, hours, services, escalation contact, and similar details you enter to configure your receptionist.
Billing information — your selected plan and, once your receptionist is live, payment details handled by our payment processor (see Section 5). We do not store full card numbers ourselves.

From callers (people who call our customers):

Caller details shared during a call — such as name and phone number.
Call content — audio recordings, transcripts, and short summaries of the conversation.
Appointment details — any booking, reschedule, or cancellation made during the call.

Caller information is processed by us on behalf of our customer (the business being called). The business controls that data within its own dashboard.

3. How we use information

To provide the Service — answering calls, checking availability, booking appointments, and producing transcripts, recordings, and notes for the customer to review.
To operate accounts — authentication, support, and account-related email such as your welcome message and a notification when your receptionist goes live.
To process payments once your receptionist is live.
To maintain, secure, and improve the Service.

We do not sell personal information, and we do not use call content to advertise to you or your callers.

4. AI and voice processing

The Service uses third-party AI and voice technology to understand callers and respond in real time. Call audio and text are processed by these providers solely to operate your receptionist. As with any AI system, the agent can occasionally misunderstand or mishandle a request — transcripts and recordings are retained precisely so calls can be reviewed.

5. Service providers we share with

We share information only with the providers needed to run the Service, and only as much as each needs:

Payment processing — Dodo Payments, our payment processor and merchant of record, for subscription billing.
AI & voice infrastructure — the providers that power real-time speech understanding and the voice agent.
Email delivery — our email provider (Spacemail) for transactional notifications.
Hosting — the hosting provider where the Service and its database run.

We may also disclose information if required by law, to protect our rights, or in connection with a business transfer.

6. Data retention

We keep account and business-profile data for as long as your account is active. Call recordings, transcripts, summaries, and appointment records are retained so you can review past calls, and remain available in your dashboard until your account is closed or you ask us to delete specific records. After account closure, we delete or anonymize personal data within a reasonable period, except where we must retain limited records (for example, billing records) to meet legal or accounting obligations.

7. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete personal information we hold about you, and to object to or restrict certain processing. Customers can manage most of their data directly in the dashboard; for anything else, contact us using the details below and we'll respond within a reasonable time. If you are a caller and want a business's record of your call addressed, contact that business — they control their own call data — or reach us and we'll help route the request.

8. Security

We use prepared database queries, hashed passwords, CSRF protection on forms, and access controls so each account only sees its own data. We recommend serving the Service over HTTPS in production. No system is perfectly secure, but we work to protect the information entrusted to us.

9. Children's privacy

The Service is intended for businesses and is not directed at children. We do not knowingly collect personal information from children.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by the "Last updated" date above, and continued use of the Service after an update constitutes acceptance of the revised policy.

11. Contact

Questions about this Privacy Policy or your data can be sent to support@tasmio.com.