Privacy Policy

Who we are, and who this is for

Mordecai AI ("Mordecai", "we", "us") operates mordecai.co and Booked, a service that gives a local service business a one-page website with an AI rep on it that answers questions, quotes jobs and books appointments.

There are two different kinds of people in this policy, and the rules differ for each:

• Business owners. You signed up for Booked, or you use another Mordecai service. We decide how your account data is handled, and this policy is our promise to you about it.
• People who contact a business through a Booked site. If you messaged a plumber or booked a handyman through a site we host, that business decides what happens to your information. We hold it and process it on their behalf. Your first stop for a question or a deletion request is that business; we will help them answer you.

Using Mordecai means this policy applies to you. If you do not agree with it, please do not use the service.

What we collect

From business owners

• Your account: name, email address, mobile number, and either a password (which we store only as a salted hash, never in readable form) or a link to your Google account if you sign in that way.
• Your public business listing: when you paste your Google Business Profile, we read what is already public on it — business name, category, address, phone number, website, star rating, review count and the listing URL — to build your site. No sign-in is involved; this is the same information anyone can see on Google.
• What you tell us about your business: services, prices, hours, service area, booking rules, policies and anything you add to your knowledge base.
• Payment: handled entirely by Stripe. We never see or store your card number. We keep the identifiers Stripe gives us for your customer and subscription, and whether the subscription is active.
• Your Google Calendar connection, if you choose to connect it. See the Google section below, which explains exactly what we read and write.

From people who contact a business through a Booked site

• What you type into the chat, and the reply the rep gives you.
• The details you hand over to book: your name, your mobile number, sometimes an email address, what the job is, and a ZIP code or address.
• The appointment itself — what, when and where.
• A photo, only if you choose to send one to describe the job.
• If you ask to stop receiving texts, we record that you opted out so we can keep honouring it.

Collected automatically

• Basic traffic counts for each site: page views, a randomly generated visitor and session identifier, the referring site, and a broad device type such as "mobile" or "desktop". This is how an owner sees whether their site is working.
• Standard server logs, including IP address, kept briefly for security and debugging.

We do not run advertising trackers, we do not build advertising profiles, and we do not follow you around other websites. See our Cookie Policy for what we do set.

What we do with it

• Build, host and run the website and AI rep for the business.
• Answer a visitor's question, quote a job, and put a booking on the calendar.
• Tell the owner, by text and email, that a lead or a booking came in.
• Send a customer their booking confirmation, reminder or reschedule notice.
• Take payment and manage the subscription.
• Show the owner how their site is performing.
• Keep the service secure, prevent abuse, and meet our legal obligations.

We do not sell personal information, and we never have. We do not share it with advertisers or data brokers.

Google user data

This section explains exactly what Mordecai does with data from your Google Account. There are two separate, optional connections, and each asks for its own permission.

Signing in with Google

If you choose "Continue with Google", we request only the openid, email and profile scopes. We verify the identity token Google returns and use it to sign you into an account that already exists for that email address. We store your Google account identifier and your email so we recognise you next time. That is all this connection does.

Connecting Google Calendar

Connecting your calendar is optional, and Booked works without it. If you connect it, we request two scopes:

• See the events on your calendars (google.com/auth/calendar.readonly) — we use this for one thing only: to ask Google which blocks of time are already busy, through Google's free/busy lookup, so the rep never offers a customer a time you cannot work. We do not read the titles, descriptions, guests, locations, conference links or attachments of your events. We are not able to see who you are meeting or what about.
• Edit events on your calendars (google.com/auth/calendar.events) — we use this to put Booked's own appointments onto your calendar, and to update or remove one when a booking is rescheduled or cancelled. We record the identifier of every event we create and only ever touch those. We do not modify, move or delete anything else on your calendar.

We keep the busy times in memory for about a minute so the booking screen stays quick, and nothing more. Your calendar data is never sent to the AI model. The only thing your calendar contributes is which times are free, and that is worked out on our own servers before anything is shown to a customer.

How the connection is stored, and how to end it

The tokens Google issues are encrypted before they are stored and are used only to make these calls on your behalf. You can disconnect at any time from Settings in your dashboard. When you do, we revoke the token with Google immediately and delete it, and appointments stop syncing. You can also revoke our access yourself at myaccount.google.com/permissions. Events we already put on your calendar stay there, and are yours to keep or delete.

Limited Use

Mordecai AI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Concretely, that means:

• We use Google user data only to provide and improve the features described above, which are the features you connected the calendar for.
• We never use Google user data for advertising of any kind.
• We never sell Google user data or transfer it to data brokers.
• We never use Google user data to develop, train, improve or fine-tune any artificial intelligence or machine learning model, whether ours or anyone else's.
• No human at Mordecai reads your Google user data, except where you have given us specific permission (for example, you asked us to look at a sync problem), where it is necessary for security or to comply with the law, or where the data has been aggregated and anonymised for internal operations.

The AI rep

The rep on a Booked site is powered by Anthropic's Claude models. When a visitor sends a message, that message, the conversation so far, and the business details the owner has given us are sent to Anthropic so a reply can be generated. This happens under Anthropic's commercial terms, which do not permit that content to be used to train their models.

The rep works from facts the owner approved. It is instructed not to invent a price. A booking is only ever made against times our own servers have confirmed are open.

Who else touches your information

We use a small number of companies to run the service. Each is given only what it needs for its job, and none of them may use it for anything else:

• Anthropic — generates the AI rep's replies.
• Stripe — takes payment and manages subscriptions.
• Twilio — sends and receives the text messages.
• Resend — sends our email.
• Google — the public business listing lookup, and Calendar and sign-in if you connect them.
• Cloudflare — serves the sites and manages custom domains.
• Railway and our managed Postgres provider — hosting and the database.

When you book through a Booked site, the business you are booking with receives your name, phone number and job details so it can do that job. It does not receive your text-message consent, and none of this is shared for marketing.

We will also disclose information if the law requires it, to protect someone's safety or our legal rights, or, if Mordecai is ever sold or merged, to the acquiring company — in which case this policy continues to apply until you are told otherwise.

Text messages (SMS)

Texts are sent by Booked by Mordecai (registered with carriers as Mordecai Booked), a service of Mordecai. We only text a mobile number whose owner opted in by ticking an optional, unchecked box on our website. Texting is never required to book or to sign up.

• Customers who book through a Booked site and tick “Text me the confirmation” get the confirmation and any changes to that booking, usually 1 to 3 texts per booking.
• Business owners who tick the optional text box when they sign up at mordecai.co/start get their preview link, alerts about new leads and bookings, and account notices. Message frequency varies with activity.

Message and data rates may apply. Reply STOP to any message to opt out, and HELP for help, or email hello@mordecai.co. We never send marketing texts under this program. Opting out of texts does not cancel an appointment; call the business to do that.

Mobile information and messaging consent are not shared with third parties or affiliates for marketing or promotional purposes. We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. Text-messaging originator opt-in data and consent are excluded from every kind of sharing described in this policy and are never shared with any third party. The full terms for our texts are in our Terms of Service.

How long we keep it

• Your account and business content: for as long as your account is open, and deleted within 30 days of you closing it.
• Leads, chat transcripts and appointments: for as long as the account is open. An owner can delete individual records at any time, and everything goes within 30 days of the account closing.
• Google tokens: deleted the moment you disconnect, or when the account closes.
• Traffic counts: individual page-view records are pruned on a rolling basis; only totals are kept long term.
• Server logs: a short rolling window, for security and debugging.
• Opt-out records: kept indefinitely. If you asked us to stop texting you, we have to remember that in order to honour it.
• Payment records: kept as long as tax and accounting law requires.
• Backups: deleted data can persist in encrypted backups for up to 30 days before those are rotated out.

Your choices and your rights

Whoever you are, you can ask us to:

• Tell you what information we hold about you
• Correct anything that is wrong
• Delete it
• Send you a copy in a portable format
• Stop using it for a particular purpose

Email privacy@mordecai.co and we will answer within 30 days. We will never charge you for asking, and we will never treat you differently for exercising any of these rights.

If you contacted a business through a Booked site, that business holds the relationship with you and decides what happens to your information. Ask them first. If you cannot reach them, write to us and we will pass it on and help them act on it.

Depending on where you live, you may have these rights under laws such as the California Consumer Privacy Act or the GDPR. We extend them to everyone regardless.

How we protect it

• Everything travels over HTTPS.
• Passwords are stored only as salted hashes, and cannot be reversed.
• Google tokens are encrypted before they are stored.
• Each business's data is separated from every other business's.
• Access to production data is limited to the people who need it to run the service.

No service can promise perfect security, and we will not pretend otherwise. If a breach ever affects your information, we will tell you and the relevant authorities as quickly as the law requires.

Children

Mordecai is built for businesses and is not directed at children. We do not knowingly collect information from anyone under 16. If you believe a child has given us information, write to us and we will delete it.

Where your information is held

Our servers and our providers are in the United States. If you are writing to us from elsewhere, your information will be transferred to and processed in the United States, under the safeguards our providers have in place.

Changes to this policy

If we change how we handle your information, we will update this page and move the date at the top. If the change is a significant one, we will email account holders before it takes effect rather than leave you to notice.

Contact us

Questions about this policy, or a request about your information, go to privacy@mordecai.co. For anything else, write to hello@mordecai.co.