Privacy Policy

Effective August 26, 2026

Who this covers

WLKS OS is an AI receptionist and business command center operated by WLKS Collective. Businesses subscribe to it; their customers and patients reach it by calling the business’s own phone number. This policy covers both — the business that holds the account, and the person on the other end of the call.

It is written to be read rather than to be defended. Where we do something narrow, we say exactly how narrow.

What we collect

• Business account information. The email address used to sign in, the business name, timezone, phone number, business hours, the team members you invite, and the settings you choose.
• Calls on your line. Recordings, transcripts, and post-call summaries of calls Emma answers, along with structured facts about each call — when it started, how long it ran, and whether it was answered, booked, transferred, or flagged as an emergency. Call audio and transcription are processed by our telephony provider, Retell AI.
• What callers tell Emma. The caller’s name and callback number, the appointment or job they asked for, the time they were given, and any address or note they provided for that booking.
• Dashboard usage. Ordinary server logs from our hosting provider, and a record of significant account actions such as connecting or disconnecting Google Calendar.

We do not collect payment card numbers. Subscription billing, where it applies, is handled by Stripe, and card details never reach our servers.

Google user data

WLKS OS’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Connecting Google Calendar is optional and the product works without it. When a business does connect it, this is the whole of what happens:

• The scopes we request. https://www.googleapis.com/auth/calendar.events, to put bookings on the calendar, plus openid and email so the Integrations screen can show you which Google account is connected rather than saying “connected as unknown”. We request no other scope.
• What we do with it. Two things, and only two. We create a calendar event for an appointment the business has accepted — either booked by Emma during a call, or approved by the owner on the booking requests screen. And we delete that same event again if the business marks that appointment cancelled. Those are the whole of what this product does with your calendar. We do not list, read, or search it, we never touch an event we did not create, and we never read your calendar to learn something about you.
• What we never do. We do not sell Google user data. We do not use it for advertising, and we do not use it to train any AI or machine learning model. We do not transfer it to anyone except as needed to provide this service, or where the law requires it.
• How the token is held. The refresh token Google issues is stored in a database table that has row level security enabled with no access policies for any signed-in user — not even for the business that owns it. Only our server can read it, and it is encrypted at rest by our database provider.
• How it ends. Disconnecting Google Calendar on the Integrations screen deletes that row, and the token with it, immediately. You can also revoke our access at any time from your own Google Account security settings.

How we use what we collect

To answer your phone, book appointments, show you what happened on your line, put approved bookings on your calendar, email you the sign-in link you asked for, and keep the service running and secure. We do not sell any of it, and we never use one business’s data to serve another.

Who we share it with

Service providers only, each doing one job for us:

• Retell AI — answers the call, transcribes it, writes the summary.
• Supabase — the database, and the emailed sign-in link.
• Vercel — hosting.
• Google — only where a business has connected Google Calendar, and only as described above.
• Stripe — subscription billing, where it applies.

We never sell personal information and we never share it for advertising. We may disclose information if the law compels us to, or to protect someone from harm.

Medical practices

For an account marked as a medical practice, WLKS OS deliberately stores no call transcript, no call summary, and no raw call payload. Those columns are left empty by design rather than by accident: we keep the counts and the outcome of a call, not its content. The audio itself stays with Retell AI under their agreement with the practice.

Callers, and recorded calls

Emma tells every caller the call is recorded in the first sentence she speaks, before anything is discussed. Recording and notification law varies by state and by country, and the business that owns the line is responsible for meeting the rules that apply to it — see the Terms.

The business owns its own customer data. If you are a caller and you want to know what a business holds about you, or want it deleted, contact that business directly — they can act on it themselves inside WLKS OS, and we will help them if they ask.

Keeping it, and deleting it

We keep account and call records for as long as the account is open, because the product is a record of what happened on your line. You can disconnect Google Calendar at any time, which deletes the stored token immediately. To delete your account and the data in it, write to wlkscollective@gmail.com from the address on the account; we will confirm and delete it, and backups roll off on their own schedule shortly after.

Security

Each business’s data is separated in the database by row level security, so one account cannot read another’s rows. Traffic is served over HTTPS. Signing in is a one-time emailed link, so there is no password of yours for us to store or lose. No system is perfect and we will not pretend otherwise — if something happens that affects your data, we will tell you.

Children

WLKS OS is a tool for businesses and is not directed at children. We do not knowingly collect information from anyone under 13.

Changes

If this policy changes we will update the effective date at the top, and we will email account holders about anything that materially changes what we do with their data.

Contact

WLKS Collective — wlkscollective@gmail.com. A real person reads it.