Privacy Policy

Wilco is operated by Wilco Inc.(“Wilco”, “we”, “us”), a Canadian corporation. Wilco provides an AI receptionist that businesses use to answer their customers over web chat, text message (SMS) and phone, book appointments and hand conversations to staff.

We handle personal information in two different roles:

• For our own customers (the businesses that sign up, and the people on their teams), Wilco decides how account, billing and website information is used. This policy describes those practices.
• For the people who contact those businesses(“end users”: anyone who chats with, texts or calls a business that uses Wilco), Wilco acts as a service provider and processes their information on the business’s behalf and under its instructions. The business is responsible for that information and for its own privacy practices. If you contacted a business through Wilco, please read that business’s privacy policy and send requests about your information to it. This policy explains what Wilco does with that information as its service provider.

Our Data Processing Addendum sets out our commitments to businesses as their service provider. The Service is not currently offered to businesses located in Quebec.

From businesses and their team members

• Account information: name, email address, password (stored only as a secure hash by our authentication provider), optional phone number, role, and the email addresses of people you invite.
• Business information: business name, hours, services, staff names and contact details used for hand-offs, and the documents, FAQs and other knowledge you add.
• Agreement records:when you accept our terms we record the version, the time, your IP address and your browser’s user-agent string, so we can show what was agreed.
• Billing information: your plan, invoices, usage and spending-cap settings. Payment card details are collected and held by Stripe, never by Wilco.
• Calendar connections: if you connect Google Calendar or Microsoft 365, we store the access tokens (encrypted) and calendar identifiers, read free and busy times, and create, update or cancel the appointment events Wilco books.
• Support communications: what you send us when you contact support.

From end users, on behalf of businesses

• Conversation content: the messages exchanged in web chat and SMS, and the transcript of phone calls, including anything an end user chooses to say or type.
• Contact details: phone numbers of people who text or call, and any name, phone number or email address an end user provides, for example to book an appointment.
• Appointments: the service, time, staff member and contact details for bookings.
• Call information: caller and called numbers, call times and duration, transfer outcome, and a written transcript. Wilco does not record or store call audio. Audio is processed in real time by our telephony provider to recognize speech and to speak replies.
• Messaging consent: a record of each opt-out (STOP) and opt-in (START) and when it happened.
• Web chat context: the address of the website where the chat is embedded. The chat widget does not set cookies or use browser storage, and does not ask for identity unless the end user provides it.

Collected automatically

• Technical data: IP address, browser and device type, and request logs kept by our hosting and authentication providers for security and troubleshooting.
• Usage data: counts of AI processing, messages, call minutes and similar measures used for billing and to enforce plan limits.

• To provide the Service: generate replies, look up a business’s knowledge, check calendar availability, make bookings, and notify staff by email or text when a conversation needs a person.
• To create and secure accounts, authenticate users, and prevent fraud, abuse and spam.
• To bill for the Service, meter usage and enforce spending caps.
• To send service messages, such as confirmations, invitations, password resets and notices about changes to the Service or these terms.
• To provide support. Wilco staff access a business’s account only to provide support or keep the Service secure, through time-limited access that is recorded in an audit log.
• To understand and improve the Service using aggregated or de-identified statistics.
• To comply with law and enforce our agreements.

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use end-user information for our own marketing. We use end-user information only to provide the Service to the business that collected it.

Wilco’s replies are generated automatically. To produce a reply, we send the conversation, the business’s information and relevant excerpts from its knowledge to our AI model provider. To find those excerpts, we send the business’s knowledge and each incoming message to our search-indexing provider. Available appointment times derived from a connected calendar may be included so the receptionist can offer them.

Wilco does not use customer or end-user content to train AI models, and our AI providers’ commercial terms do not permit them to train their models on the data we send. Those providers may keep data for a limited period under their own policies, for example to detect abuse.

AI replies can be wrong or incomplete. They are not professional, medical, legal or financial advice, and Wilco is not an emergency service. In an emergency, call 911 or your local emergency number.

Businesses use Wilco to reply to text messages that people send to the business’s Wilco number, and to text their own staff when a conversation needs attention. Wilco does not send marketing or promotional texts, and does not text members of the public who have not first contacted the business.

• Message frequency varies with the conversation. Msg & data rates may apply.
• Reply STOP at any time to stop receiving messages from that business’s number. We will confirm and send nothing further. Reply START to resubscribe.
• Reply HELP for help, or contact contact@getwilco.app.
• Carriers are not liable for delayed or undelivered messages.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

When a business connects a calendar, Wilco uses calendar data only to show availability and to create, change or cancel the bookings it makes, for that business. We do not use calendar data for advertising, we do not sell it, we do not let people read it except as needed to provide the Service, for security, or to comply with law, and we do not use it to develop, improve or train generalized AI or machine-learning models.

Wilco’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

A business can disconnect a calendar at any time in Wilco, or revoke Wilco’s access from its Google or Microsoft account settings.

We share personal information only:

• with the business an end user contacted, which can see its own conversations, contacts and bookings;
• with the service providers listed below, who process it for us under contracts that limit their use to providing their service;
• when a business connects a third-party service, such as its calendar, as that business directs;
• if required by law, court order or a lawful request from a government authority, or to protect the rights, safety or property of Wilco, our customers or others;
• as part of a merger, financing, acquisition or sale of all or part of our business, subject to this policy.

Service providers

Our primary database is hosted in Canada. Several of our service providers, listed above, process information in the United States. Information processed outside Canada is protected by our contracts with those providers, but it is subject to the laws of the country where it is processed and may be accessible to that country’s courts, law-enforcement and national-security authorities.

We keep account and business information for as long as the account is open. After an account is closed, we delete or de-identify its information on request or when it is no longer needed, except for records we must keep for legal, tax, accounting or dispute-resolution purposes.

End-user information is kept on the business’s behalf until the business deletes it or closes its account. When a business processes an end user’s deletion request in Wilco, we remove that person’s contact details and the content of their messages and appointment details. We keep some limited operational records after that, such as records of messaging opt-outs (so we can keep honouring them), call logs and error logs, for security, compliance and billing.

We protect information with encryption in transit, encryption at rest provided by our hosting providers, separate encryption of calendar credentials, database-level isolation between businesses, and restricted, logged staff access. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach of security safeguards creates a real risk of significant harm, we will notify affected people, businesses and regulators as the law requires.

Subject to legal exceptions, you may ask to access the personal information we hold about you, to correct it, or to withdraw consent to its use (which may mean we can no longer provide the Service). Residents of some U.S. states, including California, may also have rights to know, delete and correct personal information and to opt out of its sale or sharing. Wilco does not sell or share personal information as those laws define it. We will not discriminate against you for exercising a right.

To make a request, email contact@getwilco.app. We may need to verify your identity. If you are an end user of a business that uses Wilco, we will refer your request to that business, because it controls your information, and we will help it respond.

Wilco uses only the cookies needed to keep you signed in and to protect your session. We do not use analytics, advertising or tracking cookies on our website or in the app, and the chat widget that businesses embed on their websites sets no cookies.

Wilco is a service for businesses and is not directed at children. We do not knowingly collect personal information from children under 16 for our own purposes. Businesses must not use Wilco for services directed at children under 13.

We may update this policy. We will post the new version here with a new effective date, and for material changes we will notify account owners by email or in the app before the change takes effect.

Our privacy officer is accountable for our compliance with this policy. Contact: contact@getwilco.app, or by mail at Wilco Inc., Attention: Privacy Officer, Ontario, Canada.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or to the privacy regulator where you live.