YOUR INFORMATION

Privacy policy

Last updated: 19 October 2026

guisesAi stores your page details, uploaded images, conversation progress and published versions under your signed-in account. Published pages are public. Sign-in is required to create or edit a page.

Google sign-in and Business Profile

On guises.ai, Google sign-in identifies your account. If you separately connect Business Profile, we read the business listings you can access to help you choose your business. We do not edit your Google listing. Access tokens are stored in an encrypted, secure, HTTP-only session cookie and are used only until they expire; signing in and Business Profile do not request offline access. You can sign out or revoke Google access through your Google account. This feature requires Google approval before it is enabled.

Existing websites

If you provide an existing website, we request that public page without your login or cookies. Suggested names, introductions and services are saved with your draft for review. Only the fields you choose are added to your page. We do not copy website images or import private pages.

Google Maps

When you request a lookup, your business name, area and Maps link are used to find the listing through Google. We save your supplied link and the selected Place ID. Returned Google business details and reviews are loaded live, are not saved in your profile or export, and may change. Review author images may load from Google when a visitor opens your page.

Google handles information under its Privacy Policy. Opening Google Maps or WhatsApp links takes you to those services.

Published pages connected to a Google Maps listing can show a map from Google. It loads from Google only when a visitor scrolls to it, and Google then receives that visitor’s request under Google’s own privacy policy.

Appointments

If you add a Google booking link, visitors complete their booking with Google. guisesAi does not access your calendar or collect appointment information through these booking links. WhatsApp appointment requests are sent through WhatsApp. Your name, story and photo captions are saved with your page; review the preview before publishing.

Optional Calendar management

If you separately connect Google Calendar in the appointments workspace, guisesAi reads your calendar list and the event titles and times needed to show the selected calendar. With your confirmation, it can reschedule or cancel eligible events and create private busy blocks. Update and cancellation requests ask Google to notify event guests. Event titles, descriptions, guest names and guest email addresses are processed for these actions and are not saved in our website database or exports. To mark guests who have booked with you before, we keep, for each booking you have viewed, only a one-way keyed fingerprint of the guest’s email address, which cannot be turned back into the address, together with the booking’s start time and Google’s event identifier. This is used only to show you a guest’s earlier bookings, is removed when the booking no longer appears in your calendar, and is deleted after two years. The access token is kept in an encrypted, secure, HTTP-only cookie until expiry, for at most one hour.

Bookings on your page (Pro)

If you connect Google Calendar from the chat, so that visitors can book appointments on your page (the calendar can belong to any of your Google accounts, not only the one you sign in with), Google gives us lasting (offline) access to your calendar and we keep its refresh token, encrypted, with your account email, your appointment length, and your time zone with where it came from (your calendar, your Google listing, the device you use in the chat, or your own choice when you tell us where you’re based). Your booking times, online consultation times and whether booking is on are saved with your page. We use it only to work out your free times from your booking times and the times your calendar shows as busy, to add the bookings visitors and you make, to add and remove the days off you mark in the chat (as busy “Day off” events in your calendar), and to list and cancel upcoming appointments when you ask in the chat. We do not show your other events to anyone. To stop two visitors taking the same time, a booking briefly holds a lock that records only your account and when the lock ends, never who is booking. A visitor who books gives their name and phone number, and may add a note. Normally they also give an email address, and we email them a link that opens the booking for them to confirm with a button; only once they press it are these written into the booking in your Google Calendar and sent to you by email, and Google sends the visitor the invitation. If you turn email confirmation off in the chat, the booking is made as soon as the visitor sends their name and phone, an email address is optional (Google sends an invitation only if they give one), and the same details go into your calendar and your email. The form asks visitors not to include private medical or financial details in their note. The details wait for confirmation only inside that sealed, 30-minute link, not in our database. Apart from the emails about a booking, which wait encrypted in our email queue until they are sent (usually seconds; at most 30 minutes for the visitor’s confirmation link and a day for your alert) and are then deleted, we do not keep visitors’ details in our database; to limit misuse we count bookings per day using one-way keyed fingerprints of the visitor’s network address and email, which cannot be turned back into either. Disconnect Google Calendar in the chat deletes the stored token at once, and you can also revoke access in your Google Account.

Disconnect Calendar in the appointments workspace removes that browser session’s Calendar token.

Google API data and Limited Use

guisesAi’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the features you turn on, as described above. We do not sell it, use it for advertising, or use it to train AI models, and people at guisesAi do not read it unless you ask us to for support, it is needed for security, or the law requires it.

Who we share Google user data with

We do not sell, rent or trade Google user data, and we do not share it with advertisers, data brokers or anyone else for their own use. Google user data means your Google account name, email address and profile picture from Google sign-in, and the calendar list and events you let us use when you connect Google Calendar.

We disclose it only in these cases:

• Google. Requests to view, change or cancel your calendar events go back to Google, and Google sends any guest notifications.
• Cloudflare, our hosting provider. Cloudflare runs our servers and database on our behalf, under its data processing terms, and does not use the data for its own purposes. Calendar event details pass through these servers only while a request is handled; the only Calendar data kept is the one-way fingerprint described above and, if you turn on bookings, the encrypted calendar connection described under Bookings on your page.
• The law, safety and business changes. If the law requires it, to protect people’s safety or to investigate abuse; or to a successor if guisesAi is merged or sold, who must keep the same protections, and we will tell you first.

Google user data is never sent to Anthropic or any other AI provider. The writing help, photo framing and hours-by-message features described below use only what you type or upload yourself, never data received from Google APIs.

How we protect your data

• Everything is sent over HTTPS (TLS), between your browser, our servers and Google.
• Google access tokens from signing in and from the appointments workspace are encrypted with AES-256-GCM and kept only in a Secure, HttpOnly cookie that scripts cannot read. They are never written to our database and last at most one hour.
• If you turn on bookings on your page, the one exception is your calendar’s refresh token: it is kept in our database encrypted with AES-256-GCM and bound to your account, so it can’t be used for anyone else, and it is deleted the moment you disconnect Google Calendar or delete your account.
• Guest email addresses are never stored. Only a keyed one-way fingerprint (HMAC-SHA-256), which cannot be turned back into the address, is kept, and it is deleted after two years at the latest.
• Our database and file storage are encrypted at rest by Cloudflare.
• Each account can reach only its own pages and calendar; every request is checked against the signed-in account, and changes are only accepted from guises.ai itself. The admin board is limited to named administrator accounts and shows no Google Calendar data.
• The encryption keys are kept as secrets on our hosting platform, not in our code.
• If we learn of a breach affecting your data, we will tell you without undue delay.

How the page builder is used

To see where people find the page builder hard, we count how many reach each question. Each browser tab gets a random number that is not linked to your account, your answers or your network address, and we keep only that number and the question reached, for 90 days.

Writing help and photos

Some features use Anthropic’s Claude models. When you tap “Write it for me” or “Suggest one for me”, the details you have entered for your page are sent to Anthropic to suggest wording or a look; nothing is added to your page until you choose it. When you change your hours by message, that message is sent to Anthropic only to read which days and times you mean; you see the change and confirm it before anything is saved. When you upload a photo, it is sent to Anthropic once to find its subject (the face in a profile photo, or the main thing in a gallery or cover photo), so crops keep it in view; only that position is saved. Anthropic processes this to answer the request and does not use it to train its models.

Plans and payments

We keep your plan, until when it lasts, and any access codes you have used. Payments are handled by Dodo Payments, our payment partner, which acts as the reseller (merchant of record). We send it only your email address, for the receipt, and an internal account number so the payment reaches the right account. At checkout, which appears on guises.ai inside a secure Dodo Payments frame, you give it your name, your country, a postcode only where tax rules require one, and your card or other payment details; these go straight to Dodo Payments and never through our servers. Neither we nor the checkout ask for your phone number or street address. Dodo Payments uses this to take the payment and work out tax, under its own privacy policy. We receive only whether you paid, for which plan, and until when.

Account emails

We email you about your account only: when Pro starts, a week before it renews, when you cancel it, when an access code is applied, and once before paid plans begin if you joined early. If your page had visitors, we also send a short weekly summary on Mondays; every one has a link to stop it, and you can turn it off on your Visitors page. These go out through Resend, our email provider, which receives your email address, your first name and the message. We keep a record that each email was sent, without its text, so it is never sent twice. Each email waits, encrypted, in a short queue until it is sent, so one that fails is tried again for up to a day; its text is deleted as soon as it is sent, and one that could not be sent is deleted within a week. We do not send marketing emails or share your address.

Sites you host with us

If you upload a website you built yourself (a Pro feature), we store the files you upload, a list of its versions with their dates and sizes, and a one-way hash of its deploy key, never the key itself. We read the files when they arrive only to check them: for file types we can serve, for secret keys that should not be public, and for password or card fields, which we may look at to prevent phishing. The site is public at its guises.site address, served by Cloudflare. We do not add tracking or cookies to it and do not count its visitors; Cloudflare may keep standard request logs. Files are deleted when you delete the site, when older versions are replaced (we keep the latest five), or 60 days after Pro ends.

Storage and service providers

Cloudflare hosts this service and stores saved drafts, uploaded images and published versions. Resend sends account emails. Your browser also stores conversation progress and your language preference. Essential cookies keep you signed in. Google receives requests when you use Google sign-in or Maps features. No advertising trackers are intentionally added by guisesAi.

Retention and control

Saved page information and published snapshots remain in the service so you can return, edit and undo changes. Removing content from your current page does not remove earlier snapshots. To remove a page completely, delete it from My pages: this takes it offline and permanently deletes every saved version, its visitor counts and any photos no other page of yours uses. Disconnecting Google does not delete your saved website. Clearing browser storage removes local progress; it does not delete server-side copies. To delete your account, use Delete my account on your plan page: it permanently deletes all your pages and their versions, visitor counts, photos, hosted sites and their files, and your own domains; disconnects Google Calendar and withdraws our access at Google; and removes your plan, codes used, email preferences and the record of emails sent. Appointments already in your Google Calendar stay there. If you pay for Pro, cancel it first. We keep payment records (the subscription’s identifiers, status and dates), as tax and refund rules require, with nothing else of your account attached.

Your page

You can edit your details, remove the Maps connection, hide reviews, and export your published website from the chat.

Visits to published pages

When someone opens a published page, we count the visit so the page owner can see how many people came, roughly where they came from (for example Google or Instagram), and how many tapped Call, WhatsApp, Email, Book or directions. Published pages set no cookies and run no scripts. To count a person once a day, we keep a one-way fingerprint of the day, the page, the network address and the browser, which cannot be turned back into any of these and is deleted after that day. We never store network addresses. Owners see totals only.

Operator and contact

guisesAi is operated by Kishlaya Kumar, an individual based in India. For support, privacy questions, or requests to access, correct or delete your stored information, email ping@guises.ai.