Privacy Policy

1. Controller and Contact

The controller responsible for processing your personal data is Nairon GmbH, Rothausstrasse 1, 8280 Kreuzlingen, Switzerland (UID: CHE-308.568.524) ("Nairon", "we", "us", or "our").

For any privacy questions or to exercise your rights, contact us at [email protected].

This Privacy Policy applies to our website and to our AI voice and customer communication services, and is aligned with the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

2. Personal Data We Process

Account and contact data: name, email, phone number, company, role, and login credentials.

Billing data: plan, billing address, tax identifiers, and payment metadata (card details are handled by our payment providers, not stored by us).

Usage and technical data: log data, IP address, device and browser information, feature usage, and diagnostic data.

Communication and voice data: call audio is processed only transiently in real time to generate a transcript and is not retained; we keep transcripts, conversation logs, and related metadata processed when you or your end customers use our voice agents.

Support and marketing data: messages you send us, support tickets, and communication preferences.

3. How and Why We Use Personal Data

To provide, operate, secure, and support the Services, including delivering AI voice agents and dashboards.

To process payments, manage subscriptions, and prevent fraud and abuse.

To improve and develop our Services, including quality assurance and aggregated analytics.

To communicate with you about your account, service changes, and — where permitted — relevant offers.

To comply with legal obligations and to establish, exercise, or defend legal claims.

4. Voice and Call Data

When our voice agents handle calls on your behalf, we process call audio, transcripts, and metadata as a processor acting on the instructions of our business customer (the controller for those calls).

We do not retain the underlying call audio. Audio is processed only momentarily to produce a transcript and is then discarded; only the transcript and related metadata are stored.

We do not make transcripts or call data available to any third party outside the use explicitly permitted by, and on the instructions of, the relevant business customer, except where required by law. Where a customer connects third-party integrations (for example, a CRM, helpdesk, or webhook endpoint), transcripts and related data may be shared with those integrations as part of that permitted use and at the customer’s direction.

Our business customers are responsible for providing any required notices and obtaining any required consents (for example, for call recording) before using the Services to interact with their end customers.

5. Google User Data

Our Services let you connect a Google Calendar so that your AI voice agents can check your availability and book, reschedule, or cancel appointments on your behalf. Connecting is optional and happens only when you explicitly authorize Nairon through Google’s consent screen.

Data we access: when you connect Google Calendar, we request the following permissions: (a) "View and edit events on all your calendars" (calendar.events) and "See and download any calendar you can access using your Google Calendar" (calendar.readonly), used to list your calendars, read event times to determine your availability, and create, update, or delete the appointments your voice agents manage; and (b) your Google account email address (userinfo.email), used only to show you which Google account is connected.

How we use it: we use Google user data solely to provide and improve the user-facing calendar features you have enabled — checking availability and managing appointments booked through your voice agents. We do not use Google user data for advertising, we do not sell it, and we do not use it to build user profiles.

AI and machine learning: we do not use Google user data, including calendar data, to develop, improve, or train generalized or non-personalized AI or machine learning models.

Storage and protection: we store the OAuth access and refresh tokens Google issues to us, encrypted at rest, together with the connected account email and the calendar you select. We do not keep a separate copy of your calendar; event information is fetched from Google on demand when an agent needs it. Details of an appointment booked by an agent (such as its time and the caller’s details) may appear in the related call transcript and logs.

Sharing: we do not share or transfer Google user data with third parties, except (a) with our infrastructure and AI sub-processors to the extent necessary to provide the calendar features, under data processing agreements; (b) as necessary to comply with applicable law or to protect against fraud or abuse; or (c) as part of a merger, acquisition, or sale of assets, with notice to you. Humans at Nairon do not read your Google user data unless you give us explicit permission (for example, for support), it is necessary for security purposes, or it is required by law.

Retention and deletion: we keep Google tokens only while the integration is connected. When you disconnect or remove the Google Calendar integration in the Nairon dashboard, we revoke the token with Google and delete the stored tokens. You can also revoke Nairon’s access at any time at https://myaccount.google.com/permissions. To request deletion of any other data associated with your account, contact us at [email protected].

Limited Use: Nairon’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

6. Legal Bases for Processing

Where the GDPR applies, we rely on: performance of a contract (Art. 6(1)(b)); our legitimate interests in operating, securing, and improving the Services (Art. 6(1)(f)); compliance with legal obligations (Art. 6(1)(c)); and your consent where required (Art. 6(1)(a)).

Under the Swiss FADP, we process personal data where it is justified by the performance of a contract, an overriding legitimate interest, a legal obligation, or your consent.

Where processing is based on consent, you may withdraw it at any time without affecting processing carried out before withdrawal.

7. Sharing and Processors

We share personal data with trusted service providers (sub-processors) who host, secure, and support our Services — such as cloud infrastructure, telephony carriers, AI model providers, payment processors, and analytics tools — under data processing agreements.

We do not sell personal data. We do not disclose call transcripts or conversation data to third parties outside the use explicitly permitted by the relevant business customer — which includes any third-party integrations the customer chooses to connect. We may disclose personal data when required by law, to enforce our agreements, or to protect the rights, safety, and integrity of our users and Services.

8. International Data Transfers

We are based in Switzerland and may transfer personal data to recipients in the EU/EEA and other countries.

Where data is transferred to a country without an adequacy decision, we apply appropriate safeguards, such as the EU Standard Contractual Clauses (with the Swiss addendum where relevant) and additional technical and organizational measures.

9. Data Retention

We retain personal data only as long as necessary for the purposes described in this policy, to provide the Services, and to comply with legal, accounting, or reporting obligations.

Retention periods depend on the type of data and the nature of our relationship. We do not retain raw call audio; only transcripts and related metadata are retained, according to the configuration and instructions of the relevant business customer.

10. Your Rights

Subject to applicable law, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability.

Where processing is based on consent, you may withdraw it at any time. To exercise your rights, contact us at [email protected].

You also have the right to lodge a complaint with a supervisory authority — in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the EU/EEA, your local data protection authority.

11. Automated Decision-Making

We do not use your personal data for automated decision-making that produces legal or similarly significant effects on you without a lawful basis and appropriate safeguards.

Our voice agents generate conversational responses but do not make such decisions about you on our own behalf.

12. Cookies

We use cookies and similar technologies on our website as described in our Cookie Notice.

You can manage cookies through your browser settings and any consent tools we provide.

13. Security

We maintain technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, or alteration.

No system is completely secure, but we continuously review and improve our controls and monitoring.

14. Children

Our Services are intended for businesses and are not directed to children. We do not knowingly collect personal data from children.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect legal, operational, or product changes.

When updates are material, we will provide notice through our website or Services and update the "Last updated" date below.

16. Contact

Nairon GmbH, Rothausstrasse 1, 8280 Kreuzlingen, Switzerland — [email protected].