Privacy Policy

Audrey is operated by Lachance Préfontaine inc., doing business as “Atelier Drave” and “Audrey” (“Drave”, “we”, “us”), 3472 chemin d'Oka, Saint-Joseph-du-Lac, Quebec J0N 1M0, Canada. For any question: hello@audrey.business · +1 (438) 802-7592.

If you connect your calendar, you grant Audrey — through the relevant OAuth provider — access to it:

• Google: https://www.googleapis.com/auth/calendar.freebusy + calendar.events (reading your availability and creating events);
• Microsoft: Calendars.ReadWrite (reading and writing your calendar).

Although these permissions technically allow reading your calendar, Audrey holds itself to strict minimization: we only query your busy/free windows (free/busy) to compute the slots to offer, and we create appointment events when a customer confirms. The details of your existing events (titles, guests, notes) are never accessed persistently or stored in our databases. We access no other Google data (Gmail, Drive, contacts).

Audrey's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In practice: we use this data solely to provide the appointment-booking feature described above; we do not sell it, we do not use it for advertising, we do not use it to train artificial-intelligence models, and we do not allow humans to read it except with your explicit consent, for security purposes, or as required by law.

The OAuth access tokens (which let Audrey act on your behalf) are stored encrypted at our integration provider (Nango), hosted on our own infrastructure in Canada (OVH, Beauharnois, Quebec). They are never stored in plain text and never leave this infrastructure.

Audrey relies on providers to deliver the service:

• Nango — vault for OAuth calendar tokens. Hosted on our own infrastructure in Canada (OVH, Beauharnois, Quebec).
• Supabase — the service database (your settings, your conversations, your leads). Hosted in the United States (region us-east-1).
• Twilio — sending/receiving text messages (SMS) when that channel is enabled. Receives the number and content of the messages.
• AI provider (LLM) — Anthropic or OpenRouter, depending on configuration — to generate the assistant's replies. Receives the content of conversations, never the details of your calendar.

These providers use your data only to provide their service to Audrey. In particular, the content of your Google/Microsoft calendar is not transmitted to the AI provider.

You can withdraw access to your calendar at any time:

• from your Audrey dashboard: Settings → Your calendar → Disconnect;
• or from your Google account (myaccount.google.com/permissions) / Microsoft account (account.live.com/consent/Manage).

To request deletion of all your information, email hello@audrey.business; we action it promptly.

OAuth tokens are kept while your calendar stays connected, then destroyed within 30 days of disconnection or account closure (or sooner on request). Conversation logs are retained only as long as needed to provide the service, then purged in accordance with our legal obligations.

In accordance with the Act respecting the protection of personal information in the private sector (Quebec), you have the right to access your information, to have it corrected, and to request its deletion. The person responsible for the protection of personal information is Simon Lachance, reachable at hello@audrey.business or +1 (438) 802-7592.

Hosting and transfer outside Quebec: your calendar tokens are kept in Canada (Quebec); the other service data (settings, conversations) is hosted in the United States (Supabase, us-east-1) and may be processed by the sub-processors listed above. We take reasonable measures to protect it.

If you believe your rights are not being respected, you may file a complaint with the Commission d'accès à l'information du Québec (CAI).

We may update this policy. The “last updated” date above reflects the version in force.