Privacy Policy

“Pombi,” “we,” “us,” and “our” refer to the operator of the Pombi service (the “Service”). This policy applies to the Pombi website, dashboard, and the voice and messaging assistant we provide to businesses (“Customers”).

Two kinds of people appear in this policy: the business owner and staff who sign up for and use Pombi, and the end customers of those businesses (the people who call, text, book, or order). We handle the second group’s information on the business’s behalf, as described below.

Account information you give us when you sign up: your name, business name, email address, phone number, business address, hours, services, and pricing.

Business content you configure or generate in the Service: menus and service lists, booking rules, message templates, and the knowledge you teach the assistant about your business.

End-customer information that flows through the Service as we operate it for you, which may include:

• Caller and customer names, phone numbers, and email addresses
• Call audio, transcripts, and text-message content
• Bookings, orders, quotes, and payment status
• Reviews and the replies drafted in response

Payment information. Subscription payments and any payments your customers make are processed by Stripe. Pombi does not store full card numbers; we receive limited details such as the last four digits, brand, and payment status.

Technical information collected automatically: log data, device and browser information, IP address, and usage of the dashboard, used to operate and secure the Service.

• Operate the Service — answer calls and messages, book jobs, take orders, send reminders and follow-ups, and surface everything in your dashboard.
• Generate drafts and suggestions using AI, which you review and approve before they are sent or acted on.
• Process payments and, where you enable it, route your customers' payments to your own connected account.
• Communicate with you about your account, security, and product updates.
• Maintain, secure, debug, and improve the Service.
• Comply with law and enforce our Terms.

We do not sell personal information, and we do not use the content of your calls, messages, or customer records to train third-party foundation models.

The assistant transcribes calls, understands requests, and drafts responses using AI. To do this, relevant content is processed by our AI and voice providers (for example, speech-to-text, text-to-speech, and large-language-model services) solely to deliver the Service to you. Recording and transcription may be subject to consent requirements — see our Terms of Service for your responsibilities around notifying and obtaining consent from callers.

If you connect your Google account, Pombi requests access only to the Google data needed for the features you turn on:

• Google Calendar (calendar events) — to create, read, and update bookings on your calendar so appointments the assistant takes appear on your schedule.
• Google Business Profile (only if you grant it) — to read your listing and, where supported and approved, help manage reviews.

Pombi’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we use Google user data only to provide and improve the features you enable, we do not transfer or sell it to third parties except as needed to operate the Service or as required by law, we do not use it for advertising, and we do not allow humans to read it except with your consent, for security, to comply with law, or where the data is aggregated and anonymized. You can disconnect Google at any time from your dashboard, which revokes our access.

We share information with vendors who process it on our behalf, under contracts that limit their use to operating the Service. These include, by function:

• Hosting and database (application hosting; Supabase)
• Telephony and messaging (Twilio)
• Speech and voice (speech-to-text and text-to-speech providers)
• AI language models (Anthropic)
• Payments (Stripe, including Stripe Connect)
• Point of sale and orders (Square, where you connect it)
• Calendar and business listings (Google)
• Email delivery (Resend)

We may also disclose information to comply with law, to protect rights and safety, or in connection with a merger or acquisition (with notice where required).

We keep information for as long as your account is active and as needed to provide the Service, then for a reasonable period afterward to meet legal, accounting, and security obligations. You can ask us to delete your account data, subject to records we must retain by law.

We use administrative and technical safeguards to protect information, including encryption of sensitive credentials at rest and access controls. No method of transmission or storage is perfectly secure, but we work to protect your information and to notify you of material incidents as required by law.

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, and to object to or restrict certain processing. Business owners can manage most data directly in the dashboard, disconnect integrations, and cancel at any time. To make a request, contact us at pombihq@gmail.com.

End customers of a business using Pombi should contact that business directly; we will support the business in responding to your request.

The Service is for businesses and is not directed to children under 13, and we do not knowingly collect their personal information.

We may update this policy from time to time. When we do, we will change the “Last updated” date above and, for material changes, provide additional notice.

Questions about this policy or your data? Email pombihq@gmail.com.