# Privacy notice

C-R Consulting is the data controller for personal data collected by this booking
assistant.

## What we collect

When you use the assistant to discuss or book a consultation, we may collect your
message content, email address, selected meeting time, calendar invite details, and the
fact that you contacted C-R Consulting about AI consultancy.

## Why we use it

We use this data to answer your enquiry, verify that you control the email address used
for a booking, create or cancel calendar events, send calendar invites, and follow up on
the consultation request.

The lawful basis is legitimate interests: responding to business enquiries, arranging
consultations, and keeping booking records. If a CRM lead is created from your enquiry,
the same basis applies.

## How long we keep it

One-time password records expire after 10 minutes. Conversation state used by the agent
expires after 24 hours. Booking records remain in C-R Consulting's internal Odoo system
for business administration unless deletion is requested or a longer legal retention
need applies.

## Who can see it

Customer booking events are for internal C-R Consulting use in Odoo. They must not be
published publicly or exposed through a customer portal. If C-R Consulting ever publishes
availability publicly, it should publish anonymised free/busy slots only, never attendee
names, emails, or message content.

## Logs

The system must not log plaintext OTP codes or full conversation history. Operational
logs use conversation and booking identifiers, and hashed email identifiers where
correlation is needed.

## Your rights

You can ask C-R Consulting to delete or correct your personal data. Contact Rogerio at
C-R Consulting with the email address used for the booking and, if relevant, the booking
time so the request can be located.