OPENBOOKLY · LAST UPDATED SEPTEMBER 14, 2026

Your privacy, in plain language.

You can search the map and ask questions without an account. This policy explains how Openbookly processes information when you use the service.

Map searches and location

We send search terms and the viewed map area to Google Maps, or to Photon when using the OpenStreetMap alternative. Maps and business details load from the selected provider, which receives information needed to return them and may receive your IP address. Google Maps features are governed by the Google Privacy Policy and Google Maps End User Additional Terms of Service. Vercel provides an approximate city from your IP address to set the initial map area. We do not save that city or your coordinates in our analytics. Your precise device location is used only when you choose the location button and grant your browser permission.

We keep Google place identifiers to connect business profiles and conversations. Google names, addresses, reviews, and other business-card content are displayed without saving them in our place database. Selected Google place coordinates may be cached for up to 28 days to position premium markers. Business owners provide their own profile information separately. OpenStreetMap place information may be cached to make repeat searches faster.

Questions and AI answers

When you ask a question, we send your conversation context and relevant owner-provided business information and knowledge to OpenAI to generate an answer and check content safety. For OpenStreetMap listings, this may also include public listing information. For an unregistered Google Maps listing, we include the selected business’s displayed name and address so the answer refers to that business. We do not include its other business-card fields, such as reviews, photos, or contact details. For a business that has not registered, answers use the model’s existing knowledge by default. Only when you explicitly request an online lookup do we enable OpenAI’s web search and include the place identifier as an identity hint. For those lookups, search queries derived from your question may be processed by its search providers and answers include available source links. The assistant may ask for clarification if the selected identity is missing or ambiguous. OpenAI processes requests under its API data policies.

We enable OpenAI request logs so authorized Openbookly operators can investigate answer quality and service problems. These logs contain the conversation context, including any selected business name and address, and business knowledge excerpts sent to the model and its generated response, which may include output that our safety checks prevent from appearing in chat. OpenAI stores these responses for at least 30 days, subject to its API data retention policies. Contact details entered in the separate follow-up form are not included.

New conversations, including your questions and the assistant’s answers, are saved in Supabase for 90 days and can be reviewed by the owner of the corresponding business in its private dashboard. For an unclaimed listing, its owner can review the conversation after joining Openbookly. Earlier conversations that were not saved cannot be recovered. A secure, essential browser cookie protects access to your conversation; signing in is optional. Please avoid sharing sensitive personal, medical, financial, or confidential information in chat.

Optional business follow-up

We ask whether you want the business to contact you later. If you agree, you choose the name and email address or phone number to share and may add details about your request. You may select the email from your signed-in profile and confirm it, or enter contact details yourself. Signing in alone does not share your profile email with a business. We save your chosen contact information, optional follow-up details, consent, and the request’s status with the conversation for the business owner. Contact information and follow-up details entered in this form are not sent to the AI model. Requests for an unclaimed listing wait until the business joins; a reply or response time is not guaranteed.

Accounts and business knowledge

Supabase Auth handles sign-in, email confirmation, and supported Google sign-in. Essential secure cookies keep your account signed in. Transactional account emails may be delivered through Resend. If you claim a business, we store your account identifier, email address, contact name, ownership declaration, business information, and uploaded text in Supabase. Owners can edit or delete knowledge documents in the dashboard. Knowledge is used to answer public questions, so upload only information you are authorized to share with customers. Raw documents are accessible through the dashboard only to their owner.

Payments

Stripe processes subscriptions and card details. Openbookly stores Stripe customer and subscription identifiers, subscription status, and billing dates to manage premium access. We do not receive or store your full card number. Receipts, payment details, and cancellation are available in Stripe’s customer portal.

Security and usage information

We keep aggregate chat counts, request-limit records, and AI usage totals to operate the service and prevent abuse. Request-limit identifiers are hashed. Vercel hosts the application and provides operational logs and aggregate web analytics. We record daily totals for page views and actions such as searches, business views, questions started, knowledge updates, and billing visits. These platform totals contain no search text, messages, knowledge content, business identifiers, email addresses, location, or visitor/session identifiers.

Separately, a business’s private activity feed records its listing identifier, the time, and supported actions such as opening its card or conversation and choosing an Openbookly directions or website link. This activity feed does not identify the visitor or contain their search text, contact details, or location. Provider-controlled links inside Google’s own card may not be observable by Openbookly. Activity analytics respect browser Do Not Track and Global Privacy Control signals; these preferences do not disable the conversation storage needed to provide chat and requested follow-up. Authentication and private reporting pages are excluded from Vercel page tracking. We do not sell your personal information or use chat content for targeted advertising.

Public community visitor counts

Our map shows how many browsers are visiting recently and progress toward 10,000 unique visitors since this counter launched. After a short visible visit, a separate secure, HttpOnly first-party cookie assigns your browser a random identifier. Repeat visits and tabs reuse it. We store a one-way keyed hash to prevent counting that browser again, and a recent-activity timestamp to estimate visitors active within the last five minutes. This is website activity, not physical foot traffic at a business. The counts do not identify people: separate browsers, devices, or cleared cookies can count again.

The cookie expires after one year and is renewed on return. We retain its hashed counting record for the life of this community goal, separately from account and conversation cookies. Short-lived presence records expire after five minutes and are routinely cleaned up. Hashed network limits help prevent automated inflation; we do not store raw IP addresses in community records. These records contain no account details, search queries, chat, contact information, or browsing history. Only totals are public. Browser Do Not Track or Global Privacy Control stops community counting, as do known automated clients and non-production testing. You can still view the totals. You can remove the community cookie in browser settings; doing so may cause a later visit to count again.

Retention and your choices

We routinely remove request-limit records older than two days, cached OpenStreetMap records older than seven days, and completed AI usage metadata older than 90 days. Google coordinate caches expire within 28 days and expired rows are cleaned hourly. Action totals are retained for up to 365 days. Other cleanup runs daily in batches. Pending spending reservations and billing records are retained for accounting and security.

Saved conversations, associated follow-up details, and individual business activity are available for 90 days, with expired records removed by daily cleanup. A business may separately retain information you asked it to use for follow-up under its own practices. Contact tenthousandai@gmail.com to request access, correction, or deletion of your Openbookly conversation or contact details; we may ask you to verify the request.

Business records and knowledge remain while needed to provide your account. Deleting a knowledge document removes it from active use; provider backups may retain copies according to their retention schedules. Billing and security records may be retained where required for financial records, disputes, or abuse prevention. Contact us to request account deletion, a copy of your information, or a correction. We may need to verify your identity before acting.

Service providers and changes

Our providers may process information in countries other than yours. Their policies describe their own processing: Google, OpenStreetMap, Komoot / Photon, Supabase, OpenAI, Stripe, Vercel, and Resend. We will update this page when our practices change.

Questions? Contact tenthousandai@gmail.com.