Privacy & Control

It runs with your own permissions

The assistant has no access of its own. Every look-up and every change is made as the person using it, through the same checks the app applies on its pages. An employee's assistant cannot read a colleague's private records, a department head's cannot reach another department, and nobody's assistant can reach another organization.

It only works with BookYourPTO. It politely refuses questions about anything else, and treats what is written in records, files and tool results as information, never as instructions.

Settings > Intelligence

Executives and administrators decide who can use the assistant in Settings > Intelligence.

Access

The assistant is on for everyone by default. On the Access tab you can:

• Switch it off for whole departments.
• Switch it off for individual people, using the department filter and search to find them.
• Switch a person back on inside a department that is switched off.

Choose Save changes to apply the changes. A person it is switched off for no longer sees the Assistant link or the assistant button, and is told only that it is not available to them.

Company usage

The Company usage tab shows how much the organization has used today, this week and in total, and how many people used it this week. Below that, a per-person table shows each person's usage Today, This week (against the weekly allowance), Questions this week, All time and when they Last used it. It shows amounts only, never what anyone asked.

Each person sees their own usage in Settings > Usage (see Usage & Limits).

Help improve Intelligence

Help improve Intelligence decides whether BookYourPTO may use your organization's assistant conversations to make the assistant better. It is on the Access tab, on by default, and only executives can change it; administrators see it but cannot change it. A change is saved straight away.

• On: BookYourPTO may keep de-identified copies of conversations, with names, email addresses, phone numbers, identification numbers, addresses, dates and amounts removed or replaced, and review them to find and fix problems. At an important moment, such as after a thumbs-down or when a change failed, the assistant may also ask the person whether to share that conversation in full (see Sharing a conversation below).
• Off: the assistant never asks anyone to share a conversation, and BookYourPTO makes no de-identified copies of your organization's conversations. Only usage signals with no message text are kept.

Either way, nothing is used to train an AI model. The full rules are in section 7.3 of the Privacy Policy.

Misuse is recorded

Requests that look like misuse, such as asking for system secrets or another organization's data, trying to override the assistant's instructions, or pasting an injection payload, are refused and recorded as AI Assistant Misuse under Settings > Security > Security Violations, so administrators and executives can review them. The record includes the first 200 characters of the message that was flagged. The most serious never reach the assistant at all.

Your conversations

• Conversations are never used to train AI models, ours or anyone else's.
• Your chats are private to you. Nobody else in the organization can open them. The only exception is the excerpt kept with a misuse record (above).
• What the AI model provider sees. To write an answer, the assistant sends your message, the conversation so far, the records it reads for you, your attached files and your remembered facts to BookYourPTO's AI model provider, which may not use them to train its models. Providers are listed on the Subprocessors page.
• Deleting your data includes the assistant. A privacy data-deletion request (see Account Deletion & Privacy) also deletes your assistant chats, remembered facts and attached files.
• Not on the public demo. The assistant is not available on the BookYourPTO demo site, where sign-ins are shared.

How BookYourPTO improves the assistant

• Usage signals, for every organization. For each answer BookYourPTO keeps signals with no message text: the mode and model used, how long it took, which actions failed and their error codes, whether a confirmation was cancelled, whether the question was corrected, token counts, and any rating with its reason. They help find what goes wrong.
• De-identified copies, only while Help improve Intelligence is on (above).
• Who looks at them. Only authorized BookYourPTO staff, to find and fix problems, check the quality of answers and actions, and improve prompts, tools and features. They may use AI tools from BookYourPTO's existing AI provider to help, under terms that do not allow training on the data. It is never sold, shared with other customers or used for advertising.
• How long. Usage signals, de-identified copies and shared conversations are kept for no more than 24 months. Files exported for a particular review are deleted within 30 days of it.
• Deleting removes it. Deleting a conversation, or erasing a person's data, removes it from future improvement copies; copies already exported for analysis are deleted within 30 days.
• Calendar account details are left out. Information that comes from Google, such as the email address of a connected Google Calendar, is removed from anything kept for improvement.

Sharing a conversation

When something has gone wrong in a chat (you gave an answer a thumbs-down, an action failed, you cancelled an approval card, the assistant said it was done while a change had failed, or you asked the same question again), the assistant may ask below its answer whether you are willing to share that conversation in full. It asks at most once every 7 days, and never twice in the same chat. It never asks on the public demo or while Help improve Intelligence is off.

• Share full conversation keeps the whole conversation, including the actions taken and their results, with people's names, contact details and identification numbers replaced. Dates and amounts are kept, because they are often what went wrong.
• No, keep it de-identified treats the conversation like any other.
• Don't ask again stops the question for you.

To withdraw a choice to share, or to object to your conversations being used this way, ask your organization's executives to switch Help improve Intelligence off, or email privacy@anhourtec.com.