Privacy policy

1. Who we are

Fellix AI OÜ, a company registered in Estonia, provides Fellix AI (the service) and publishes this website. For questions about this policy, for a request about your own personal data, or for help with the product, email [email protected].

2. What we collect, and when

Visiting this website. The pages you open and when, the browser and device you use, an approximate location derived from your IP address, the hostname of the site that linked you here (the hostname only — never the full referring address), and any campaign parameters carried in the URL you arrived on: utm_source, utm_medium, utm_campaign, utm_term, utm_content, gclid, wbraid, gbraid, fbclid and msclkid.

Booking a demo. The name, email address and anything else you type into the scheduling form on our demo page. That form is Calendly’s and your booking goes to Calendly directly; we pass it the campaign values above so a booking can be credited to the campaign that produced it.

Chatting with us here. The messages you send to the chat bubble on this site, any name, email address or phone number you choose to give it, and the technical details needed to deliver the conversation.

Holding an account. Your name, work email address, the organisation you belong to, your role in it, and the data needed to authenticate you. If you subscribe, the billing details needed to invoice you.

Signing in with Google, or connecting a calendar. If you use Sign in with Google, the identity Google confirms for you. If an owner connects the organisation’s Google Calendar, the busy hours on the calendars they select, and the appointments Fellix writes back. Clause 6 says exactly which permissions are asked for, what is kept, and how to withdraw it.

Signing in with Apple. If you use Sign in with Apple, Apple hands us a signed identity token for your Apple ID, asking for two permissions: your name and your email address. We read four things from that token and nothing else — the identifier Apple uses for you with Fellix, your email address, whether Apple has verified it, and whether it is a private relay address. Apple gives us your name the first time only, and we use it only to create your account. We keep the rest on your Fellix user record, with when you last signed in this way, so that the same Apple ID signs you back in next time. If you choose Hide My Email, the address we hold is a random one at privaterelay.appleid.com: the mail we send you passes through Apple, which forwards it to you, and Apple tells us when you turn that forwarding off or on again, which your profile then shows. Apple also gives us a token, which we keep encrypted and use for one thing: taking Fellix off your Apple ID when you disconnect Apple or your account is deleted. Signing in this way gives us no access to your iCloud data, your contacts or anything else in your Apple ID. You can stop using Apple with Fellix from your Apple ID’s Sign in with Apple settings; Apple tells us, and we end that connection and the sessions it opened.

Signing in with a passkey. A passkey you add is made and kept by your device or your password manager. We store its public key, which can check a sign-in but cannot make one, the name you give it, when it was added and last used, and what the passkey standard reports about it: the kind of authenticator it lives on, whether it is synced or backed up, a counter that helps spot a copied key, and how your device reaches it. Your fingerprint, your face and your device’s PIN never leave the device; we never receive them.

Using the service. The content your organisation puts into Fellix: messages across the channels it connects, calls and their transcripts, its clients’ contact details, appointments, notes and uploaded files. This is the content in clause 3 — we hold it for your organisation, on its instructions.

Connecting an AI assistant or another app. The app’s name and the permissions you approved for it, and a record of each call it makes on your behalf. Clause 11 says what such an app can reach, what we keep and how to disconnect it.

Keeping it running. Server logs of the requests your browser and your account make, including IP address, timestamp and user agent, which we need to keep the service available and to investigate abuse.

3. When we are the controller, and when we are only the processor

Your own data — we are the controller. The account you hold, the email we send you, what you do on this website, and any conversation you have with us. This policy is the notice for that data, and you can bring a request straight to us.

Your clients’ conversations — we are the processor. When an organisation uses Fellix to answer its own clients, that organisation chooses what is collected, for what purpose and for how long. We process it under a data processing agreement and act on that organisation’s instructions.

So if you reached us because you messaged a business that uses Fellix, the business you were talking to is the controller and your request belongs with them. Tell us at [email protected] and we will help them carry it out — but we will not delete or disclose their records on our own initiative.

4. Why we use it, and our legal basis

To provide what you asked for. Creating and running your account — including signing you in with Google, Apple or a passkey when you choose one instead of a password — delivering the service, reading and writing the calendar an owner connected, invoicing, and answering support requests. Legal basis: performance of a contract (Article 6(1)(b) GDPR), or the steps taken at your request before there is one.

With your consent. Analytics and advertising cookies, and any marketing email you opted into. Legal basis: consent (Article 6(1)(a)). You can withdraw it at any time; clause 5 says how.

To keep the service safe, and to see what works. Preventing abuse and fraud, investigating incidents, and understanding in aggregate which pages and campaigns bring people here. Legal basis: our legitimate interests (Article 6(1)(f)), weighed against yours and served with the least data that answers the question.

Because the law requires it. Accounting and tax records, and responses to lawful requests from authorities. Legal basis: legal obligation (Article 6(1)(c)).

5. Cookies, and how measurement works here

What may load. Our Google Tag Manager container loads the measurement and advertising tags we use: Google Analytics 4, Google Ads conversion tracking and the Meta pixel. The container is served from our own domain rather than Google’s, so the cookies it sets are first-party ones belonging to fellix.ai. What sits inside a container changes as campaigns do; those three are the categories it is configured to carry.

Consent comes first, by region. Before any tag loads, we set Google Consent Mode v2 to deny advertising and analytics storage for visitors in the EEA, the United Kingdom and Switzerland, and to allow it elsewhere. Denied is not silence: Google’s tags still send a cookieless ping that carries no identifier and sets no cookie, which is how a visit is counted without tracking you.

The banner. Accept or Decline. Your answer is kept in this browser under fellix.consent and applies on your next visit, so the question is asked once per browser. Declining also deletes the attribution cookie below, which is written when you land — before anyone has been asked.

Changing your mind. Clear this site’s data in your browser: the stored answer goes with it, and the banner asks again on your next visit. On a shared or work machine, that is also how you undo an answer somebody else gave.

Cookies we set ourselves. fx_attr — first-party, 90 days — holds the campaign parameters, the landing page and the referring hostname from clause 2, so that a demo booked on a later visit is still credited to the campaign that brought you. It carries no name, email address or account identifier. The chat widget separately keeps a visitor token and its open or closed state in this browser’s storage, so a conversation you start is still yours when you come back.

6. Google sign-in, and a connected Google Calendar

Signing in with Google. If you sign in with Google rather than with a password, Google hands us a signed identity token for the account you picked, using the three permissions that identify a person: openid, email and profile. We read five things from that token and nothing else — the account identifier Google uses for you, your email address, whether Google has verified that address, your first and last name, and the web address of your profile picture. We keep them on your Fellix user record so that the same Google account signs you back in next time and your colleagues can see who you are. Signing in this way gives us no access to your Gmail, your Drive, your contacts or your calendar.

Connecting a Google Calendar. An owner can connect an organisation’s Google Calendar so that Fellix stops offering hours that are already taken and writes the appointments it books onto the right calendar. That connection asks Google for four permissions and each is used for one thing: calendar.readonly to see when the selected calendars are busy; calendar.events to create, move and cancel the appointments Fellix itself booked, and nothing else on the calendar; openid and email so the settings page can show which Google account is connected. Nothing is connected without an owner passing through Google’s own consent screen, and it is undone in the same place.

What we keep from a connected calendar. We do not copy your calendar. For events inside the period we schedule against, we keep a busy record: which calendar it came from, Google’s identifier for the event, when it starts and ends, whether it lasts all day, and the event’s title, shortened. Guests, descriptions, locations, attachments and meeting links are not stored: Google’s reply carries them, and we keep none of them — the guest list is looked at once, in memory, and only so that an invitation this account has declined is not treated as a commitment. The title is kept because one screen needs it — the double-booking report, which tells a manager whether a clash is the same person or the same room — and it is shown only to the team members allowed to manage the calendar connection itself. It never reaches a website visitor, and it is never given to the AI agent.

What we write back to it. When Fellix books an appointment on a connected calendar, the event it creates carries the word Appointment with the client’s name, the note taken during the booking if there is one, the start and end time in the organisation’s time zone, and a hidden marker that lets us recognise the event as ours later. That is the whole of what leaves us for Google Calendar. Deliberately absent is the visitor’s link for managing their own appointment: it carries a cancellation token, and a calendar entry is visible to everyone the calendar is shared with.

Where the access lives. The access and refresh tokens Google issues are encrypted at rest, held against the organisation that authorised them, and used for nothing but the calls described above. We request no further scope, and we call no other Google API with them.

What we never do with it. Data we receive from Google is used only to run the two features on this page. It is not sold, it is not shared with anyone for their own purposes, and it never reaches the measurement or advertising tags in clause 5. It is not used to train, fine-tune or evaluate any AI model, ours or a provider’s. Our own staff do not read it, except where that is necessary to fix a fault you have reported to us, to investigate abuse, or where the law requires it.

Taking it back. Disconnecting the calendar in Fellix — Settings, then Integrations — deletes every busy record and every change subscription we hold for that account at that moment, and we stop using its tokens. You can also withdraw our access from your own Google account, under the third-party connections listed at myaccount.google.com/permissions, which stops it at our next call. Closing your Fellix account removes the Google identifier and profile-picture address held on it, on the timetable in clause 9.

Fellix AI’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Read the Google API Services User Data Policy.

7. Who else sees it

These are the recipients that personal data from this website reaches, and what each one does with it:

Google Ireland Limited

Tag Manager, Analytics 4 and Google Ads — website measurement and campaign reporting, subject to your consent.

Meta Platforms Ireland Limited

The pixel and conversion reporting behind our Instagram and Facebook campaigns, subject to your consent.

Cloudflare, Inc.

Hosting, content delivery and protection for this website and the chat widget — every request to fellix.ai passes through it.

Calendly LLC

The scheduling form on our demo page. A booking you make there is submitted to Calendly directly.

The service relies on further sub-processors: infrastructure, the messaging and telephony channels a customer connects, and the AI model providers that generate replies. They are named in our data processing agreement, which we will send you on request at [email protected]. None is added without a contract binding it to the obligations in this policy.

We do not sell personal data, we do not share it for anybody else’s advertising, and we do not use the content in your account to train AI models — see clause 10.

8. Transfers outside the EEA

Some of the recipients in clause 7 are established outside the European Economic Area, or belong to groups that are. Where personal data is transferred out of the EEA we rely on the European Commission’s standard contractual clauses, or on an adequacy decision where one covers the recipient — including the EU–US Data Privacy Framework for recipients certified under it. Ask at [email protected] which safeguard applies to a particular transfer and we will tell you.

9. How long we keep it

Website measurement. The fx_attr cookie expires 90 days after your first visit. Analytics data is kept for the retention period set on our Google Analytics property, after which Google deletes it automatically.

Demo bookings and sales conversations. For as long as we are in contact about it, and up to 24 months afterwards — sooner if you ask us to delete it.

Organisations, and the content in them. For as long as the organisation exists. After a termination we keep it for 30 days so that you can export it, and may delete it from our active systems and backups after that. An organisation an owner deletes in its settings is erased 30 days later; one an owner asks support to erase, or one terminated for breach, is erased at once. An organisation that has never paid for a plan is erased after 30 days in which nobody uses it, a week after we email its owners. Our terms of service describe each.

What erasing an organisation leaves behind. Erasing deletes everything the organisation held: its content and files, its connected apps, and the access it gave other services, which we revoke. We keep a record that it existed and was erased: its name, plan, time zone and languages, the dates, who asked and why, each former member’s role, and the link to its invoices, which are accounting records (below).

Your own user account. Your name, email address and the ways you sign in belong to your user account, not to an organisation, so erasing an organisation leaves them in place: you may belong to another one, or start one later. They last until you ask us to delete your account, by writing to [email protected] from the email address it uses.

Sign-in identities and calendar data. The Google or Apple identity on your user record, and your passkeys, last as long as the account does, unless you remove them from your profile first; removing Apple, or deleting the account, also takes Fellix off your Apple ID. A connected calendar’s busy records and access tokens last as long as the connection: disconnecting it, or withdrawing our access from your Google account, ends both — see clause 6.

Connected apps. The record of each call an app or API key makes is kept for 90 days, then deleted. A connection lasts until it is disconnected or its refresh token expires, as clause 11 describes; an app that registered itself and was never connected is deleted after 30 days.

Security logs. Up to 12 months, then deleted.

Accounting records. For the period Estonian accounting and tax law requires, which we cannot shorten on request.

10. AI, and what is automated

We do not train on your content. We do not use your data, or your clients’ conversations, to train, fine-tune or otherwise develop any generative AI or machine-learning model — ours or a third party’s — except with your separate, specific, opt-in consent. The model providers that generate replies for us are contractually prohibited from training on what we send them.

What the agent does by itself. The AI agent reads a conversation and drafts or sends replies, classifies and routes messages, and can book appointments, within the configuration your organisation sets. It makes no decision that produces a legal effect on you or anything of comparable significance, and anyone on your team can take a conversation over at any point.

11. AI assistants and other apps you connect

Fellix runs an MCP server at api.fellix.ai/mcp, beside a public API, so that an assistant such as Claude or ChatGPT, or another app, can work in an organisation’s account when someone asks it to. Nothing is connected until a member signs in to Fellix from that app and approves the permissions it asks for on our consent screen, or until an owner creates an API key.

What a connected app can see and do. It acts as the member who connected it. It sees only the conversations, clients and appointments that member sees in Fellix, does only what their role allows, and only within the permissions they approved. A message it sends goes out under that member’s name. An API key acts for the whole organisation instead, within the permissions the owner gave the key.

What we keep about the connection. The name, website, logo and return addresses the app registers itself with, which permissions were granted and by whom, and one record for each call it makes: which tool or endpoint, when, how long it took and whether it succeeded. That record does not contain what was read or written; a change the app makes is stored in the account like any other change made there. An access token lasts one hour. The refresh token that renews it expires after 30 days without use and after 90 days at the latest, and we store it only as a one-way hash.

Who else sees it. The company that runs the assistant, such as Anthropic for Claude or OpenAI for ChatGPT, receives what the assistant reads through Fellix. You choose that company, not us, and it handles what it receives under its own terms and privacy policy. We send it only what the assistant asks for through the permissions you approved, and nothing on our own initiative.

Ending a connection. Profile, then Connected apps, lists every app you connected and disconnects any of them at once. An owner can disconnect anyone’s under Settings, then API keys. Deactivating or removing a member ends their connections too. Disconnecting stops the app’s access to Fellix from its next call; what it already received stays with the company that runs it.

12. How we protect it

We encrypt personal data in transit and at rest, control access by role, and review our security regularly. Access to the content in a customer’s account is limited to the people who need it to operate the service or to answer a support request from that customer.

No system is perfect. If a breach affects personal data and is likely to present a risk, we will notify the competent supervisory authority within 72 hours of becoming aware of it, and tell the people affected without undue delay where the law requires it.

13. Your rights

Where we are the controller, you can ask us to:

• Give you a copy of the personal data we hold about you
• Correct it, if it is wrong or incomplete
• Delete it, where no overriding obligation requires us to keep it
• Restrict how we use it while a dispute about it is open
• Send it to you, or to another provider, in a commonly used machine-readable format
• Stop processing that rests on our legitimate interests, including profiling for marketing
• Withdraw a consent you gave, which stops the processing that rested on it from then on

Email [email protected]; to delete your own user account, write from the email address it uses. We answer within one month, and we will tell you if a request genuinely needs longer. We may ask you to confirm who you are first, so that we do not hand your data to somebody else. Exercising any of these rights costs nothing, and is not a reason for us to treat you differently.

If you are unhappy with how we handled it, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or to the supervisory authority where you live or work.

If your data reached us through an organisation that uses Fellix, your request belongs with that organisation — clause 3 explains why.

14. Children

Fellix is a product for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child’s data has reached us, write to [email protected] and we will delete it.

15. Changes to this policy

When this policy changes, we publish the new version on this page with a new effective date. If a change materially affects how we use personal data, we will tell account holders at least 30 days before it takes effect.