TownSaysUpdated September 9, 2026
Privacy notice
TownSays is a rental-availability service operated by Andrew. Your account stores information you supply. Shared business information is published only when you approve what to share and who can see it.
Your TownSays account
Sign in with Google or ChatGPT. We receive your provider account identifier, email address and, when available, name to identify your account and protect access to your businesses. We do not receive your password or access to your ChatGPT conversations. Google sign-in does not grant access to Sheets, Calendar or Gmail.
We use a secure session cookie to keep you signed in for up to seven days, and a cookie to remember that a browser must explicitly sign in again after sign-out. Short-lived cookies protect the sign-in process. We retain minimal account-entry success and failure records for up to 90 days, with cleanup during subsequent sign-ins. Connecting another sign-in method requires proof of access to both accounts.
Applications and support
We collect the business website, contact name and email, rental category, current booking method and any optional message you submit. We use this information to respond to your request and help set up your business. Submitting does not authorize public inventory publication or put you on a general marketing list.
What may become public
With your permission: your business name and pickup area, equipment details, requested dates, availability, when the information was last checked, and your booking link. Customer names, contact details, private bookings, prices negotiated with individuals, internal notes and private connection keys are not included in public answers.
Where information is processed
The site uses OpenAI Sites hosting and Cloudflare database infrastructure. Their infrastructure may process information outside your country. If you connect an external assistant, that assistant’s provider processes your question and the public results under its own terms. TownSays does not need access to your unrelated conversations.
Connected updates
Connected tools send equipment updates. If you allow it, clear updates can apply automatically. Unclear or conflicting messages need clarification or review. We keep where the update came from, when it happened, how it was understood, what was decided and what changed. We store scrambled versions (hashes) of private connection keys. Disconnecting a tool stops its access. Do not put customer details in equipment fields or review notes.
WhatsApp and email updates are processed through those services. When AI is used to understand a message or turn a voice note into text, the relevant message or audio is sent to OpenAI. Private message text kept to resolve an update is due for deletion after 30 days. The app removes expired text when processing updates or doing maintenance, so deletion may happen later if the service is inactive. A minimal history of changes remains. Original audio is handled separately by the messaging provider and transcription service. Email and WhatsApp updates require assisted setup.
Retention and control
Booqable and Rentman
When you connect rental software, TownSays encrypts your API key and keeps it on the server. We read catalogue and pickup-location records, and ask Booqable for quantities available during requested rental periods. Rentman currently supplies catalogue entries only; date availability needs your confirmation. These integrations use read requests and do not create or change bookings.
We keep product identifiers, equipment names, selected pickup-location names, connection status and a minimal history of connection changes. API responses may contain additional fields, which are discarded rather than stored or sent to assistants. Customer lists, orders and private booking notes are not requested by these integrations. Only selected equipment becomes public after you choose to share it.
Pausing stops date checks. Disconnecting deletes the API key from TownSays and stops sharing through that connection. Deleting the TownSays copy removes its imported catalogue without changing your original rental software. To revoke a key at its source, use your provider’s account settings; this may affect other integrations using that key. Restricted hosting backups follow the retention limitations described below.
Google Sheets and Calendar
Google connections read your selected rental records to calculate availability. Sheets uses Google’s selected-file permission, which also permits edits; TownSays uses only read methods. Calendar permissions cover the calendar list and event reads; TownSays imports events only from calendars you explicitly select. We request no Gmail access.
We read mapped Sheet fields and the minimum Calendar fields needed for equipment, dates, status and recurrence. A shared calendar’s title is parsed for equipment tags and discarded. Attendees, descriptions and attachments are not requested. Raw reads stay in memory. Stored records contain equipment codes, unavailable dates and reasons, booking references, column and calendar settings, and the times records were checked.
Google refresh credentials are encrypted at rest and kept on the server. A short-lived Sheets token is supplied to Google’s file picker during selection. Routine synchronization performs no AI inference. Only the equipment availability you approve is shared with customers or their connected assistants. We do not sell Google-derived data, use it for unrelated products or use it to train models. TownSays’ use and transfer of Google API information follows the Google API Services User Data Policy, including its Limited Use requirements.
Temporary imported records are scheduled for removal within 24 hours; current active records remain while connected, and minimized historical changes expire after 30 days. Disconnecting stops sharing those booking records immediately. Account disconnect removes local credentials and attempts to revoke Google access; revocation may affect several connections to the same Google account. Disconnecting one sheet or calendar retains access only for your other selected records. Downloaded booking records exclude credentials. Delete removes the imported records without modifying Google. Minimal change history expires after 30 days.
The retention periods above are targets. We cannot yet guarantee automatic deletion on those dates or give an exact date for removal from hosting backups. Deleted data may remain in restricted provider backups until their retention expires. Support normally uses redacted status information; access to Google-derived content requires your affirmative consent for the particular support task, except a documented security or legal exception permitted by Google’s policy.
Our policy is to review and remove unsuccessful applications within 90 days and retain account information only while needed to provide the service and its documented follow-up. Our team carries out this policy. You can request access, correction, withdrawal from the service or deletion through the support form. We may retain minimal records needed to honor an opt-out or meet legal obligations.
Basic safeguards
Only authorised people and tools can update a business. Customers can check availability but cannot change it. To reduce form abuse, we limit requests and briefly keep scrambled (hashed) network identifiers. We do not install advertising trackers. Please do not submit customer records or passwords.