Your data, in plain English

Last updated: 2026-05-15

Set and Forget builds Callie, the AI Booking Recovery Agent for solo-owner businesses on Square. Connecting Square requires permissions we keep as narrow as possible. Here’s exactly what we access, what we don’t, and why.

What we ASK Square for

Permission	What it lets us do	Why we need it
APPOINTMENTS_READ	See your calendar’s open and booked time slots	So Callie can tell callers “yes, we have 2 PM Tuesday open”
APPOINTMENTS_WRITE	Create new appointments on your calendar	So Callie can actually book the slot, not just describe it
ITEMS_READ	See your service catalog (names, durations, prices)	So Callie names services and durations correctly
CUSTOMERS_READ	Look up an existing customer by phone	So a returning client doesn’t become a duplicate “Jane Doe #4”
CUSTOMERS_WRITE	Create a new customer record for first-time callers	Square requires every booking attached to a customer record
MERCHANT_PROFILE_READ	See your business’s location and basic profile	So we book to the right shop if you have multiple

What we DO NOT ask for — and therefore cannot see

Credit card numbers. Square keeps card data behind a separate permission (PAYMENTS_READ / CARDS_READ). We never request these. We cannot see card numbers, expiry dates, CVVs, or even the tokenized card-on-file IDs.
Past payment history. Same separate permission. We don’t see what anyone paid you, when, or how.
Bank account or payout information. Held under your Square business profile, not exposed to apps.
Employee payroll, tax records, or staff schedules outside of appointment availability. Out of scope.

What we DO and DO NOT do with the permissions we have

We create new customer records when a first-time caller books by phone.
We read customer records to find a returning caller by their phone number.
We never delete customer records. Square’s permission model bundles “create” and “delete” into a single CUSTOMERS_WRITE scope (a Square design choice, not ours), but our software contains zero delete calls. Source code available on request.
We never modify customer records beyond creating new ones — no editing names, addresses, notes, or anything else on existing records.
We never share your customer data with anyone. It stays inside the call and the booking; nothing is sold, syndicated, or used to train AI models.

How long we keep call data

Call transcripts and basic metadata (who called, when, did they book) are retained for 90 days for quality and dispute resolution, then deleted. You can request earlier deletion at any time by emailing admin@setandforget.ai.

Want to verify any of this?

Our backend code is open to inspection by paying customers. Email us and we’ll walk you through the exact lines that touch your Square data.