readywhen Privacy Review for Freelancers: Safe for Client Work?

Bywarren_admin

Short answer: readywhen reads your email, calendar, chat and meeting transcripts to track every promise you make to clients, sends transcript text to Anthropic’s Claude API, and keeps the briefings it builds for as long as your account exists. Our verdict is USE WITH CAUTION for client work. Policy reviewed October 2026, six days after readywhen relaunched on Product Hunt as a personal assistant that lives inside WhatsApp, with its own phone number. The pitch lands hard for solo consultants: it catches the “I’ll send it Friday” lines you forget. The catch is that the privacy notice was last updated in April, before the WhatsApp version existed. We checked the vendor’s own documents against how we evaluate AI tools, and the gap between what the product does and what the policy covers is the story here.

What readywhen does with your data

Privacy at a glance

Privacy dimensionreadywhen’s answer
Trains on your data?No, per its terms and security page
Training opt-outNot needed; no-training is the default
Data retentionRaw data per session; briefings kept for account life
Third-party sharingAnthropic Claude API, Datadog, hosting, support tools
Storage regionEU hosting claimed; transfers covered by SCCs
Enterprise-team tierCustom deployment and dedicated infrastructure on request
WhatsApp channelNot mentioned in the April 2026 notice

readywhen is run by Oliva Health Ltd in London. Its privacy notice was last updated April 9, 2026 (per readywhen’s privacy notice, retrieved 2026-10-19), and splits data into two roles.

As a controller, readywhen handles your account: name, email, company, role, billing records, support tickets, usage logs and technical metadata. It uses these to run, bill, secure and improve the service.

As a processor, it handles workspace data pulled from tools you connect. The notice names Slack, Gmail, Google Calendar and Google Docs. From those sources it may process names, work addresses, job titles, message content, meeting attendance, timestamps and interaction metadata. Calendar and Docs access is described as read-only; the transcripts are the Meet transcripts attached to your events.

Who else sees it. For Google data, the notice names two outside parties. Transcript text can go to Anthropic’s Claude API, which the notice says holds inputs for up to 30 days for abuse checks and does not train on them. Datadog gets operational metadata such as IDs and content length, not transcript text. The wider controller section adds cloud hosts, AI vendors, analytics and support tools, and points to a Trust Centre for the full processor list. That Trust Centre returned an access error to our automated check, so we could not verify the list.

What it keeps. Raw transcripts are fetched from Google on demand, processed in memory and not saved, per the notice. OAuth tokens are encrypted with AES-256-GCM and deleted when you disconnect. What does persist is the derived output: meeting briefings and what the notice calls contextual analysis. Those stay for the life of your account.

Training. Section 8.4 of the terms of use (retrieved 2026-10-19) says workspace data and message content are not used to train AI models, whether readywhen’s or a third party’s. The same clause still allows aggregated or de-identified data for analytics, research and service improvement.

What this means for solo freelancers

readywhen is built around a simple idea: it reads everything you already see. For a solo worker, “everything” means your client relationships, so here is where the policy as written leaves room for trouble.

Scenario 1: you run it through WhatsApp and send it client voice notes. The Product Hunt listing describes an assistant you call, message and voice-note on WhatsApp, with its own number and its own computer. The April notice does not mention WhatsApp, phone calls, voice recordings or that computer anywhere. Based on the policy as written, you have no documented answer on how long a voice note about a client project is kept, which model transcribes it, or whether Meta’s business messaging layer sits in the chain. That carries a real disclosure risk if a client contract asks you to list every subprocessor.

Scenario 2: it builds a profile of your clients. The coaches and consultants page says the assistant learns how you write, how you run sessions and who your clients are, and that this picture sharpens over time. The notice confirms derived outputs are kept for the account lifetime. If a client asks you to delete everything about them after a project ends, you would need readywhen to purge that profile too, and the notice gives no self-serve way to do it short of emailing the data protection address.

Scenario 3: the processor role lands on you. In processor mode, readywhen tells individuals to exercise their rights through the organisation that set up the account. For a freelancer, that organisation is you. The terms also make you responsible for getting any consents needed from people whose data flows in, including clients on your calls and threads. Based on the policy as written, an EU client asking who processes their meeting content becomes your problem to answer, not the vendor’s.

One more detail: liability under the terms is capped at the greater of twelve months of fees or £100. During the free beta, that means £100.

How to use it safely

If you still want readywhen’s follow-up tracking, narrow what it can reach. These steps follow the controls the vendor documents.

  • Connect one source at a time. Start with Google Calendar only. Add Gmail later, and only if you can live with every client thread being read.
  • Use a separate Google account for client work you cannot expose. readywhen inherits your permissions, so anything that account cannot open, the assistant cannot open either.
  • Keep the WhatsApp channel for personal errands. Until the notice covers it, do not voice-note client names, fees or project details to the assistant’s number.
  • Skip Google Meet transcripts on sensitive calls. Leave transcription off in the Meet toolbar (or turn off auto-transcribe in the event’s Meet settings). No transcript in your Docs means nothing for readywhen to send to Claude.
  • Request the DPA before onboarding EU clients. The connectors page says one is available on request. Email the data protection address listed in the notice and ask for the full subprocessor list at the same time.
  • Audit your Google connections monthly. Go to myaccount.google.com, open Security, then Your connections to third-party apps, and confirm the scopes readywhen holds.
  • Disconnect before you leave. Revoking access in readywhen deletes the OAuth tokens. Then email a deletion request for the stored briefings, because those survive a disconnect.

For a wider routine across tools, see our guide to opting out of AI training for freelance work.

Privacy-friendlier alternatives

These cover the same job, catching commitments across email and calls, with less data in one vendor’s hands.

Proton Mail with Proton Calendar. What it gives you that readywhen does not: an end-to-end encrypted inbox and calendar, plus the Scribe writing assistant, which Proton says can run locally on your device. You lose automatic follow-up tracking but keep client mail out of any outside model. Pricing band: free tier; Mail Plus from about $3.99 a month, bundles up to about $12.99. Best for consultants whose commitments mostly live in email. Link: proton.me/mail.

Lumo by Proton. What it gives you that readywhen does not: Proton says Lumo keeps no chat logs and does not train on conversations, and it only sees the paragraph you paste, not your whole workspace. Paste a call summary, ask it for the action items, done. Pricing band: free; Lumo Plus about $9.99 to $12.99 a month. Best for freelancers who want AI help on demand rather than an always-on reader. Our Lumo privacy review covers the details. Link: lumo.proton.me.

Self-hosted Inbox Zero with a local model. What it gives you that readywhen does not: open-source code you run on your own server, paired with a local Ollama model, so emails never leave hardware you control. Pricing band: free software plus a small VPS, around $5 to $10 a month. Best for technical freelancers comfortable with an afternoon of setup. See our Inbox Zero privacy review for the trade-offs.

How to pick:

  • Forgotten email promises: Proton Mail plus a simple task list closes most of the gap with no AI reader at all.
  • Call summaries: write a two-line recap yourself and hand only that to Lumo.
  • readywhen’s automation without its cloud: self-hosted Inbox Zero is the closest match, though it covers email only.

Comparing meeting assistants instead? Our Granola privacy review applies the same scoring, and readywhen can read Granola notes too.

The verdict

ATP Privacy-Vetted: USE WITH CAUTION

Use with caution: readywhen commits in writing to no model training, runs its Google data through a single named AI vendor with 30-day retention, and does not store raw transcripts, but its privacy notice predates the WhatsApp assistant it now markets, its full subprocessor list sits behind a Trust Centre, and client briefings persist until you delete your account. Fine for calendar and internal follow-ups today. Keep client voice notes and sensitive threads out of it until the notice catches up.

Frequently asked questions

Does readywhen train AI models on my emails and calls?

Not according to its terms. Section 8.4 says workspace data, message content and personal data are not used to train AI models, either readywhen’s own or a third party’s. The Claude API it uses for transcripts also does not train on those inputs, per the privacy notice. One caveat: the terms still allow aggregated or de-identified data for research and service improvement, so the no-training promise does not mean nothing is reused.

Is readywhen GDPR-friendly for EU clients?

Based on the policy as written, readywhen acts as your processor for workspace data, names a DPO, lists the Spanish AEPD as its EU supervisory authority, relies on Standard Contractual Clauses for transfers and offers a DPA on request. Those are solid basics. The gaps are an April 2026 notice that does not cover WhatsApp or calls, and a full processor list we could not access. Ask for both before onboarding EU client data. This is not legal advice.

Can I use readywhen for HIPAA or health data?

The documents we reviewed make no mention of HIPAA or a business associate agreement, even though the vendor is named Oliva Health. Based on that, routing protected health information through readywhen carries a clear risk. Coaches, therapists or wellness consultants who discuss health topics with clients should keep those calls untranscribed and those inboxes disconnected, and use a tool that signs a BAA for anything clinical.

Is readywhen.ai the same company as readywhen.com?

No. readywhen.ai is the AI assistant run by Oliva Health Ltd in London, which this review covers. ReadyWhen Tech Inc., an unrelated estate-planning vault, uses the readywhen.com domain and publishes its own privacy policy, which shows up in search results for this tool. Check you are reading the policy at readywhen.ai/privacy before signing up, and make sure the OAuth consent screen names the right app when you connect Google.

How do I delete my data from readywhen?

Start by disconnecting each integration inside readywhen, which the notice says deletes the OAuth tokens and stops new data from flowing in. Then email the data protection address in the privacy notice and ask for deletion of your account, briefings and any contextual analysis. The terms say you can ask for a copy of your data within 30 days of termination, so export anything you need first.

Sources

Reviewed by Jérémy, founder of AidTaskPro and GreenBudgetHub. Based in central France. Privacy posture sourced from public policies and vendor documentation as of 2026-10-19.

Get Your Free Cybersecurity Checklist

Protect your digital life in 5 minutes. Free checklist + weekly productivity & security tips.

Similar Posts