Kronologic

A genuine middle case, which is uncommon on this axis. Strip the models and something saleable does remain: the free tier is a booking page with calendar connection and two meeting types, and the second tier adds unlimited meeting types, reminders, payment at booking and branding. Those are real products people pay for. But they are not what this company is.

The tier that carries the positioning, the pricing and the entire argument is the one whose named feature is autonomous negotiation, and the proposition throughout is that a machine engages a contact, interprets a written reply and settles a time without a person in the thread. Remove the model and what survives is a scheduling link competing with free alternatives, which the vendor itself frames as the on ramp rather than the destination. Not the top band because a complete product survives; not the middle band because what survives is not what they sell.

This is the most explicitly unattended product graded in this index, and the absence of human involvement is not a gap in the disclosure, it is the sales argument. The marketing states that there is no form to click and no representative babysitting the thread, that meetings are booked with no human follow up, that sellers simply take the meetings that land, that nobody has to learn the tool, and that at one named customer no seller has ever been trained on it.

The feature name on the paid tier is autonomous negotiation. Real constraints do exist and are worth crediting: a person selects the target segment, the seller's actual calendar availability and stated preferences bound every outcome, an administrator configures the campaign, and the top tier adds custom permission sets. The outcome is also narrow, since the machine is arranging a time rather than making commitments or quoting terms.

What is absent is any oversight architecture at all: no approval step, no review queue, no confidence threshold, no withholding behaviour, no escalation path when a reply is ambiguous or hostile, and no audit trail of what was written on a seller's behalf.

The mechanism is described in functional terms and nothing behind it is published. The system is said to engage each person, read their replies, negotiate a time in plain language and place the meeting, which is a clear description of behaviour and tells a buyer nothing about how it is produced. No provider, model family, version, inference location or evaluation method appears anywhere on the surface read.

The accuracy question is sharper here than the description suggests, because the model is interpreting free text written by a real customer and acting on that interpretation immediately by moving an appointment on a seller's calendar. A misread reply produces a wrong meeting with a live account rather than a discarded draft.

No accuracy rate, confidence measure or fallback behaviour for ambiguous replies is published, and the privacy policy's own enumeration of rights includes the right not to be subject to solely automated decisions without ever addressing how that interacts with the product.

The named reference base is unusually heavyweight for a company this size. Twelve enterprise logos are displayed including several of the largest technology manufacturers, resellers, security and information vendors in the market, and they are repeated on every page rather than confined to a case study section.

More useful than the logos is a specific operational claim attached to a named customer: that at one large reseller a single administrator books more than a thousand meetings a month across hundreds of salespeople, with no seller ever trained on the product. That is a falsifiable statement about how the thing actually gets used, which is rarer and more informative than a percentage. Aggregate figures are published for meeting minutes automated, total meetings booked and years operating.

A customers page and an independent review platform presence exist. Off the top band because none of the figures carries a measurement basis, period or method, no case study with a stated baseline was located, and no named individual testimonial appears on the current site. Recorded as observed rather than relied on: an availability prediction accuracy figure quoted to one decimal place appears on the vendor's other channels but not on the pages read here.

One channel is documented better than anything else in this index and the other is not documented at all. On text messaging the vendor publishes the verbatim wording of the consent checkbox a guest must tick, names the host inside that wording and identifies itself as the intermediary, states that a booking cannot be submitted with a phone number unless the box is affirmatively ticked, and records the date, time and exact wording of every consent for audit.

Purpose limitation is stated positively and negatively, including an express commitment that numbers are never used for marketing, upselling or cross selling and are never used to message a guest about a meeting they did not themselves schedule.

Three full keyword sets are published for opting out, resubscribing and requesting help, and a stop instruction suppresses delivery to that number across every host and every booking rather than only for the sender who triggered it, which is a cross tenant suppression list and is materially stronger than the norm. The carrier sub processor is named. That is an express written consent architecture built into the product rather than promised in prose.

Held off the top band because it governs appointment reminders, while the outreach the product actually exists to perform is email sent to contacts the customer uploads, and for that channel there is no acceptable use policy, no sending policy, no statute named, no stated lawful basis and no unsubscribe commitment anywhere.

Solid and current, dated April 2026, with the operating entity and a postal address published. European rights are enumerated in full including the right not to be subject to solely automated decision making, and the legal basis section correctly distinguishes the vendor's position as processor from its position as controller and states the resting basis for each.

The Californian section is unusually operational, publishing the acknowledgement window, the response window, the outer extension, the verification requirement, the authorised agent route through the state register and the cap on requests per year, alongside an express statement that information is not sold. Connected mailbox and calendar limitations are enumerated rather than incorporated by reference, including an express prohibition on advertising use.

Three things hold it off the top band. Transfers rest on consent inferred from continued use of the site, which is the weakest of the available bases. Site collected personal data is retained indefinitely by the policy's own words until a purge is requested.

And the security section points the reader to a trust and security page for the substance, which does not appear in the site navigation or footer and could not be located, so the one section that should carry the detail defers to a document a buyer cannot reach.

Structurally cleaner than most because there is no data product to explain. The vendor sells no contact database and acquires no third party person records; the contacts worked are supplied by the customer, either uploaded or pulled as a live segment from the customer's own system of record, so provenance sits with the buyer where it belongs.

Telephone numbers, the one category the vendor collects directly from individuals, are gathered with published affirmative consent at the point of booking, which is the best collection disclosure in this index. What keeps this at the middle band is the position of the people on the receiving end of the core product.

The contacts the machine emails and negotiates with are third parties who have a relationship with the customer rather than with the vendor, and nothing published addresses how they are told their correspondence is being processed, what basis supports it, or how they would ask for it to stop. The Californian disclosure also lists inferences among the categories held, without saying what is inferred or from what.

A low exposure profile with one live question. Access to mailboxes and calendars runs through the official authorisation interfaces of both major providers rather than stored credentials, and the vendor states plainly that it will not ask for passwords.

The permitted uses of that access are enumerated in the privacy policy in the form those providers require, covering reading, writing and modifying message and invitation bodies, metadata, headers and settings, with onward transfer restricted and advertising use prohibited. Messaging runs through a named regulated carrier intermediary. Systems of record are reached through their own integrations.

There is no scraping, no social platform automation, no browser extension acting on a third party site, no credential rotation and no multi account mechanism, so none of the patterns that produce the bottom band in this index are present.

Off the top band because the product sends volume email from the customer's own connected mailbox across a whole segment at once, which is the exposure that matters most for this architecture, and no conformance position with either mailbox provider is stated.

The connected account limitations are enumerated rather than incorporated by reference, which is the right form, and they include an express prohibition on using mailbox and calendar data for advertising and a general prohibition on employees reading it. Two things keep this at the middle band rather than higher.

The human reading prohibition carries an exception drafted more broadly than the standard template it otherwise follows, permitting access for the platform's internal operations in support of the customer's business processes, which is wide enough to cover a great deal and is not further bounded.

And the training question is never reached at all: this product reads the content of replies written by the customer's own customers in order to act on them, which is among the most content intrusive operations graded here, and nothing published states whether that material trains, tunes or evaluates models, whether processing is tenant isolated, or which providers touch it. The policy separately reserves the right to retain deidentified and anonymised data and metadata to support enhancements to the platform, with no boundary described.

The core interaction is a machine conducting written correspondence that a real person will read as correspondence from the seller whose calendar it manages. It engages, interprets the reply, negotiates in plain language and confirms, and nothing published states that the person on the other side is told any of this is automated. No position is taken on the European marking obligation. Three factors genuinely mitigate and are the reason this is not lower.

The repositioning matters: the targets are now existing customers up for renewal, accounts being cross sold, dormant customers, people who filled in a form or attended a webinar, and new customers awaiting onboarding, so these are warm or existing relationships rather than strangers. The ask is narrow and reversible, being a time on a calendar the recipient can decline or move.

And on the messaging channel the vendor does the opposite of concealing itself, naming both the host and the platform inside the consent wording the guest must tick. That makes the silence on the email side a choice rather than an oversight.

Thin for a product deployed at the scale its own reference list implies. Four connections are evidenced across the whole surface: a calendar provider on the free tier, one system of record on the second tier, two on the third, and a carrier intermediary for messaging. Synchronisation is described usefully, with live segments pulled from the system of record and every outcome written back, which is the right shape and is the integration that matters most here.

Beyond that there is nothing: no published interface or developer documentation, no webhook surface, no event model, no connector catalogue, no marketplace listing and no agent protocol server. A buyer wanting to trigger a campaign from an event elsewhere in their stack, or to pull booking outcomes into a warehouse, has no documented path. The absence is more conspicuous given the enterprise deployments claimed, where a rollout across many teams would normally require exactly that.

Two statements in the same document point in different directions and neither resolves into a residency position. One section states that the service is hosted in the United States, governed by United States law, and that servers and the central database sit there, warning users elsewhere that their information will be transferred and that local protections may be weaker.

A later section states that data is processed both inside and outside the United States, relying on legally provided mechanisms to move it across borders, without naming a single one of those mechanisms or any of the other countries involved. A buyer cannot reconcile the two from the page. No region choice, hosting provider, data centre or availability zone is named, and the only sub processor identified anywhere is the messaging carrier. The transfer basis offered for site visitors is consent inferred from continued use, which is the weakest basis available and does not address the customer data at all.

The one section that should carry the detail points somewhere that does not exist. The privacy policy states that technical, administrative and physical measures are in place as described on the vendor's trust and security page, and no such page appears in the navigation, the footer or the site structure, and none could be located. That leaves the security disclosure as three adjectives and a statement that data is held on secure servers.

No certification is named anywhere on the surface read, no attestation type, no audit period, no auditor, no penetration test, no vulnerability disclosure route and no enumerated control set. The whole published legal estate is two documents.

Two things keep this at the middle band rather than lower: authorisation runs through official provider interfaces with an express statement that passwords are never requested, and the enumerated limits on mailbox access function as access controls in substance even though they appear under a privacy heading. The gap matters more than usual because this product holds simultaneous read and write access to the mailbox and the calendar of sellers at some of the largest technology companies in the market.

Clear, self serve and honest about fit. Four tiers are published, three of them with real figures at zero, fifteen and forty nine dollars per seat per month, a billing toggle is offered with the annual discount quantified as two months free rather than a vague percentage, and the trial is specified as the full top team plan for fourteen days. Every priced tier can be started without contacting anyone, which is rare in this category and rarer still for a product sold into large enterprises.

Contents are enumerated per tier, and each tier additionally carries a plain statement of who it is right for, which does more work than a feature list. Held off the top band on the variable that matters most for this particular product. It is priced per seat while its value is volume, and the only mention of volume anywhere is that the custom tier includes unlimited volume, which necessarily implies a cap on the tiers below it that is never published.

A buyer at forty nine dollars a seat cannot tell how many contacts the machine will work before something stops, and the answer to what counts as a seat sits behind a question that did not resolve on retrieval.

A defined post termination outcome, which is more than most here manage. The policy states that upon termination of the subscription the vendor deletes the customer's data within ninety days, which gives a departing buyer a fixed outer limit rather than an open ended discretion.

Data subject rights include portability expressed as a copy in electronic format together with the right to transmit it elsewhere, requests carry a stated thirty day response commitment, and outcomes are written back to the customer's own system of record throughout the relationship, so the booking history accumulates somewhere the buyer already controls. Off the top band on three points.

No customer facing export path is described anywhere in the product material, only an individual rights process, and those are different things for a departing company. No deletion confirmation or artefact is offered. And the retention position is inconsistent across the document, since data collected through the site is stated to be held indefinitely until a purge is requested, while deidentified data and metadata may be retained after deletion with no boundary given.

The email side publishes nothing and the messaging side publishes a great deal. On messaging there is a complete opt out infrastructure with three keyword sets, immediate global suppression across every host and booking, a named carrier intermediary, a published frequency expectation of one to two messages per meeting, and a rates disclosure. That is proper sending hygiene for the channel.

On email, which carries the actual product, there is no warmup, no sender authentication guidance, no volume pacing, no sending window, no bounce or complaint handling, no blocklist monitoring and no placement testing described anywhere, despite the product sending across an entire segment at once from the seller's own mailbox. Two structural factors keep this at the middle band rather than lower. Volume is inherently bounded by how many meetings a team can actually hold. And sending happens from the customer's existing mailbox rather than provisioned infrastructure, so the buyer inherits their own established reputation rather than a pooled or disposable one.

Among the more falsifiable segment statements in this index, because each tier carries an explicit statement of who it suits rather than leaving the buyer to infer. The free tier is scoped to a solo user wanting a clean link. The second names the roles it is for, being founders, account executives, recruiters, consultants and customer success managers, and adds two qualifying conditions, that the buyer charges for meetings and runs on a named system of record.

The third is the sharpest: a revenue team of five to thirty people spanning sales, customer success and account management, sitting on accounts that are due, running on one of two named systems of record. That is a headcount band, a function set, a situation and a stack precondition in a single sentence.

Held off the top band because the custom tier then absorbs everything above with unlimited volume and no upper boundary is ever stated, and because the reference logos are drawn from very large enterprises which sits awkwardly against a five to thirty band as the described core.