HABIBUTLR

Privacy Policy

Last updated: August 2026 — draft, not yet reviewed by counsel

HABIBUTLR is a booking assistant that talks to a salon’s clients over WhatsApp. Doing so involves processing personal data. This policy sets out what data that is, why it is processed, and what rights data subjects have.

1. Controller

The controller is [COMPANY NAME], [ADDRESS], reachable at support@habibutlr.ae.

For salon client data the salon itself is the controller; HABIBUTLR processes that data as a processor under a data processing agreement.

Data protection officer: [NAME AND CONTACT, IF APPOINTED]

2. What data is processed

  • WhatsApp number, plus the content and timing of the messages exchanged

  • Name or preferred name, where given in conversation

  • Appointment data: treatment, time, assigned staff member, price, status

  • Visit history, revenue, and attributes such as VIP status or marketing consent

  • Technical data from website visits: IP address, time, page requested, browser

3. Purposes and legal bases

Processing conversation and appointment data serves the booking itself and is necessary for the performance of a contract or pre-contractual steps under Art. 6(1)(b) GDPR.

Promotional messages such as win-back reminders or campaigns are sent only with explicit consent under Art. 6(1)(a) GDPR. Consent can be withdrawn at any time, for instance by replying STOP.

Operating and securing the servers rests on our legitimate interest in a stable and secure service under Art. 6(1)(f) GDPR.

4. Use of artificial intelligence

The assistant’s replies are generated by a language model. The message text and the context needed to answer it — existing appointments, treatments, and the conversation so far — are transmitted to the model provider. We use Google Gemini, with Anthropic Claude as a fallback.

To the best of our knowledge the transmitted content is not used to train those models. No automated decision producing legal effects within the meaning of Art. 22 GDPR takes place; bookings can be changed or cancelled by a human at any time.

5. Recipients and processors

  • WhatsApp / Meta Platforms — message transport

  • Google (Gemini) and Anthropic (Claude) — reply generation

  • Supabase — database

  • Railway, Hetzner, and Vercel — application and website hosting

  • Stripe — payment processing for salon subscriptions

6. Transfers to third countries

Some of the services named above process data outside the European Union, in particular in the United States and the United Arab Emirates. Such transfers rest on the European Commission’s Standard Contractual Clauses or on an adequacy decision where one exists.

7. Retention

Conversation histories and appointment data are deleted [RETENTION PERIOD, E.G. 24 MONTHS] after the last contact, unless statutory retention duties apply. Invoice-related data is kept for the periods required by commercial and tax law.

8. Rights of data subjects

  • Access to the data processed (Art. 15 GDPR)

  • Rectification of inaccurate data (Art. 16 GDPR)

  • Erasure (Art. 17 GDPR)

  • Restriction of processing (Art. 18 GDPR)

  • Data portability (Art. 20 GDPR)

  • Objection to processing (Art. 21 GDPR)

  • Withdrawal of consent with effect for the future

  • Complaint to a supervisory authority (Art. 77 GDPR)

9. Privacy contact

Please direct requests to support@habibutlr.ae. We respond within the statutory time limits.

Back to home