Privacy Policy
Draft pending legal review. This text has not yet been reviewed by a lawyer. Fields highlighted in yellow must be completed before publication. Set legal_reviewed to true in config.json when ready to remove this notice.
- Who we are
- Controller and processor
- What data we process
- Who else receives the data
- Transfers outside the EEA
- How long we keep data
- Your rights
- Security
- Cookies and external resources
- WhatsApp and Meta
- Changes
1. Who we are
StudioBooking is a service operated by Web Digital Venture SRL, tax ID (CUI) 46880060, registered with the Trade Registry under no. J40/18742/2022, with its registered office at Str. Baba Novac nr. 18, bl. 24B, sc. A, et. 1, ap. 6, Sector 3, București ("we"). For any question about personal data, write to contact@web-digital.ro.
StudioBooking offers salons (beauty salon, barbershop, nail studio, etc.) two solutions: an AI assistant that answers customers on WhatsApp and takes appointment requests, and a complete solution that adds a web application (online booking page, calendar, customers and an admin panel) in which the assistant creates appointments.
2. Controller and processor
We act in two different roles, depending on the data:
- Controller for the data of people who contact us or request a pilot through this website. We determine the purposes and means of that processing.
- Processor for the data of a salon's customers. The salon is the controller: it decides why and how the data is processed, and we process it only on its behalf and on its instructions, under a data processing agreement concluded with the salon (Article 28 of Regulation (EU) 2016/679, "GDPR").
If you are a customer of a salon and want to exercise your rights, you can write to the salon or to us. See also the Data deletion page.
3. What data we process
| Who | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| People who contact us or request a pilot | Name, email, salon name, content of the message | Replying to the request and organising the pilot | Art. 6(1)(b) (steps at the request of the person before a contract) and Art. 6(1)(f) (legitimate interest in replying) | 6 months from the last contact, then we delete the data |
| A salon's customers (in the service) | Name, phone number and WhatsApp profile, content of messages, appointment details (service, date, time, specialist), email if the customer provides it | Answering messages and creating and managing appointments on behalf of the salon | Determined by the salon as controller (usually performance of a contract with the customer or the salon's legitimate interest) | Set by the salon in the data processing agreement. When the service ends, data is deleted or returned, at the salon's choice |
| Visitors of our infrastructure | IP address, date and time, browser type, in security logs | Security and troubleshooting | Art. 6(1)(f) (legitimate interest) | Short term, according to the hosting provider's settings |
The service is not intended to collect health data or other special categories of data (Article 9 GDPR). If a customer writes such information in a conversation, it is processed only as far as needed to answer and can be deleted on request.
We do not sell personal data and we do not use it for our own or third-party marketing. The assistant does not send promotional messages and only replies to people who wrote first.
4. Who else receives the data
We use infrastructure providers (sub-processors) to deliver the service. We have, or are putting in place, a data processing contract with each of them.
| Provider | Role |
|---|---|
| Meta Platforms Ireland Ltd. (WhatsApp Business Platform) | Delivering WhatsApp messages between the customer and the salon. Meta also processes data under its own policies (see section 10). |
| Anthropic, PBC | Language model that generates the assistant's replies. It receives the conversation text needed for the reply. |
| Supabase Inc. | Database for conversations and appointments. |
| Vercel Inc. | Application hosting. |
[to confirm: final list of sub-processors and storage regions, before publication]
We may disclose data to authorities only when the law requires us to.
5. Transfers outside the EEA
Some providers are established or process data in the United States. Transfers rely on the mechanisms provided by the GDPR, as applicable: an adequacy decision (the EU–US Data Privacy Framework) or standard contractual clauses.
6. How long we keep data
We keep data only as long as necessary for the purpose it was collected for, as shown in the table in section 3. After that we delete or anonymise it, unless the law requires us to keep it.
7. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent where processing is based on it (Articles 15–22 GDPR). You can exercise them by writing to contact@web-digital.ro. We reply without undue delay and, as a rule, within one month.
For data in the service, where the salon is the controller, we may forward your request to the salon or fulfil it on the salon's instruction.
You have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro.
8. Security
We apply appropriate technical and organisational measures: encrypted connections (HTTPS), restricted access to data, and separate storage of passwords and access keys.
9. Cookies and external resources
This website does not use marketing or analytics cookies and does not load resources from third parties: fonts are served from our own server. If we add such tools, we will update this policy and ask for consent where the law requires it.
10. WhatsApp and Meta
WhatsApp messages pass through Meta's WhatsApp Business platform. For the data that Meta processes for its own purposes, Meta acts as an independent controller under its own policies. StudioBooking is not affiliated with, sponsored by or endorsed by Meta Platforms, Inc. WhatsApp is a trademark of Meta Platforms, Inc.
11. Changes
We may update this policy. The current version is the one on this page, with the date of the last update at the top. We notify salons with which we have a data processing agreement of important changes.