Privacy Policy

1. Introduction

This Privacy Policy ("Policy") describes how AI Beauty Bot, Inc., a Delaware C-Corporation ("Company", "we", "us", or "our"), collects, uses, stores, and protects personal data of users of the AI Beauty Bot service ("Service").

By using the Service, you acknowledge that you have read and understood this Policy and consent to the collection and processing of your personal data as described herein.

2. Data We Collect

In the course of providing the Service, we may collect the following categories of data:

• Salon owner data: name, phone number, email address, and salon name — provided during registration.
• Salon client data: name and phone number — received from incoming messages via WhatsApp, Telegram, and Instagram.
• Message content: text of conversations between clients and the AI receptionist, necessary for processing appointment requests, answering questions about services and pricing.
• Google account data: the email address of the Google account a salon owner chooses to connect.
• Google Calendar data: calendar identifiers, names, access permissions, time zones, and event data from calendars the salon owner explicitly selects for synchronization. For ordinary Google events, we retain only the timing and technical identifiers needed to represent staff busy time; titles and descriptions are not stored in Beauty OS.
• Technical data: IP address, browser type, and cookie data — collected when visiting ai-beauty.bot.

3. How We Use Your Data

We process personal data for the following purposes:

• Processing incoming client messages using AI to book appointments, answer questions, and send reminders.
• Synchronizing appointment data with the Altegio CRM system (creating bookings, checking staff availability, updating schedules).
• Synchronizing appointments, group events, manual time blocks, and staff busy time between Beauty OS and Google Calendar when a salon owner enables that integration.
• Improving the quality of the Service based on anonymized usage statistics.
• Communicating with salon owners regarding onboarding, billing, and support.

4. Third-Party Services

The Service integrates with the following third-party platforms to deliver its functionality:

• Altegio— for appointment scheduling and salon management. Client name, phone number, selected service, staff member, date, and time are shared with Altegio to create and manage bookings. Data processing by Altegio is governed by Altegio's own privacy policy.
• WhatsApp, Telegram, Instagram — as messaging channels through which clients communicate with the AI receptionist. Messages are received and processed via official APIs.
• Google Calendar — as an optional calendar synchronization provider for native Beauty OS salons. The salon owner chooses which calendars are connected and may disconnect them at any time.

We only share the minimum data necessary to provide the Service. We do not sell personal data to any third party.

5. Google Calendar Data

Google Calendar access is optional and begins only after a salon owner affirmatively connects a Google account through Google's OAuth consent screen. AI Beauty Bot requests the following permissions for this user-facing feature:

• Account identity and email — to display which Google account is connected.
• Calendar list read access — to show the calendars available to the owner, verify write permission, and let the owner select a default salon calendar or map a calendar to a team member.
• Calendar event access — to read event times in selected calendars, create and maintain Beauty OS-managed appointment events, detect changes, and synchronize valid changes in both directions.

Although the Google permission applies to calendars available to the connected account, AI Beauty Bot processes events only in calendars the salon owner explicitly selects or maps in Beauty OS. Ordinary Google events are used only to calculate team availability. They do not create salon clients, services, or appointments in Beauty OS, and their titles and descriptions are not retained.

Appointment events created by Beauty OS may contain the client's display name, selected service, assigned team member, date, and time. Client phone numbers and internal salon notes are not sent to Google Calendar.

Google OAuth access and refresh tokens are encrypted with AES-256-GCM before storage. We also store calendar selections, synchronization tokens, webhook channel identifiers, event identifiers, and synchronization timestamps needed to keep the integration reliable and prevent duplicate events.

When the owner disconnects Google Calendar, AI Beauty Bot revokes the stored Google credentials, deletes them from the Service, stops synchronization channels, and removes busy-time blocks imported from ordinary Google events. Events previously created in Google Calendar remain in the selected Google calendar unless the owner deletes them there. The owner may also revoke access from the Google Account permissions page.

Google user data is not sold, used for advertising, shared with data brokers, or used to train general-purpose or personalized AI models. AI Beauty Bot's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. Data Security

We implement appropriate technical and organizational measures to protect personal data, including:

• Encryption of data in transit (TLS/SSL) and at rest.
• Storage on access-controlled servers with regular backups.
• Logical data separation — each salon can only access its own data.
• Continuous security monitoring and incident response procedures.

7. Data Retention

Personal data is retained for the duration of the service agreement with the salon and for 12 months after its termination, unless a longer retention period is required by applicable law. After the retention period expires, data is deleted or anonymized.

Google OAuth tokens and Google-derived synchronization data follow the shorter integration-specific lifecycle described above and are deleted when the owner disconnects Google Calendar, except for security and audit records that do not contain Google event content.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right of access — request information about what personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure — request deletion of your personal data, subject to any legal retention obligations.
• Right to restriction — request that we limit the processing of your data in certain circumstances.
• Right to data portability — receive your data in a structured, commonly used format.
• Right to withdraw consent — withdraw your consent at any time; however, this may limit your ability to use the Service.

To exercise any of these rights, please contact us at hello@ai-beauty.bot. We will respond to your request within 30 days.

9. Disclosure to Third Parties

We do not sell personal data. We disclose data only to the integrations selected by the salon, to infrastructure and service providers acting on our instructions, or as required by applicable law in response to valid legal process. Google user data is not transferred for advertising, profiling, or any purpose unrelated to the Google Calendar synchronization feature described in this Policy.

10. Cookies

The ai-beauty.bot website uses cookies to ensure proper functionality, analyze site traffic, and improve the user experience. You can disable cookies in your browser settings; however, this may affect certain features of the website.

11. International Data Transfers

Your data may be processed in countries other than your country of residence. In such cases, we ensure that appropriate safeguards are in place to protect your data in accordance with applicable data protection laws, including the EU General Data Protection Regulation (GDPR) where applicable.

12. Changes to This Policy

We may update this Policy from time to time. The current version is always available at ai-beauty.bot/privacy. We encourage you to review this page periodically for any changes.

13. Contact Information

For any questions or concerns regarding this Privacy Policy or the processing of your personal data, please contact us: