At peluguau, we respect your privacy and protect the personal data you entrust to us. This policy explains what data we collect, why we collect it, how long we keep it and what rights you have under Regulation (EU) 2016/679 (GDPR) and Spain's Organic Law 3/2018 on Data Protection and the Guarantee of Digital Rights (LOPDGDD).
1. Data controller
The controller of browsing, account, subscription and billing data is peluguau. LEGAL TODO: the controller's exact legal name, tax ID and full registered address are still missing. These details must be confirmed and published before commercial operations begin. For any question about your data, contact us at privacidad@peluguau.com.
For each salon's client data, including WhatsApp conversations, the salon is the data controller and peluguau acts as a data processor, following its documented instructions and the data-processing agreement under GDPR Article 28. The salon must inform its clients about the processing and determine the applicable legal basis.
2. Data we process
We collect and process the following types of data:
- Account data: name, email, hashed password, phone number, grooming business, address, language and time zone.
- Billing data: legal name, tax ID, billing address and payment method (processed by Stripe; we do not store card details).
- Business data: employees, services, appointments, clients and pets that you enter into the platform.
- Technical data: IP address, browser, operating system, pages visited and activity logs for security and performance.
- Communications: messages you send us by email, forms or support channels.
- The salon's WhatsApp data: phone number, client name, message content and data needed to manage appointments (pet, services and times), along with channel opt-in, opt-out and WhatsApp marketing consent preferences.
3. Purposes and legal bases
- Providing the contracted service (performance of a contract — GDPR Article 6(1)(b)).
- Billing and meeting tax obligations (legal obligation — GDPR Article 6(1)(c)).
- Securing the platform and preventing fraud (legitimate interest — GDPR Article 6(1)(f)).
- Handling demo requests and commercial communications about peluguau (consent — GDPR Article 6(1)(a), which can be withdrawn at any time).
- Improving the product through aggregated and anonymous analytics (legitimate interest).
3.1 AI assistant and WhatsApp communications
On the salon's behalf, the artificial intelligence assistant answers questions about its services and helps clients check availability and book, change or cancel appointments. The platform also enables WhatsApp appointment reminders. Depending on the circumstances, processing is based on performance of the contract between the salon and its client or pre-contractual steps requested by the client (GDPR Article 6(1)(b)), or on the salon's legitimate interest in answering enquiries and organising appointments (GDPR Article 6(1)(f)), after balancing that interest against the client's rights and freedoms. peluguau processes these data under the salon's instructions.
To generate responses using Claude models, the content of conversation messages and the data needed to manage the appointment are sent to Anthropic: the client's name, pet, services and times. Under its commercial terms, Anthropic does not use these data to train its models.
The assistant identifies itself as an AI in its first message. A member of the salon's staff can intervene at any time. No decisions are made solely through automated processing that produce legal effects concerning the client or similarly significantly affect them (GDPR Article 22).
Appointment reminders are service communications. To send WhatsApp marketing, the salon must obtain and record its clients' prior, specific consent (GDPR Article 6(1)(a)), which they may withdraw at any time. Booking an appointment or using the assistant does not imply consent to marketing.
4. Retention period
We retain account data while you are a peluguau user. After cancellation, we retain only the data needed to meet tax and legal obligations or address liabilities, for the applicable periods and up to a maximum of 6 years for accounting and commercial records, with restricted access and, where required, blocking of the data.
WhatsApp conversations are retained in the salon's account while it remains a peluguau customer, subject to erasure requests and the salon's instructions as controller. When the service ends, data processed on the salon's behalf are returned or deleted according to its instructions and the data-processing agreement, unless a legal obligation requires retention. You may request erasure through the channels described in section 7, subject to applicable legal retention exceptions.
5. Recipients, processors and subprocessors
We do not sell your data. We use the following providers to operate the platform. When they process data on our behalf, they act as processors; when they participate in processing that peluguau carries out on the salon's behalf, they act as subprocessors, within the scope of the contracted service and under data-processing agreements (DPAs) imposing the applicable data protection obligations:
- Stripe Payments Europe Ltd. — payment processing.
- Cloud hosting provider (Vercel / AWS / similar, located in the EU).
- Transactional email providers (Resend or similar) — reminders and notifications.
- Plausible Analytics (if enabled) — cookie-free web analytics using anonymised data.
- Twilio Inc. (US/EU) — official WhatsApp Business Platform provider for sending and receiving WhatsApp messages.
- Meta Platforms Ireland Ltd. / WhatsApp LLC (Ireland/US) — the WhatsApp Business platform enabling communications with the salon's clients.
- Anthropic PBC (US) — generating AI assistant responses using Claude models and the data described in section 3.1, without using those data to train models under its commercial terms.
- Neon — PostgreSQL database hosting, currently in the US under standard contractual clauses. A move to the European Union is planned; this does not mean that the data are already hosted in the EU.
6. International transfers
Using these providers involves transfers outside the European Economic Area (EEA), particularly to the United States for messaging, AI services and the Neon database. Transfers to US providers participating in the EU-US Data Privacy Framework rely on that framework where a valid certification covers the processing. If the provider does not participate or the processing is not covered, standard contractual clauses (SCCs) approved by the European Commission apply, together with a transfer assessment and any necessary supplementary measures. The Neon database is currently hosted in the US under SCCs, with a move to the EU planned.
You may request information about the applicable safeguards and a copy of them at privacidad@peluguau.com.
7. Your rights
As a data subject, you have the right to access, rectify, erase, restrict or object to processing, and to data portability. To exercise these rights for data for which peluguau is the controller, email privacidad@peluguau.com. We will request additional information to verify your identity only if there are reasonable doubts. You may also withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
If you are a salon's client, address requests about your data and WhatsApp conversations to that salon. peluguau will assist it as processor; if we receive your request, we will forward it to the salon so it can respond.
You can opt out of WhatsApp communications by sending BAJA in your conversation with the salon and opt back in by sending ALTA. Opting into the channel does not replace specific marketing consent. Opting out does not itself delete the conversation history: you may request erasure from the salon as explained above. You can also request that a member of the salon's staff intervene.
If you believe your rights have not been properly addressed, you may lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.
8. Security
We apply technical and organisational measures to protect data, including encryption in transit (TLS), hashed passwords, strict tenant isolation, encrypted daily backups and regular access reviews.
LEGAL/OPERATIONS TODO: verify that these measures match the infrastructure actually deployed.
9. Changes to this policy
If we make material changes to this policy, we will notify you by email or through the platform at least 30 days in advance. The current version will always be available at this URL.