Privacy policy
This policy explains what personal data Citamate handles, why, for how long and who else touches it. It covers citamate.com, the salon panel, salon booking pages and websites built with Citamate, the client area, and the messaging channels a salon connects: Instagram, Facebook Messenger, WhatsApp and Telegram.
1. Who is responsible
BZUB Solutions S.L., Valencia, Spain (CIF and registered address as shown on invoices) runs Citamate. Contact for anything about your data: privacy@citamate.com.
- We are the controller for citamate.com and for the accounts of salon owners and their staff.
- The salon is the controller for its clients and for the conversations its clients have with it. Citamate processes that data only on the salon's instructions, under the data processing terms in our Terms of service.
2. What we process
Salon owners and staff: name, email, phone if given, salon details, password (stored only as a salted hash), two-step sign-in codes, sign-in history and billing events. Card details are collected by Paddle; we never see them.
Salon clients: name, phone, email, bookings, preferences, gift cards and passes, and notes the salon records — including health information a client gives for their own treatment, which is stored only with the client's explicit consent.
Messages sent to a salon. When you write to a salon on Instagram, Facebook Messenger, WhatsApp or Telegram, the platform delivers the message to Citamate through its official API, and we store: your name and profile name as the platform shares them, the identifier the platform assigns to you for that salon (an Instagram- or page-scoped ID, your WhatsApp phone number, or your Telegram user ID), the text of each message and its time, and the salon's replies. We do not store attachments. From Telegram, the salon's bot forwards photos and voice notes to the salon's own work group in Telegram, where they are kept under Telegram's rules; the conversation in Citamate shows only a note such as [photo]. Attachments sent on WhatsApp, Instagram or Messenger are not received at all — the salon is told to open the app on its phone. The salon uses this only to answer you, to link the conversation to your client card and, if you ask, to book an appointment.
Visitors of citamate.com: technical data your browser sends (IP address, browser, pages requested), kept in technical server logs for 14 days for security. citamate.com sets no advertising or analytics cookies; it stores only your language choice and, when you sign in, a session.
3. What we never do with your data
- We do not sell it, rent it or share it for advertising.
- We do not use messages from Instagram, Messenger, WhatsApp or Telegram for anything except the conversation with the salon you wrote to. We do not build profiles across salons and do not use this data to train AI models.
- One salon never sees another salon's clients or conversations.
4. Why (legal bases)
- Contract — running the service a salon pays for, and the booking you make with a salon.
- Consent — health information, birthday and promotional messages, the website assistant remembering you. You can withdraw consent at any time in the client area or by asking the salon.
- Legitimate interest — security logs, fraud prevention, keeping the service working.
- Legal obligation — invoices and payment records that Spanish tax law requires us or the salon to keep.
5. How long we keep it
- Conversations stay while the salon uses Citamate, until you ask for deletion or the salon deletes your client card.
- Client cards stay while the salon uses Citamate or until you ask for deletion.
- When a salon leaves Citamate, all of its data is deleted 90 days later; a final export is offered before that.
- Booking dates and amounts are kept for 6 years after anonymisation, because tax law requires it. They no longer point to you: name, contacts, preferences and health information are removed.
- Backups are kept for 14 days, so deleted data disappears from them within 14 days.
6. Who else processes data for us
| Company | What for | Where |
|---|---|---|
| Hetzner Online GmbH | Servers and database | Germany (EU) |
| Resend, Inc. | Sending email (confirmations, reminders) | United States — standard contractual clauses |
| Paddle.com Market Ltd | Billing salon subscriptions (merchant of record) | United Kingdom — adequacy decision |
| Anthropic, PBC | Website assistant and translations; never receives the salon's client base | United States — standard contractual clauses |
| Meta Platforms Ireland Ltd | Instagram, Messenger and WhatsApp — only when you or the salon use these channels | Ireland (EU) |
| Telegram Messenger Inc. / Telegram FZ-LLC | Telegram channel — only when you or the salon use it | British Virgin Islands / United Arab Emirates |
| MONEI / Stripe | Online payments to the salon's own account; the salon contracts with them directly | Spain / Ireland (EU) |
7. Your rights
You can ask to see, correct, export or delete your data, object to its use, or restrict it. Salon clients can do most of this themselves in the client area; anyone can use Delete your data or write to privacy@citamate.com. If your data belongs to a salon's client base, we pass your request to that salon and act on it together, within one month. You can also complain to the Agencia Española de Protección de Datos (aepd.es).
8. Security
Data is stored in the EU, encrypted in transit, with access limited by role inside each salon. Messaging and payment keys are stored encrypted. Backups are verified daily.
9. Children
Citamate is not meant for children under 14. A salon booking for a minor is made by a parent or guardian.
10. Changes
We will post changes here with a new date and, for salon owners, announce important ones in the panel 30 days ahead.