Privacy Policy

This policy explains what JustAgenda LTD ("we", "us") does with personal data in JustAgenda — the booking assistant that businesses use to take bookings through messaging apps.

It is written to be read by two different people, and it says which parts are for which:

• If you run or work in a business that uses JustAgenda — clauses 2, 3, 5, 6, 8, 9, 11 and 12 are about your own data, and the rest describes what we do with your customers' data on your behalf.
• If you messaged a business and it replied through JustAgenda — clauses 1, 4, 5, 6, 7, 8, 9 and 10 are the ones that concern you. The short version: the business you contacted decides what happens to your data, we handle it for them, we keep the conversation for a limited time so that mistakes can be sorted out, and you can ask for it to be deleted.

This policy covers the Assistant, the owner Dashboard, and our internal administration console. It does not cover Telegram, WhatsApp, or the businesses themselves, which have their own policies.

1. Who is responsible for what

Data protection law distinguishes the party that decides why data is used (the controller) from the party that handles it on their instructions (the processor). JustAgenda has both, and which one we are depends on whose data it is.

If you are an end customer, the business is your first point of contact. It is their customer relationship and their decision. You can also come to us directly at legal@justagenda.com and we will act with the business.

2. Who we are, and how to reach us

We are not required to appoint a Data Protection Officer, and we have not appointed one. Privacy questions go to legal@justagenda.com and are handled by the two people who run JustAgenda LTD.

3. What we hold about business owners and staff

Name, email address, telephone number, role in the business, and the messaging account used to open the Dashboard. When you log in we record the session, the IP address and the browser user-agent of the request. Administrators of our internal console also have a second authentication factor registered.

We also keep a record of changes made to a business's setup — which field was changed, by whom, and when — so an owner can see what happened to their own configuration.

4. What we hold about end customers

This is the data the business controls and we process for them:

• Identity and contact — the messaging account identifier, telephone number, first and last name, and email address where the business holds one.
• Booking records — appointments, the services booked, which staff member, and a count of missed appointments.
• What the business records about you — notes its staff add (such as styling preferences, a "regular customer" marker, preferred language, or customary salon patch-test and product sensitivity notes recorded with your explicit consent).
• Conversations — the messages exchanged with the Assistant, including the text transcribed from voice notes, and the Assistant's replies.
• Service communications only — we only send transactional messages directly relating to your bookings and appointments (confirmations, schedule updates, cancellations, and reminders). We do not send marketing campaigns, promotional broadcasts, or unsolicited advertisements.

Voice notes, specifically

If you send a voice note, the audio is sent to a speech-to-text provider and turned into text. The audio is held in memory for the length of that request and is never written to disk by us. The transcript becomes the message and is stored like any typed message, and it is shown back to you above the reply so you can see what was heard.

To improve accuracy, the names of the business's staff and services are sent along with the clip as a hint. No customer's personal data is sent as part of that hint.

Where it comes from, and what you have to give

Most of it comes from you, in the messages you send. The rest does not, and you are entitled to know that:

• From the business you contacted — anything its staff add to your record: your name as they have it, an email or phone number you gave them in the shop, and any notes they write.
• From the messaging app — the account identifier that lets us reply to you, and the display name and language your app reports. We never see your Telegram or WhatsApp password, contacts, or any other conversation.
• Generated by the Service itself — your appointment history and the count of appointments missed.

What you have to provide. There is no statutory obligation to give us anything. But a booking is a contract with the business, and we cannot make one without a way to identify you and reach you — so if you decline to give a name or a contact point, the assistant cannot complete a booking. Everything else, including your email address, is optional.

What the provider does with it. They are contractually barred from training on it, and by default they keep nothing from an ordinary request. Where a copy is kept briefly for reliability and abuse monitoring it is deleted within 30 days, and it is stored in the United States — see clause 7.

5. Why we use it, and our legal basis

The legitimate interests balancing test

We record this openly because the law requires us to have done the thinking, and because writing it down beats improvising it later.

The interest. Two things. First, disputes are real and specific: a customer says they booked and has deleted their messages; or a customer shows a screenshot in which the Assistant appeared to confirm a booking that does not exist. Without a record, the business and the customer are left arguing about memory, and the customer usually loses. Second, the Assistant is an AI system speaking to people in three languages, and the only way to find where it is failing them is to look at where it failed.

Is it necessary? For disputes, yes — nothing but the conversation itself evidences what was said, and the messaging apps do not keep an authoritative copy either party can rely on. For quality, we looked at whether aggregate counts alone would do, and they do not: a count tells you a booking was abandoned, not that the Assistant asked the same question three times.

The impact on the individual, and what we do about it. The conversations are short, transactional, and about haircuts and appointments — but they are still someone's messages, so:

• they are deleted automatically after 90 days at the latest (clause 6);
• no JustAgenda LTD employee sees them in the ordinary course of business — access requires a typed reason and is logged (clause 8);
• when a conversation is seen outside the business it belongs to it is redacted first, and the customer becomes a pseudonym;
• they are never used to train AI models, ours or anybody else's;
• you can object and ask for deletion (clause 9).

Conclusion. The interest is real and specific, the data is the minimum that serves it, the retention is short, the access is controlled and audited, and the individual keeps a live right to object. On balance we consider the processing justified. If you disagree, clause 9 is how you say so, and we will stop unless we can show compelling grounds otherwise.

6. How long we keep it

When a business leaves, its data is exported for it and then deleted; deleting a business requires two of our administrators acting together, so it cannot happen by one person's mistake.

When an erasure request is fulfilled, the customer's conversations are deleted and their record anonymised, but the appointments remain as anonymised entries — the business needs an accurate history of its own trading, and that history no longer identifies anyone.

7. Who else is involved

We use a small number of suppliers ("sub-processors"). They are:

Transfers outside the EEA and the UK. The language model and the transcription provider are in the United States. Those transfers are made under the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum, and where applicable the EU-U.S. Data Privacy Framework and its UK Extension. We have assessed the transfer risk.

A copy of the safeguards. You are entitled to see the protections these transfers rely on. Write to legal@justagenda.com and we will send you a copy of the relevant clauses.

We do not sell personal data, and we do not share it for advertising.

8. Who at JustAgenda LTD can see a conversation, and how that is controlled

We think this deserves its own clause, because "staff may access data where necessary" is what every policy says and it tells you nothing.

• Conversations are not visible to us by default. Our internal console shows metrics, not message text.
• Reading the text of a conversation requires a typed reason, and the access is recorded.
• The customer is pseudonymised — shown as something like cust_8f3a — and the text is redacted: telephone numbers, email addresses, postal addresses and card-shaped digit sequences are stripped. The names of staff and of services are kept, because they are usually the point of the investigation.
• Today there is no way for us to reveal a customer's real name or telephone number through our console at all — the capability does not exist. When it is added, for the occasional case where someone has to be telephoned back, it will require authenticating again, a typed reason, and it will be logged.
• The AI model can never read a stored conversation. Transcripts are structurally outside what any prompt can reach, and that is enforced by an automated test rather than by a policy anyone could forget.
• The business's own staff see their own customers unredacted. It is their customer, and they already know the phone number.

9. Your rights

Under the UK GDPR and the EU GDPR you have the right to: access your data; have it corrected; have it erased; restrict or object to how it is used; receive a copy in a portable, structured, machine-readable form (such as CSV or JSON); and withdraw consent at any time where consent is the basis.

How to exercise them. If you are an end customer, ask the business you contacted — they are the controller and we act on their instruction. You can also write to legal@justagenda.com and we will act with them. We respond within one month.

What is true today, stated honestly. Erasure and export are performed by us on request, by hand. The self-service paths — a customer asking the Assistant to be forgotten, or to be sent a copy of their conversation — are being built and are not available yet. Until they are, a request by message or email reaches a person, and is acted on. This policy will be updated when that changes.

Checking it is really you. A request to delete or send a copy of someone's conversations is itself a way to attack them, so we have to be satisfied you are who you say you are. Usually that is simple — the request comes from the same messaging account the conversation happened on. Where it does not, we may ask for something more before acting, and we will ask for as little as will do.

Complaints. If you think we have handled your data badly, please tell us first. You can also complain to a supervisory authority:

• Spain — Agencia Española de Protección de Datos (AEPD), www.aepd.es
• United Kingdom — Information Commissioner's Office (ICO), ico.org.uk

10. Automated decisions and AI transparency

The Assistant uses AI to understand what you write and to phrase its replies, but it does not make decisions with legal or similarly significant effects about you. Availability, prices, services and staff come from the business's own records through ordinary software, not from the model's judgement, and nothing in the Service profiles you or scores you.

AI transparency (EU AI Act, Article 50). In accordance with Article 50 of the EU AI Act (Regulation (EU) 2024/1689), the Assistant is designed to clearly inform you upon first contact that you are interacting with an automated artificial intelligence system.

11. How we protect it

• Every business's data is isolated from every other business's, enforced on every database query.
• Connections are encrypted in transit.
• Logging in creates a server-side session referenced by an opaque cookie marked HttpOnly, Secure and SameSite; the value is stored hashed, never in the clear. Sessions expire on a fixed schedule and do not extend themselves.
• Deactivating a staff member revokes their access immediately.
• Our internal administration console is a separate door with its own credentials, a second authentication factor, and shorter sessions.
• Conversation records are hash-chained, so a record cannot be altered after the fact without it being detectable.
• Access to sensitive views is audited, as described in clause 8.

No system is perfectly secure, and we will tell you and the relevant authority if a breach occurs that requires it.

12. Cookies

The Dashboard and the administration console use strictly necessary cookies only, to keep you logged in:

There are no analytics, advertising or tracking cookies anywhere in the Service, so there is no consent banner to click. Under Spanish law (LSSI-CE) and the UK PECR, cookies strictly necessary to deliver a service you asked for do not require consent.

13. Children

The Service is intended for adults. An appointment for a child should be booked by the adult responsible for them, from that adult's own messaging account — which is what happens in practice when a parent books a haircut.

We do not ask for anyone's age, and we do not knowingly process the personal data of a child booking for themselves. If you believe a child's data has reached us, write to legal@justagenda.com and we will delete it. The business remains responsible for how it handles appointments concerning minors under its own obligations as controller.

14. Changes to this policy

We will publish any new version at https://justagenda.com/legal/privacy with its version number and effective date, and we will tell businesses about material changes before they take effect. Previous versions remain available.

Change history