Privacy Policy

BRUT | Smart Customer Flow — Last updated: July 3, 2026

This policy explains how BRUT | Smart Customer Flow ("BRUT", "we") collects, uses, and protects the personal data of individuals who interact with our services, on behalf of our business clients (independent beauty salons and partner businesses).

1. Who we are

BRUT is a B2B service that installs, configures, and operates an automated AI appointment-scheduling assistant for small independent businesses in Paris, France. We act as data processors on behalf of our clients (the businesses), who remain responsible for data processing in relation to their own end customers.

2. Data we collect

When someone contacts a partner business via WhatsApp or Instagram, we may process:

• The phone number or Instagram username used in the conversation
• The content of exchanged messages (text and, where applicable, voice messages automatically transcribed)
• The name provided during the conversation
• Appointment information (date, time, requested service)
• The message exchange history, kept to ensure conversation continuity

3. Purposes of processing

• Responding to requests and automating service scheduling
• Maintaining a consistent conversation history with each customer
• Allowing the partner business's staff to resume the conversation if necessary
• Improving the quality of the service provided

4. Legal basis

Processing is based on the data subject's legitimate interest in acquiring the partner business's services (through contact for appointment scheduling), as well as on the business's legitimate interest in automating its customer relationship.

5. Recipients and technical subprocessors

To operate, our service relies on the following providers, each operating under contractual confidentiality safeguards:

• Meta Platforms (WhatsApp, Instagram) — message transmission
• Anthropic — natural language processing to generate assistant responses
• Google (Calendar, Sheets) — appointment management and business knowledge base
• Hetzner Online GmbH (Germany, European Union) — server infrastructure hosting

No data is sold or shared for advertising purposes.

6. Retention period

Conversation history is kept for as long as necessary to ensure customer service continuity, and may be deleted upon simple request (see section 8).

7. International transfers

Our servers are hosted within the European Union (Germany). Some technical subprocessors may process data outside the EU, under appropriate safeguards (European Commission standard contractual clauses).

8. Your rights

In accordance with the General Data Protection Regulation (GDPR), you have the right to access, rectify, erase, restrict the processing of, and object to the processing of your personal data. To exercise these rights, please contact the partner business directly, or contact us using the details below.

9. Contact