Privacy Policy

What changed — October 2026

Section 3 now lists every task Google's Gemini AI model performs: besides planning each turn and reading photos, it runs short checks on a message (for example whether it concerns someone else, or is sensitive), writes the one-line note the business sees on each conversation, and writes the reply when OpenAI is unavailable; OpenAI, in turn, plans a turn when Gemini is unavailable. The photo tables now name day spas, and section 2 and the retention table in section 6 say that a record made before 1 October 2026 may hold a nail colour or pattern, or hair details read from a covered head.

What changed — September 2026

Photos. When you send a photo to a hair, nail or beauty salon, a barbershop or a day spa whose owner has chosen that business type, it is now read by Google's Gemini AI model, and a short form of style details, each picked from a fixed list, is saved with your enquiry. The photo itself is not stored. At the same moment a second look checks it for writing, for signs of a condition and for whether the head is covered: a photo of skin, with writing or with a possible condition is not described at all — only that kind of photo is recorded, and where the head is covered nothing about hair is recorded. No nail colour or nail pattern is recorded. Photos sent to clinics and every other kind of business are not sent to any AI model. A record made before 27 September 2026 may instead hold one short sentence about the photo, and one made before 1 October 2026 may also hold a nail colour or pattern, or hair details read from a covered head; both are deleted with the enquiry. "Photos you send" in section 2, the AI table in section 3 and the retention table in section 6 are updated.

What changed — August 2026

We now name every AI provider that sees your data, and say plainly what each one receives — including that our planning model is sent the customer name and phone number in a conversation, and that the salon-facing AI Consultant sends recent customer messages to OpenAI.

We have replaced the old blanket claim that data is kept for 12 months. The honest position, set out in the retention table below, is that most conversation and booking data is kept for as long as the salon keeps its account, and is deleted on request or when the account ends.

We have also added the channels the product now covers (WhatsApp, Instagram, SMS and the AI phone line), corrected the list of providers we use, and stopped implying that your data stays in the UK or the EU. It generally does not.

1. Who We Are

Confirmed is an AI front desk for service businesses ("salons" or "business customers"). It answers messages on a salon's website chat, WhatsApp, Instagram and SMS, answers its phone line, takes bookings, and can take a deposit. This policy explains what happens to personal data at each of those points.

Controller for end-customer data: the salon whose chat, inbox or phone line you are using is the controller for your personal data. Razaq Ltd acts as its processor.

Controller for salon-owner account data: Razaq Ltd is the controller for information about salon owners and their staff accounts.

We have not appointed a Data Protection Officer, as we are not required to. Data protection enquiries go to privacy@razaq.ai.

2. What Personal Data We Collect

From end customers

We handle the same kinds of data whichever channel you use — the salon's website chat widget, WhatsApp, Instagram direct messages, SMS, or the AI phone line:

• Contact details: name, phone number (stored in full international format), email address
• Channel identity: the WhatsApp number, Instagram account or phone number you message from, so the salon can reply on the same channel and recognise you next time
• Booking information: service requested, date and time, your notes, and your booking history with that salon
• Conversation content: the messages you exchange, plus any notes salon staff add to the conversation
• Photos you send: see below
• Payment information: deposits and payments are processed by Stripe, with the salon as the merchant. We do not see or store your card details. We keep a reference to the booking and the payment.
• Technical data: IP address and browser or device type. IP addresses in our access logs are shortened before they are stored, and the keys we use for rate limiting are hashed rather than kept as raw numbers or addresses.

Phone calls

Calls to the AI phone line are recorded by our voice provider (Retell AI). Confirmed itself does not store the audio: what is said is turned into text and kept as a transcript in the same way as any other conversation, and the calling number is kept in our record of the call. The audio recording is held by Retell AI under its own retention arrangements. Because calls are recorded, callers must be told — the AI greeting states that the caller is speaking to an AI assistant and that the call may be recorded, and salons must not disable or replace that notice.

Photos you send

You can send a photo into a conversation — usually a style reference. We do not store the photo itself. What happens next depends on the kind of business you are messaging:

• Hair, nail and beauty salons, barbershops and day spas whose owner has chosen that business type: the photo is sent to Google's Gemini AI model twice, at the same moment: once to fill in a short form about the style it shows, and once to check it for any writing, for any mark on the nails, skin, scalp or hair themselves, and for whether the head is covered. For that check the model copies out any words it sees in the picture; they are used only to decide that the photo is not described, and are never saved. Every answer on the form is picked from a fixed list: for hair, the colour, length, cut and texture; for nails, the shape and length, and a plain glossy, matte or chrome finish only on nails the check sees as polished (no nail colour is recorded, and no pattern such as nail art, glitter or a French or ombré finish); for brows, the shape and tint; for lashes, the style and tint. Those style details are saved with your enquiry so the business's team can see them, and the photo is then discarded. The form has no space for words, so it cannot record your face, your age, your skin, your religion or ethnicity, anything you are wearing, any words in the picture, a price, a diagnosis or whether a treatment suits you — those are for the business to confirm. If the photo shows skin, might show a condition of your hair, scalp, skin or nails, or has any writing in it (a caption, a label, a note, a screenshot), none of it is described: we record only that kind of photo was sent. If your head is covered (a scarf, hijab, turban, hat or cap), nothing about hair is recorded. The assistant's reply to you may repeat the style details, and that reply is part of the conversation transcript like any other message. A record made before 27 September 2026 may instead hold one short sentence the model wrote about the photo, and one made before 1 October 2026 may also hold a nail colour or pattern, or hair details read from a covered head; both are deleted with the enquiry.
• Clinics and every other kind of business — and a salon, barbershop or day spa whose owner has not yet chosen its business type: the photo is not sent to any AI model and is not stored. The assistant tells you it cannot open photos, and the business sees only that a photo was sent. The same happens if a conversation, or the salon's day, has already sent more photos than a set limit.

Salons must not ask customers for health information through the Platform. Please do not send anything more than you need to for the booking.

From salon owners and staff

• Name, email address, phone number
• Business name, address and website
• Subscription and billing information, handled through Stripe
• Payment account setup: to take deposits, you complete Stripe's own onboarding directly with Stripe
• Calendar data, where Google Calendar, Outlook or an iCal feed is connected
• Business configuration: services, opening hours, branding, and the answers you give the AI to use
• Content imported from your public website when you set the account up. This import reads your website only; it involves no customer data.

3. How We Use Your Data

End-customer data

Salon-owner data

AI processing — which providers see what

Confirmed is built on AI models run by other companies. To answer a message, the relevant part of the conversation is sent to them. This is the part of our processing customers most often do not expect, so we set it out in full:

The AI never carries out an action itself. It reads the conversation and proposes a plan; our own code checks that plan and then performs the booking, the payment or the message. A member of salon staff can take over any conversation at any point.

Automated checks that can refuse a request

We run automated abuse controls: obviously invalid or throwaway phone numbers are rejected, and there are caps on how many bookings can be made from one phone number or IP address in a period. These can stop a booking going through. They are anti-abuse measures rather than decisions about you, and a human can always override them — contact the salon, or us, and a person will look at it.

We do not use your data for automated decision-making that produces legal or similarly significant effects, and we do not sell personal data.

Anonymised, aggregated statistics

We record one summary per salon per day — figures such as diary utilisation, no-show rate, repeat-client rate, confirmed revenue and number of bookings. That summary contains no customer data and stays within that salon's own area of our system. We do not combine salons' data today.

We reserve the right to produce and use anonymised, aggregated statistics derived from use of the Platform — for example to benchmark performance, and to run and improve the service — including after an account ends. Such statistics never identify a salon or any individual, and are not personal data. The corresponding right for business customers is set out in our Terms of Service.

4. Who We Share Your Data With

We use the following providers (sub-processors). Some are used only where a salon turns the relevant feature on.

We may also disclose data where required by law, court order or a regulator.

5. International Data Transfers

Your salon's database and uploaded files are stored in the United Kingdom — Google Cloud's London region (europe-west2). Our error monitoring is hosted in the EU (Germany). However, most of the providers listed above are based in the United States or route data globally, so parts of a conversation — including message content sent to the AI providers — are processed outside the UK.

Where data leaves the UK we rely on the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, in our contracts with those providers. We are happy to discuss the arrangements for a specific provider with any salon that asks.

6. How Long We Keep Your Data

Some records are deleted automatically after a fixed period. The rest are kept while the salon's account is open, and deleted on request or when the account ends.

"While the account is open" means we keep the data until the salon asks us to delete it, until you ask and the salon agrees, or until the salon closes its account. Stripe keeps its own record of payments under its own retention policy. Where an automatic deletion rule is not yet switched on in a particular environment, the data is covered by the position above rather than deleted on the shorter timetable.

7. Your Rights

Under UK GDPR you have the right to:

• Access — get a copy of the personal data held about you
• Rectification — have inaccurate or incomplete data corrected
• Erasure — have your data deleted
• Restriction — have processing limited in certain circumstances
• Portability — receive your data in a portable format
• Object — object to processing based on legitimate interests, including marketing
• Withdraw consent — where processing relies on consent

How to make a request

If you are a customer of a salon, that salon is the controller of your data. The quickest route is to ask the salon directly. If you contact us instead, we will pass the request to the salon and help them act on it — in most cases we can carry out the deletion or export ourselves once the salon confirms.

Write to privacy@razaq.ai. We will acknowledge your request and respond within one month. If a request is complex, or if you have made several, we may extend that by up to two further months and will tell you why within the first month. We may ask you to confirm the phone number or email address the conversation used, so that we return the right person's data.

If you are unhappy with our response you can complain to the Information Commissioner's Office: ico.org.uk | 0303 123 1113.

8. Cookies, Tracking and Marketing Messages

Cookies

The Confirmed chat widget sets no cookies. It keeps your conversation for the length of your visit to the page. The salon dashboard uses your browser's own storage — not cookies — to keep staff signed in and to remember display preferences. Neither the widget nor the dashboard uses advertising or tracking cookies.

Our marketing pages can be configured to use Google Analytics to count visits. Where that is switched on, Google sets its own analytics cookies in your browser; where it is not, no analytics cookies are set.

Marketing and messaging

Most messages we send on a salon's behalf are service messages: confirmations, reminders and changes to a booking you asked for. Where a salon sends anything promotional, the salon is responsible for having a lawful basis to do so under UK GDPR and PECR.

You can stop SMS at any time by replying STOP, and start again by replying START. We honour STOP as soon as we receive it. We keep opt-out records indefinitely and by design: the suppression list is how we know never to message you again, so it survives even when other data about you is deleted. It holds only what is needed to recognise the number and that it opted out.

9. Children's Data

Our services are not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, contact privacy@razaq.ai and we will delete it promptly.

10. Security

The measures we actually have in place:

• Encryption in transit (TLS), and encryption at rest provided by our hosting and database providers
• Application-level AES-256-GCM encryption of the tokens that connect a salon's messaging channels and integrations
• Complete separation between salons: every record lives under a single salon, and a request is always checked against the signed-in account rather than any salon identifier the browser supplies
• No direct database access from browsers or apps — our database rules deny all client access, so every read and write goes through our server
• Dashboard access requires a verified sign-in token
• Logging that strips personal data, enforced by an automated test that fails the build if it is broken
• IP addresses shortened before they are written to access logs
• Cryptographic, timing-safe verification of incoming webhooks from Meta, Twilio and Stripe
• Signed, single-use states when connecting an integration
• Defences against requests being redirected to internal systems when a salon supplies a URL
• Rate limiting keyed on hashed — never raw — phone numbers and IP addresses, plus caps that limit booking abuse

We do not hold ISO 27001 or SOC 2 certification and we do not claim one. No system is completely secure. If there is a breach that poses a risk to your rights and freedoms we will notify the ICO within 72 hours and affected individuals without undue delay.

11. Changes to This Policy

We update this policy as the product changes. When something material changes we update the date at the top and summarise the change in the "What changed" note, so you can see what is different without re-reading the whole document.

12. Contact Us

Razaq Ltd (company number 17057410, England and Wales)
Data protection: privacy@razaq.ai
Contracts and terms: legal@razaq.ai
Anything else: hello@razaq.ai
Website: razaq.ai

Business customers can find the processing terms that apply between us in our Data Processing Agreement. This policy and any dispute about it are governed by the laws of England and Wales.