Privacy Policy

1. Who we are

The basalto platform ("Platform") is operated by GCL SERVICOS DE TECNOLOGIA DA INFORMACAO LTDA, registered under Brazilian CNPJ 44.105.841/0001-39 ("we"). The Platform provides online scheduling and WhatsApp-based client communication for service businesses ("Businesses").

This policy explains which personal data we process, for which purposes, and your rights, under the Brazilian General Data Protection Law (LGPD, Law 13,709/2018) and applicable local rules.

2. Processing roles (important)

For Business account data (owner details, professionals, services, settings and billing), we act as the CONTROLLER.

For each Business's end-client data (the names, phone numbers, messages and appointment history of the salon's or clinic's own clients), the Business is the CONTROLLER and we act as the PROCESSOR (operadora), processing that data only on the Business's instructions. Data-subject requests about that data should go to the Business first; the Platform provides export, correction and deletion tooling.

3. Data we process

Business account: owner name, email, phone; business details (name, optional address, hours, services, professionals); billing and plan data.

The Business's end clients: name, phone (and email if provided), notes and tags recorded by the Business, appointment history, messaging preference (opt-in/opt-out) and messages exchanged on the Business's WhatsApp.

Technical data: access logs (IP, timestamps), acquisition identifiers when you arrive via an ad or referral (e.g. utm, fbclid) and usage events needed for security and operation.

We do NOT process clinical or health data: the Platform is not intended for medical records, and Businesses are instructed not to enter them.

4. Purposes and legal bases

Contract performance: operating the schedule, confirming and reminding about appointments, processing plan payments, support.

Legitimate interest: security, fraud and abuse prevention (e.g. rate limits), service improvement, aggregate metrics.

Consent: WhatsApp marketing messages only to end clients who opted in; revocable at any time (e.g. by replying STOP).

Legal obligation: retention of legally required records.

5. AI assistant

Automated WhatsApp replies use a language model to interpret messages and suggest times, with safeguards: the assistant has no direct write access to data, every action is re-validated by our servers, and the Business can take over the conversation or turn the assistant off at any time.

Processing is performed by a specialized processor (Anthropic) under contract; data is not used to train models.

6. Processors and transfers

We share data only with processors needed to operate, under data-protection agreements: Meta Platforms (WhatsApp Business Platform), Stripe (plan payments), Google (optional sign-in and calendar sync), Anthropic (AI assistant, section 5), Google Cloud (hosting, São Paulo region), a transactional email provider, and Sentry (error monitoring, configured to receive no personal data).

Some processors handle data outside your country (United States and Brazil), under contractual clauses and adequate safeguards.

We do not sell personal data and do not share it for third-party advertising.

Google Calendar data

If a professional chooses to connect their Google Calendar, basalto accesses only that calendar's events to (a) create, update and cancel events mirroring bookings made in basalto and (b) treat already-busy hours as unavailable for new bookings.

This data is not used for any other purpose, is never sold, and is not used for advertising or to train artificial-intelligence models. basalto's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

The connection is individual, optional and can be disconnected at any time; access tokens are stored encrypted.

7. Retention and deletion

Account data is kept while the account exists and for the legally required period afterwards.

WhatsApp message content is automatically deleted after 18 months; minimal metadata may be kept longer for audit and billing.

When a Business deletes an end client, the data is irreversibly deleted or anonymized, including phone numbers and message content.

Backups are kept for a limited period and expire automatically.

8. Your rights

You may request: confirmation of processing, access, correction, anonymization or deletion, portability (the Platform offers data export to the Business), information about sharing, and consent revocation.

End clients of a Business should direct requests to that Business (the controller); for marketing messages, replying STOP suffices. Business owners can reach us at the contact below.

9. Security

We apply proportional technical and organizational measures: encryption in transit and at rest, per-Business data isolation enforced in the database, encrypted credentials, least privilege, and audit logs.

10. Cookies

We use only essential cookies and local storage (authenticated session and preferences such as theme). We use NO analytics or advertising cookies — which is why there is no cookie banner.

11. Children

The Platform is intended for businesses and is not directed at anyone under 18.

12. Contact

Data protection officer (DPO): contato@usebasalto.com.

You may also petition your local data-protection authority (in Brazil, the ANPD).

13. Changes to this policy

We may update this policy; material changes will be announced through the Platform or by email with reasonable notice. The last-updated date appears at the top.