BookHere is, with no small print, what we do with your data when you call us, message us on WhatsApp or Instagram, book an appointment or visit this website. If anything is unclear, write to thebrothersbarber2024@gmail.com and we'll explain.
1. The basics
- Who handles your data
- THE BROTHERS BARBER SHOP S.C. (tax ID J70887807), the partnership behind The Brothers Barbershop. Privacy email: thebrothersbarber2024@gmail.com.
- What for
- To book and look after you by phone, WhatsApp, Instagram and the website; to keep call recordings for 30 days to check what was said and fix the assistant’s mistakes; to send you the guide you ask for; and to meet our tax obligations.
- Why we can
- Because you ask us for the appointment or the information (art. 6.1.b GDPR); our legitimate interest in giving a good service, when we keep the calls (6.1.f), which you can object to; your consent, for the guides and for appearing in photos or videos (6.1.a); and a legal obligation, for invoices (6.1.c).
- Who we share it with
- The providers behind our booking system, phone line, AI assistant, chats and website, who only use it on our behalf (section 7). We never sell your data or give it to anyone for their advertising.
- Outside the European Union
- Some providers are in the USA. Data leaves the EU with the safeguards the GDPR requires: the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.
- Artificial intelligence
- The phone and chat assistant is an AI. Free slots come from our booking system and exceptions are decided by a person: we make no decisions based solely on automated processing that significantly affect you (art. 22 GDPR), and no profiling. If the assistant can’t book you in, it passes you to the team or lets you book on the website.
- Your rights
- See, correct and delete your data, object (to the recording too), restrict it and take it with you. Write to thebrothersbarber2024@gmail.com. You can also complain to the Spanish Data Protection Agency (section 9).
2. Who is responsible
- Data controller
- THE BROTHERS BARBER SHOP S.C.
- Tax ID (CIF)
- J70887807
- Registered address
- Calle Berna, 2, Planta L4, Puerta B3, Edificio Cristianos I, 38650 Los Cristianos, Arona (Santa Cruz de Tenerife)
- Privacy email
- thebrothersbarber2024@gmail.com
- AI voice assistant line
- +34 922 01 43 57
- Barbershop WhatsApp
- +34 623 169 994
- Data protection officer
- We don’t have one: it isn’t required for our activity.
3. Calls: an AI voice assistant that records
What data
- The number you call from (unless you hide it).
- Your voice, the call recording and its transcript (the text of what was said).
- The appointment details: your first and last name, the service, the day, the time and the barber.
- If you ask to speak to the team, a message with your name, your number and what you need.
We don't use your voice to recognise you: we identify you by your number and your name, so it is not biometric data. Please don't tell us health details (an allergy, for example): the assistant won't note them down and will ask you to mention it to the barber when you come in.
To book you we need your name: without it we can't make the appointment. Calling is not compulsory: you can book on this website, by WhatsApp or at the barbershop.
How it works
Twilio connects the call. ElevenLabs listens, turns it into text and gives the assistant its voice. To understand and answer you, ElevenLabs uses an AI model from Anthropic (Claude) and, after the call, one from Google (Gemini) that reviews the call to count the appointments made. n8n connects the assistant with our Square booking system, where the appointment is saved. If you ask for a person, the team gets the message on Telegram.
What for and why
| What for | Legal basis |
|---|---|
| What for: Handling the call: finding slots, booking, changing or cancelling your appointment and passing you to the team | Legal basis: You ask for it: pre-contract steps or the service you book (art. 6.1.b GDPR) |
| What for: Transcribing what you say as you speak, so the assistant understands you | Legal basis: Same (art. 6.1.b) |
| What for: Keeping the recording and transcript for 30 days, to check what was said if there is a doubt or a complaint, and to check whether the assistant made a mistake and fix it. We don’t use them to train AI models | Legal basis: Our legitimate interest in giving a good service and being able to show what was agreed (art. 6.1.f). You can object |
If you don't want to be recorded
We tell you about the recording as soon as we answer, before you tell us anything. If you don't want it, say so: the assistant won't ask for any details and will tell you how to book on this website, without calling. You can also message us on WhatsApp. Whatever was said up to that point stays recorded; if you want us to delete it before the 30 days, write to thebrothersbarber2024@gmail.com with the day and time of the call and the number you called from.
How long
The recording and transcript: 30 days, then they are deleted automatically. If you complain about a call and we need to keep it longer to sort it out, we will tell you. Other periods are in section 8.
4. WhatsApp and Instagram
When you message us on WhatsApp or Instagram, the same Digital Brother answers, also an AI: it says so in its first message. You can ask for a person at any time by writing PERSONA (or PERSON); during opening hours the team replies.
- What data: your profile name, your WhatsApp number or Instagram username, the messages and, if you book, the appointment details.
- Who is involved: ManyChat runs the conversations, n8n connects them to the booking system and Anthropic (Claude) writes the replies. The AI sees the conversation with your number hidden.
- Legal basis: handling what you ask for and managing your appointment (art. 6.1.b GDPR). To book we need your name; without it we can't make the appointment.
- Promotional messages: only with your permission (art. 6.1.a GDPR and art. 21 of the Spanish e-commerce law, LSSI). You can unsubscribe at any time by writing BAJA (or STOP).
Guides sent by Instagram DM
If you comment the word one of our videos asks for (for example, DANDRUFF), we send you the guide by private message. For that we process your username, public name, comment and the conversation. Legal basis: your consent when you ask for the guide. Asking for a guide doesn't mean you have any skin or hair condition. We don't use the word you comment for profiling, targeting or ads: only to send you the guide. You can withdraw your consent or ask us to delete your data at any time, in the same chat or by email, without affecting what was already done.
Instagram is run by Meta Platforms Ireland, which processes data on its platform as a controller under its own privacy policy.
5. Bookings in Square
Our booking system is Square Appointments. Appointments you book by phone, by chat, at the barbershop or on the website (every “Book” button here leads to Square) are kept there: first and last name, phone, email if you give it, and your appointment history (service, day, time and barber). Legal basis: managing the appointment you ask for (art. 6.1.b GDPR).
To book we need a name and a phone number: without them we can't save the appointment or tell you if anything changes. Square may send you the confirmation and a reminder of the appointment by text message. Unsubscribing from promotional messages doesn't stop these appointment messages.
Square processes our booking data on our behalf. For what it does on its own account (for example, if you create a Square customer account, or to prevent fraud), Square is the controller under its own privacy policy.
6. This website
- Hosting: the website runs on Cloudflare, which receives the technical details of the connection (such as your IP address) to serve the page and protect it from attacks. Legal basis: legitimate interest in a working, secure website (art. 6.1.f GDPR).
- Visits: we count visits with Cloudflare Web Analytics, which uses no cookies and doesn't use your IP to follow you from site to site. We don't use the Meta pixel, Google Analytics or any other advertising tools.
- The Google map on the contact page only loads if you press “Show the map here”. When you do, Google receives your visit and may use its cookies.
- Cookies: this website sets no tracking or advertising cookies. Details in the cookie policy.
Photos and videos
If you appear in our photos or videos (Instagram, TikTok, Facebook or this website), it is because you gave us written permission (art. 6.1.a GDPR and Spanish Organic Law 1/1982). You can withdraw it whenever you want: we take the post down within 72 hours.
7. Who we share your data with
Those who process your data on our behalf (“processors”) have a contract that only lets them use it for that (art. 28 GDPR). Some of them use other companies in turn (sub-processors): if you want the list, or a copy of the safeguards for a transfer, ask at thebrothersbarber2024@gmail.com.
| Provider | What for | Where and with what safeguard |
|---|---|---|
| Provider: Squareup International Limited (Square, Ireland) | What for: Bookings, customer records and appointment texts. Processor | Where and with what safeguard: May process data outside the EU, with standard contractual clauses |
| Provider: Twilio Ireland Limited | What for: Phone number and call connection. Processor | Where and with what safeguard: May process it in the USA (Twilio Inc.), with the EU-US Data Privacy Framework and standard clauses |
| Provider: Eleven Labs Inc. (ElevenLabs, USA) | What for: Voice assistant: listens, transcribes, speaks and keeps the call for 30 days. Uses AI models from Anthropic (Claude) and Google (Gemini). Processor | Where and with what safeguard: USA, with standard clauses |
| Provider: Anthropic Ireland, Limited | What for: AI that understands and writes the chat replies. Processor | Where and with what safeguard: USA, with standard clauses |
| Provider: Manychat, Inc. (USA) | What for: WhatsApp and Instagram conversations and sending the guides. Processor | Where and with what safeguard: USA, with standard clauses |
| Provider: n8n GmbH (Germany) | What for: Automations that connect the phone and chat to the booking system. Processor | Where and with what safeguard: European Union (servers in Frankfurt) |
| Provider: Meta (WhatsApp Business: WhatsApp Ireland Limited or Meta Platforms Ireland Limited, depending on the channel) | What for: WhatsApp Business channel. Processor | Where and with what safeguard: May send data to the USA, with the EU-US Data Privacy Framework |
| Provider: Meta Platforms Ireland Limited (Instagram) | What for: Instagram channel. Controller of its own platform | Where and with what safeguard: Under Instagram’s policy |
| Provider: Telegram | What for: Internal notices to the team, such as the message when you ask for a person (name, number and reason). Deleted after a week | Where and with what safeguard: Under Telegram’s policy |
| Provider: Google | What for: Backups of our tables (without the conversations) in Google Drive, and the privacy email (Gmail) | Where and with what safeguard: Under Google’s terms |
| Provider: Cloudflare, Inc. (USA) | What for: Website hosting and cookie-free visit counting. Processor | Where and with what safeguard: USA and its global network, with the EU-US Data Privacy Framework and standard clauses |
About the USA: the EU-US Data Privacy Framework is a European Commission decision recognising adequate protection at the companies that sign up to it. It is in force, although it has been challenged before the EU Court of Justice; if it fell, transfers would continue under the standard contractual clauses.
We may also have to give data to courts, the tax office or the Spanish Data Protection Agency when the law requires it.
8. How long we keep it
| Data | How long | Then |
|---|---|---|
| Data: Call recording and transcript (ElevenLabs) | How long: 30 days | Then: Deleted automatically |
| Data: Call record at the phone company (Twilio: number, time and length) | How long: As long as Twilio keeps it | Then: We delete it if you ask |
| Data: Message to the team (Telegram) | How long: 1 week | Then: Deleted automatically |
| Data: Chat memory the assistant uses | How long: 72 hours | Then: Wiped automatically every day |
| Data: WhatsApp and Instagram messages in our inbox | How long: 12 months from your last message, or sooner if you ask | Then: We delete them |
| Data: What the chat AI processes (Anthropic) | How long: 30 days, under its contract (longer only if the law requires it or to enforce its usage rules) | Then: Deleted by Anthropic |
| Data: Technical logs of our automations (n8n) | How long: 12 months | Then: We delete them |
| Data: Customer record and appointment history (Square) | How long: While you are a customer. Once a year we review the records of anyone who hasn’t come in for over 2 years | Then: Blocked, then deleted |
| Data: Backups | How long: 30 days | Then: We delete them |
| Data: Receipts and invoices | How long: 6 years (Spanish Commercial Code) | Then: Deleted |
| Data: Permission for promotional messages | How long: Until you withdraw it, plus 3 years to be able to prove it | Then: Deleted |
| Data: Unsubscribe record | How long: Only what we need never to message you again | Then: — |
| Data: Photos and videos you appear in, and your permission | How long: Until you withdraw permission; the permission, 3 more years | Then: Post taken down within 72 h |
“Blocked” means the data is set aside and nobody uses it; it is only kept for a court, the tax office or the Data Protection Agency while a claim is possible, and then deleted (art. 32 of the Spanish data protection law, LOPDGDD).
9. Your rights and how to use them
You can ask us, free of charge, to:
- see what data we hold about you and get a copy (access), including your call recording while it exists;
- correct it (rectification) or delete it (erasure);
- object to us using it on the basis of legitimate interest, for example keeping your call recording, and to receiving promotional messages;
- restrict its use or take it with you (portability);
- withdraw your consent at any time, without affecting what came before.
How: write to thebrothersbarber2024@gmail.com or ask at the barbershop. Tell us what you want and how to find you (the number you called, booked or messaged from). We reply within one month at most; if it is very complex, we will tell you within that month that we need up to two more months. For promotional messages, just write BAJA (or STOP) in the chat.
You never need to call. You can book on this website, message us on WhatsApp or come to the barbershop.
If you think we haven't done it right, you can complain to the Spanish Data Protection Agency (AEPD) or to the data protection authority of the European Economic Area country where you live or work.
10. Children
Appointments for children are booked by their mother, father or a responsible adult, who gives us the details. If the person calling or writing is a child without an adult, the assistant asks for no details and asks for an adult to book. Even so, the call is recorded like any other and deleted after 30 days. We don't send promotional messages to children under 14.
11. Security
We use providers under contract, password-protected access, keys kept out of the code, your number hidden from the chat AI, and automatic deletion of the chat memory (72 hours) and of calls (30 days).
12. Changes
If we change anything important, we will publish it here with its date and, if needed, let you know.