Privacy Policy
1. Who we are
Sarwise builds AI assistants for local businesses such as barbershops, salons, restaurants and service companies. The assistants answer customer questions on WhatsApp and manage appointments and reservations. Sarwise is a trade name of BOLBUY, registered with the Dutch Chamber of Commerce (KvK) under number 68734581. Address: Goudplevier 96, 5348 ZG Oss, the Netherlands. Contact: info@sarwise.com.
When you message a business that uses Sarwise, that business is the controller of your personal data and Sarwise acts as its processor under a data processing agreement. For this website and our own demo assistant, Sarwise is the controller.
2. What data we process
- Your phone number and WhatsApp profile name
- The content of the messages you send to the business
- Appointment or reservation details: name, chosen service, date, time and staff member
- Technical logs needed to run and secure the service (for example message IDs and timestamps)
We do not ask for special categories of personal data and we do not use your data for advertising or profiling.
3. Why we process it
To answer your questions, to book, change or cancel appointments, to send reminders, and to hand the conversation over to the business owner when needed. The legal basis is the performance of a contract or steps taken at your request (art. 6(1)(b) GDPR) and the legitimate interest of the business in running its booking service (art. 6(1)(f) GDPR).
4. AI assistant
Replies are generated by an AI model. The assistant always tells you that it is an AI. You can ask to speak to a person at any time and the business owner will take over.
5. Service providers
- Meta Platforms (WhatsApp Business Platform): delivering messages
- Anthropic (Claude API): generating the assistant's replies
- Our automation server (n8n): running the workflows and storing appointments
- Google (Google Calendar): only if the business connects its own calendar
- Hostinger: hosting this website (server logs, including IP addresses)
- Paddle.com (our reseller and Merchant of Record): processing subscription payments, invoicing and sales tax. Paddle receives your payment details directly; we never see your card details.
Some of these providers are based in the United States. Transfers take place on the basis of the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.
6. How long we keep it
Conversation history is kept for at most 30 days and then deleted. Appointments remain available to the business for as long as it needs them for its administration. Reminder logs are kept for at most 90 days.
7. This website
This website does not use cookies, analytics or tracking. Only on the payment page, and only after you click to continue to payment, Paddle's checkout is loaded; Paddle may use cookies that are strictly necessary for the payment and for fraud prevention. Our hosting provider processes technical data such as your IP address in server logs to deliver and secure the website. If you email us, we use your message only to answer you.
8. Business customers
When a business subscribes to Sarwise, we process its business name, country, Chamber of Commerce or VAT number, WhatsApp number, email address, chosen plan and payment status, to manage the account, invoice it and prevent abuse. The legal basis is the performance of the contract and our legitimate interest in preventing fraud (art. 6(1)(b) and (f) GDPR). Account data is deleted 30 days after the subscription ends; unfinished applications after 7 days. Invoices are kept by Paddle for the period required by law. To offer each business one free trial, we keep only an irreversible keyed hash of the registration number, WhatsApp number and email address; it cannot be turned back into the original data.
9. Your rights
You have the right to access, correct or delete your data, to restrict or object to processing, and to data portability. To exercise these rights, email info@sarwise.com with the phone number you used. We respond within 30 days. You may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
10. Changes
We may update this policy. The date at the top shows the latest version.