Privacy Policy

1. Who We Are and Our Roles

This Privacy Policy explains how Apolaris AI ("Apolaris AI", "we", "us" or "our") collects, uses, shares and protects personal data in connection with our marketing website at apolaris.net and our software-as-a-service platform, including the application at app.apolaris.net, the staff portal at portal.apolaris.net, our documentation site at docs.apolaris.net, and our support site at support.apolaris.net (together, the "Services").

The registered entity operating the Services is: APOLARIS AI S.L., Tax ID (NIF) B05659628, C/Ana Maria 33, 33209 Gijon, Asturias, Spain. Apolaris AI is provided by Apolaris AI S.L., a company established in Spain, and the Services are offered from Spain to customers in the European Union, Mexico and other markets. This policy and the platform interface are available in English, Spanish and French.

Apolaris AI acts in two distinct capacities depending on the data involved:

• As a data controller (responsable, in Mexico): for personal data we determine the purposes and means of processing for. This includes data about visitors to our marketing website, sales leads and prospects, and the account and contact data of the business customers who subscribe to our platform.
• As a data processor (encargado, in Mexico): for the personal data that our business customers (each a "Customer") load into, generate within, or manage through the platform — for example, their own clients' booking and purchase records, their employees' HR and payroll records, messaging content and camera events. In these cases the Customer is the controller and determines why and how the data is processed; we process it on the Customer's documented instructions under our customer agreement and a data processing addendum.

Where Apolaris AI acts as a processor, the relevant Customer's own privacy notice governs how that data is used. This policy describes our own practices and the safeguards we apply across the Services.

2. The Personal Data We Collect

The categories of personal data we handle depend on how you interact with us.

2.1 Website visitors

• Technical and usage data: IP address, device and browser type, pages viewed, referring URL, approximate location derived from IP, and interaction events.
• Information you submit through forms, including the contents of contact or demo requests.
• Cookie and similar-technology identifiers, as described in Section 4.

2.2 Sales leads and prospects

• Name, business name, email address, telephone number, role, country and any other details you provide when you request a demo, sign up for a trial, contact sales, or subscribe to communications.
• Records of our communications and the status of your enquiry.

2.3 Our business customers and their authorized users (controller data)

• Account and identity data: names, work email addresses, telephone numbers, job role, login credentials, two-factor authentication settings and API tokens.
• Passkey (biometric sign-in) credentials, where a user chooses to enable passwordless sign-in. We store only a public-key credential and related technical metadata (a credential identifier, the public key, a device type and an optional label). The biometric itself — your fingerprint, facial scan or device PIN — is captured and verified locally by your own device and is never transmitted to, accessible by, or stored by Apolaris AI. We do not collect, process or hold biometric data through this feature; we receive only the cryptographic public key needed to verify future sign-ins. (Biometric processing in the separate AI security-camera module is addressed in Sections 2.5 and 10.)
• Subscription, billing and payment metadata (we do not store full card numbers — see Section 5).
• If you register or sign in with Google, the name and email address that Google confirms to us.
• If you create your account yourself: the campaign or ad that brought you (link parameters). If you accept advertising cookies, also your IP address, your browser and those cookies' identifiers, which we use to tell the ad platform that a sign-up or purchase took place. Your email address is sent to Meta only as an irreversible hash. See the Cookie Policy.
• Configuration, audit-log and support-interaction records associated with the account.
• API tokens issued to authorized users for token-authenticated REST API access, which are treated as sensitive credentials.

2.4 Our customers' end-customers (processor data)

When a Customer uses the platform, it may upload or generate personal data about its own clients, including:

• Names and contact details (email, phone, address).
• Appointment, booking and calendar history; point-of-sale and purchase history; loyalty-program membership and activity.
• Loyalty program data: enrollment status, loyalty card number, points ledger, tier, and stamp balance.
• WhatsApp, SMS and other messaging content exchanged through the omnichannel contact center, including interactions handled by the AI booking agent and messages sent through customer-journey marketing automations, together with the related opt-out preferences (for example, STOP-word suppression lists).
• Call recordings and transcripts of telephone calls handled through the voice-telephony module — including conversations with the AI voice agent — together with call metadata such as numbers, times and durations.
• Content of the Customer's public website created with the website-builder module, and the enquiries, form submissions and booking requests that visitors send through that website or through online booking pages.
• Contact records created automatically from inbound contact-center conversations: when a person messages the Customer's connected WhatsApp number, the platform may create a client record identified by that phone number and complete it with the name, email, birthday or address that the person states in the conversation.
• AI-derived customer memory: durable, AI-generated notes summarizing a client's stated preferences and facts (for example a preferred service, staff member or constraint), retained per client to personalize the AI booking agent across conversations. These notes are generated from the conversation content and the Customer's own records.
• Notes and preferences recorded by the Customer.

2.5 Employees and HR data (processor data)

Where a Customer uses the HR, payroll, attendance and camera modules, the platform may process personal data about that Customer's workforce, including:

• Identity and employment details, compensation and payroll data, leave and scheduling records.
• Attendance and people-counting events, which may be derived from the AI security camera / computer-vision module (event detection, people counting and attendance).
• Optional camera footage and detected events configured by the Customer.

Where a Customer enables the camera / CCTV video-analytics module at its premises, the platform processes the video footage and derived events (such as arrival detection and incident clips) as a processor on that Customer's behalf, and applies short retention windows to footage and clips. The Customer, as controller, is responsible for the lawfulness of video surveillance at its premises, including the signage and information notices required by applicable law.

2.6 AI prompts and queries

When you or a Customer's users interact with the AI copilot, the AI booking agent, the analytics/data explorer, or other AI features, we process the prompts, queries and the contextual platform data needed to generate a response. This processing also covers the AI automation builder, including automation definitions and alarm conditions; automations may trigger outbound emails, contact-center messages, or webhooks to external systems specified by the Customer, subject to manager approval.

2.7 Location and competitor-intelligence data

Where a Customer's manager uses the competitor-analysis feature, the platform derives the geographic coordinates of the Customer's own sites (geocoded from the site addresses the Customer has entered) and queries public map data to discover nearby businesses of the same type. The map and business listings come from public sources — by default OpenStreetMap (via its Nominatim geocoding and Overpass query services) and, if the platform operator has enabled it, the Google Places API. Only site locations and search parameters are sent to these services; no client, employee or messaging data is shared with them. The businesses returned are public commercial listings; the resulting competitor records, together with the Customer's own performance figures, are used to produce an AI-generated action plan for the Customer.

2.8 Health data in the Consents & Clinic History module (processor data)

Where a Customer enables the optional Consents & Clinic History module, the platform processes health data about that Customer's clients on the Customer's behalf: signed consent documents (together with electronic-signature evidence such as IP address, device information and timestamps), clinical and treatment history, allergies and medications, treatment notes, patch-test results and clinical photographs. This is special-category data under Article 9 GDPR; the safeguards and retention rules that apply to it are described in Section 11.

3. Purposes and Legal Bases

For data where Apolaris AI is the controller, we rely on the following legal bases under Article 6 of the EU General Data Protection Regulation (GDPR). For data subjects in Mexico, the corresponding processing is carried out under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and is described in our aviso de privacidad; we indicate below which purposes require your consent in Mexico.

Purpose	GDPR legal basis	Mexico (LFPDPPP)
Providing, operating and securing the Services and accounts	Performance of a contract (Art. 6(1)(b))	Necessary for the contractual relationship — no separate consent required
Responding to sales enquiries and managing leads	Legitimate interests / pre-contractual steps (Art. 6(1)(f) / (b))	Necessary for the relationship requested
Billing, payment processing and fraud prevention	Contract and legal obligation (Art. 6(1)(b) and (c))	Necessary; tax/legal retention applies
Service-related and transactional communications	Contract / legitimate interests (Art. 6(1)(b) / (f))	Necessary for the relationship
Marketing emails, newsletters and prospecting	Consent or legitimate interests (Art. 6(1)(a) / (f))	Requires consent for marketing to leads/prospects
Non-essential cookies and analytics	Consent (Art. 6(1)(a))	Requires consent
Measuring our advertising campaigns (advertising cookies and reports of sign-ups and purchases to ad platforms)	Consent (Art. 6(1)(a))	Requires consent
Improving and developing the Services	Legitimate interests (Art. 6(1)(f))	Compatible secondary purpose; opt-out available
Complying with legal, tax and regulatory obligations	Legal obligation (Art. 6(1)(c))	Required by law

Where we rely on legitimate interests, we balance those interests against your rights and freedoms. You may object at any time (see Section 9). In Mexico, processing for the secondary purposes marked above as requiring consent will not occur if you withhold or withdraw it, and you may always exercise your right of opposition.

For processor data (Sections 2.4 and 2.5), the legal basis and any required consent are determined by the relevant Customer as controller; we process such data only on that Customer's instructions.

4. Cookies and Similar Technologies

Our marketing website and platform use cookies and similar technologies. Strictly necessary technologies (for example, those that keep you signed in and maintain your tenant context) operate without consent. Non-essential technologies, such as analytics, preference and advertising cookies, are set only where required consent has been given, consistent with the EU ePrivacy rules and Mexican law.

Our sign-in protection uses an offline arithmetic challenge, a honeypot field and failed-attempt throttling, and does not rely on any third-party CAPTCHA, CDN tracker or similar third-party profiling technology.

For full details of the cookies we use, their purposes and durations, and how to manage your preferences, please see our separate Cookie Policy.

5. How We Share Data and Our Sub-Processors

We do not sell personal data. We share personal data only as needed to operate the Services and as described below.

• Sub-processors and service providers: we engage trusted vendors that process personal data on our behalf under contractual confidentiality and data-protection obligations.
• Within a Customer's tenant: the authorized users of a Customer account can access the data within that tenant according to role-based permissions configured by the Customer.
• Legal and safety reasons: where required to comply with law, respond to lawful requests, enforce our agreements, or protect the rights, safety and security of Apolaris AI, our users or the public.
• Corporate transactions: in connection with a merger, acquisition or sale of assets, subject to this policy and applicable law.

For payment card transactions, card data is collected and processed directly by our payment providers; Apolaris AI does not store full card numbers and handles only payment metadata such as transaction status and references.

Our current categories of sub-processors and third parties are:

Provider	Purpose
Stripe; PayPal; Mercado Pago	Payment processing
Telnyx	Voice telephony carrier (phone numbers, calls and SIP trunking) for the voice module, including the AI voice agent, call recording and transcription
Meta Platforms (WhatsApp Business, via the WhatsApp Cloud API or a WAHA gateway)	WhatsApp messaging and the omnichannel contact center
AI infrastructure operated by or for Apolaris AI, currently located in Spain (self-hosted language, vision, speech-to-text and text-to-speech models)	AI copilot, AI agents for messaging and voice, and other AI features; customer personal data is not sent to third-party AI cloud services
OpenStreetMap (Nominatim and Overpass)	Geocoding site addresses and discovering nearby businesses for the competitor-analysis feature (default map data source)
Google Places API (optional)	Alternative competitor-discovery data source, used only where the platform operator enables it
Google (Sign in with Google)	Registration and sign-in with a Google account, when the user chooses it
Google Ads; Meta Platforms; OpenAI (ChatGPT ads)	Measuring our advertising campaigns, only if the visitor accepts advertising cookies. These providers may process that data under their own policies
Cloudflare	DNS, network, CDN, WAF/DDoS protection and secure tunnel
OVHcloud (OVH SAS, France)	SMS carrier (notifications, reminders and two-factor authentication codes); email hosting and relay for transactional, notification and support email; domain-name registration for tenant websites; EU edge server for network failover
Tailscale	Private encrypted network between our own servers (end-to-end-encrypted traffic only)
Browser push services (Google, Apple or Mozilla, depending on the user's browser)	Delivery of the encrypted push notifications users opt into

The platform, its databases, uploaded files, AI models and backups are hosted on servers owned and operated by Apolaris AI in Spain (European Union); no public-cloud hosting provider processes personal data. Where a Customer connects its own account with a third-party service — for example its own SMS or telephony carrier account, its own Meta WhatsApp Business account, its own email relay or payment account, or a third-party scheduling or marketplace tool it synchronises with the platform — that provider acts for the Customer under the Customer's own agreement with it and is not a sub-processor of Apolaris AI.

Self-hosting the platform on a customer's own infrastructure is offered only to large enterprise customers and is subject to review and approval. Where an enterprise Customer is approved to self-host, that Customer controls its hosting environment, and some of the cloud-hosting and network arrangements above may not apply. Approved enterprise Customers may also use self-hosted AI models so that AI features operate without sending data to an external model provider.

6. International Data Transfers

Apolaris AI is established in Spain and provides the Services from Spain to the European Union, Mexico and other markets, and some of our sub-processors operate in other countries, including within and outside the EU/EEA. As a result, personal data may be transferred to and processed in jurisdictions other than your own.

Where we transfer personal data from the EU/EEA to a country that has not received an adequacy decision, we rely on appropriate safeguards, principally the European Commission's Standard Contractual Clauses, together with supplementary measures where needed. For transfers subject to Mexican law, we apply the protections required by the LFPDPPP and ensure that recipients assume the obligations applicable to the transferred data. You may request more information about these safeguards using the contact details in Section 13.

7. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy, after which it is deleted or anonymized.

• Account and contractual data: for the duration of the customer relationship and thereafter as needed to meet legal, tax and accounting obligations.
• Sales-lead data: until the enquiry is resolved or, for marketing, until you withdraw consent or object.
• Website and cookie data: for the periods set out in our Cookie Policy.
• Processor data (Customer content, including end-customer, HR, messaging and camera data): retained for as long as the Customer maintains it in the platform and according to the Customer's instructions and retention settings. On termination of a Customer's subscription, we delete or return such data within the period set out in our customer agreement, subject to legal retention requirements.

8. Security Measures

We maintain technical and organizational measures designed to protect personal data, including:

• Encryption of data in transit.
• Strict per-tenant data isolation so that each Customer's data is logically separated.
• Role-based access control with an activity audit log.
• Hardened sign-in (offline arithmetic challenge, honeypot, and failed-attempt throttling) without third-party CAPTCHA or CDN trackers.
• Optional two-factor authentication for accounts.
• Optional passwordless sign-in with passkeys (WebAuthn), which are phishing-resistant and where the biometric or device PIN is verified on the user's own device — only a public key reaches our servers, never biometric data.

No method of transmission or storage is completely secure, but we work to protect personal data against unauthorized access, alteration, disclosure or destruction, and we maintain procedures to address suspected data breaches in line with applicable law.

9. Your Rights and How to Exercise Them

Depending on where you live and the applicable law, you have rights over your personal data.

Under the GDPR (EU/EEA users), you may request access to your data; rectification of inaccurate data; erasure ("right to be forgotten"); restriction of processing; data portability; and you may object to processing based on legitimate interests or used for direct marketing. Where processing is based on consent, you may withdraw it at any time without affecting prior processing.

Under Mexico's LFPDPPP, you have the ARCO rights: Acceso (access), Rectificación (rectification), Cancelación (cancellation/deletion) and Oposición (opposition to processing). You may also withdraw your consent and limit the use or disclosure of your data, where applicable.

To exercise any of these rights, contact us at [email protected]. We may need to verify your identity before acting on a request, and we will respond within the time limits set by applicable law.

If your personal data is held in the platform by one of our Customers (where we act as a processor), please direct your request to that Customer as the controller; we will assist them in responding as required. For records held in the Consents & Clinic History module, statutory clinical-record retention periods may limit erasure, as described in Section 11.

10. Automated Decision-Making and Artificial Intelligence

Several features of the Services use artificial intelligence, including the AI copilot, the AI booking agent in the WhatsApp contact center, AI-assisted analytics, and the AI security camera / computer-vision module.

In line with EU AI Act Article 50 transparency requirements, we make clear when you are interacting with an AI system. The AI chatbot and booking agent are automated systems, not human agents; when you communicate with them you are interacting with software. Where camera modules include any biometric or emotion-related detection features, their operation is disclosed and is configured and controlled by the relevant Customer as controller. This camera-based processing is separate from biometric sign-in (passkeys): passkey authentication verifies a fingerprint, face or PIN entirely on the user's own device and involves no biometric data being collected or processed by Apolaris AI (see Sections 2.3 and 8).

As required by Mexico's LFPDPPP and the GDPR, we explain the role of automated processing: the AI booking agent can read availability and create or modify bookings based on the conversation, and AI features may generate suggestions, summaries and insights. These functions support, rather than replace, human oversight. Routine appointment booking by the AI agent is automated for convenience; however, decisions that would produce legal or similarly significant effects are not made solely by automated means without human involvement, and you may request human review of, express your point of view on, or contest such a decision by contacting [email protected]. AI prompts and outputs are processed to deliver the relevant feature and, where self-hosted models are used by a Customer, may be processed without transmission to an external model provider.

AI features — including the AI agents that answer WhatsApp and other messages in the contact center, the AI voice agent that answers telephone calls (with call recording and transcription used to deliver the feature), and the copilot that assists the Customer's staff — run on AI infrastructure operated by or for APOLARIS AI S.L., Tax ID (NIF) B05659628, C/Ana Maria 33, 33209 Gijon, Asturias, Spain using self-hosted models. Customer personal data processed by these features is not sent to third-party AI cloud services, and we do not use customer personal data to train AI models without a separate agreement.

11. Health Data and the Consents & Clinic History Module

The optional Consents & Clinic History module lets a Customer (typically a salon or clinic) collect signed consent documents from its clients and keep a clinical and treatment history — allergies, medications, treatment notes, patch tests and clinical photographs. This information is health data, a special category of personal data under Article 9 GDPR. APOLARIS AI S.L., Tax ID (NIF) B05659628, C/Ana Maria 33, 33209 Gijon, Asturias, Spain processes this data strictly as a processor, on behalf and on the documented instructions of the Customer, which is the controller.

The legal bases for this processing are established by the Customer as controller. The module is designed around the client's explicit consent (Article 9(2)(a) GDPR), captured as a signed consent document, and — where the Customer provides health or care services — the provision-of-care basis of Article 9(2)(h) GDPR.

Consents are signed with a simple electronic signature captured on screen, via QR code or through a remote signing link. Each signed document is sealed as a PDF with a SHA-256 hash fingerprint and stored together with signature evidence (IP address, device information and timestamps), so the Customer can demonstrate who signed, what was signed and when.

We apply reinforced safeguards to this module: clinical files are encrypted at rest with a dedicated key; access is restricted by the per-employee privileges configured by the Customer; and access and changes are recorded in an audit trail.

Retention is governed by statutory clinical-record law — in Spain, Law 41/2002 requires clinical documentation to be kept for at least five years, and in Mexico, NOM-004-SSA3-2012 requires five years. To the extent such laws apply, they override an erasure request (Article 17(3)(b) GDPR): if a client asks for their account or record to be erased, the signed consent documents and the clinical entries subject to statutory retention are kept for the legally required period with the link to the client's profile pseudonymized, and are deleted once that period expires.

12. Children's Data

The Services are intended for businesses and their authorized users and are not directed to children. We do not knowingly collect personal data directly from children through our marketing website or sales channels. Where a Customer's use of the platform involves personal data relating to minors (for example, an end-customer who is a minor), the Customer is responsible as controller for obtaining any consent required by law. If we become aware that we have inadvertently collected a child's personal data without an appropriate legal basis, we will delete it.

13. Changes to This Policy, Contact and Complaints

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date shown with this document and, where appropriate, notify you through the Services or by email. The version published on apolaris.net is the current one.

For any questions about this policy or to exercise your rights, contact us at [email protected]. The entity responsible for the processing described here is APOLARIS AI S.L., Tax ID (NIF) B05659628, C/Ana Maria 33, 33209 Gijon, Asturias, Spain.

If you are in the EU/EEA, you retain all of your GDPR rights and may lodge a complaint with your local data protection supervisory authority or, as Apolaris AI is established in Spain, with the Spanish Agencia Española de Protección de Datos (AEPD). If you are in Mexico, you may contact the National Institute for Transparency, Access to Information and Personal Data Protection (INAI) regarding the handling of your personal data. We encourage you to contact us first so that we can address your concerns.