BeautySuite
Hear how it answers

Privacy policy

1. Who processes your data

BeautySuite is a brand of CODELABS STUDIO, S.L., tax ID (NIF) B88708797, with registered office at Pasaje Federico García Lorca, 6, 3º E, 29130 Alhaurín de la Torre (Málaga), España, registered in the Commercial Registry of Málaga (Registro Mercantil de Málaga), sheet MA-198508, 1st entry.

For any question about your personal data you can write to hola@beautysuite.pro. This policy explains what data is processed on beautysuite.pro, in the BeautySuite dashboard and in the assistants that BeautySuite provides to the businesses that subscribe to it, and in which role CODELABS STUDIO, S.L. acts in each case.

Last updated: 2026-10-31. This is a translation; if there is any discrepancy, the Spanish version prevails.

2. What the service is and does

BeautySuite gives hair salons, barbers, beauty centres and aesthetic medicine clinics an artificial intelligence assistant that answers the phone, calls from the website and chat: it answers questions about the services and prices on the menu the business provides and sends the person the booking link of the appointment system the business already uses, by SMS, email or WhatsApp. BeautySuite does not keep the appointment book.

3. Two different roles: controller and processor

  • As controller, CODELABS STUDIO, S.L. decides on the data of people who visit this website, ask for a demo or a call, write to us, and of the staff of client businesses who use the dashboard.
  • As processor (Article 28 of the General Data Protection Regulation, GDPR), CODELABS STUDIO, S.L. processes on behalf of each client business the data of its clients and people who call or write to the business. In that case the controller is the salon, centre or clinic, which decides what the data is used for; we only process it to provide the service and following its instructions.

If you are a customer of a business that uses BeautySuite, exercise your rights with that business. If you write to us, we will forward your request to it without delay.

4. Data we process as controller

  • Visiting the website: IP address and technical connection data logged by the server, and your choice in the cookie banner. The Meta pixel is only loaded if you accept advertising cookies (see the cookie policy).
  • Call request ("call me now"): the phone number you type, the page language and the result of the Cloudflare Turnstile bot check. Before dialling, the number is checked against the Spanish Robinson opt-out list; if it is listed, we only call once you prove the number is yours with a six-digit code we send you by SMS (Spanish numbers only).
  • Voice demo in the browser: the audio from your microphone while you talk to the demo assistant and the transcript of the conversation. It only starts when you press the button and allow the microphone.
  • Contact by email or WhatsApp: your contact details and whatever you tell us.
  • Dashboard users: name, email and the identifier of your account in the Codelabs sign-in system (auth.codelabs.studio), the business you belong to and your role, and a log of the relevant actions you take in the dashboard.
  • Client business data for contracting and invoicing: company name, tax ID, address, contact phone and email, plan and subscription status.

Demo calls and conversations with our assistants are also recorded and transcribed, and the assistant says so at the start.

5. Data we process on behalf of the client business

  • Conversations: audio recording of each call, its transcript, the summary and score shown in the dashboard, and chat messages.
  • Name, phone or email, the service or treatment the person asks about and the channel used to send the booking link.

6. Call recording

Every call answered by the BeautySuite voice assistant is recorded and transcribed. At the start of each call the assistant says that it is an artificial intelligence and that the call is recorded.

The client business can listen to every call in full in its dashboard, with the transcript moving along with the audio. The recording lets the business check what each customer was told, follow up properly on what was asked and resolve any disagreement, for example about a viewing, a booking or a price.

The audio is served to the dashboard through signed links that expire after a few minutes: anyone without access to that dashboard cannot listen to it.

Health data: the assistant is instructed not to ask for health data, not to diagnose or recommend treatments, and to refer any such question to the professional. If a person nevertheless mentions something about their health during a call, it will remain in the recording and the transcript, which the business processes as controller.

7. Purposes and legal bases

  • Handling your request for a demo, a call or information: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).
  • Providing the contracted service, managing the account and giving support: performance of the contract (Article 6(1)(b) GDPR).
  • Invoicing and meeting accounting and tax obligations: legal obligation (Article 6(1)(c) GDPR).
  • Checking the Robinson list before calling: legal obligation under Spanish Law 11/2022 on Telecommunications and data protection law (Article 6(1)(c) GDPR).
  • Recording demo calls and conversations, protecting the website against abuse and bots, and keeping the server's technical logs: legitimate interest in the security of the service and in being able to review what the assistant said (Article 6(1)(f) GDPR).
  • Measuring advertising with the Meta pixel: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time from the cookie settings button in the footer.
  • Data we process on behalf of the business: the legal basis is determined by the salon, centre or clinic as controller. Usually it is handling its customer's own request, consent for saved searches and alerts and, where applicable, a legal obligation.

8. Artificial intelligence

BeautySuite assistants introduce themselves as artificial intelligence at the start of every conversation, as required by Regulation (EU) 2024/1689 on artificial intelligence.

To understand speech, converse and speak, the assistants use language and voice models from the providers listed below. The score of each conversation shown in the dashboard is indicative, to help the business decide whom to attend to first: neither the assistant nor the platform takes decisions with legal effects on anyone.

9. Who the data is shared with

We do not sell personal data or disclose it to third parties for their own purposes. To provide the service we use these providers, under data processing agreements:

  • AgenteUno, the voice and messaging platform of CODELABS STUDIO, S.L. itself (not a third party): it handles calls, chat, recordings and transcripts.
  • Hetzner Online GmbH (Germany): servers for the application, the database and email.
  • Cloudflare, Inc.: DNS, bot check (Turnstile) and storage of recordings.
  • Telnyx and Twilio: telephony for the voice platform.
  • Cerebras Systems Inc. (United States): language model that processes the assistant's chat messages.
  • Google LLC (Gemini Live, United States): voice model that processes the audio and transcript of voice conversations.
  • Meta Platforms: WhatsApp messages, when the business uses that channel, and the advertising pixel on this website, only with your consent.
  • Google LLC: Google Calendar, only if the business connects its calendar. Permissions are limited to creating and deleting viewings and to checking whether a time is free or busy, without reading the content of other events.
  • OpenStreetMap Foundation (United Kingdom): the map on property or accommodation pages, which receives the IP address of whoever views it.

We will also disclose data to the authorities when the law requires us to.

10. International transfers

The main servers are in the European Union. Some of the providers above are based in the United States and may process data outside the European Economic Area. In that case the transfer relies on the adequacy decision for the EU-US Data Privacy Framework, where the provider is certified, or on the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914). The United Kingdom benefits from an adequacy decision of the European Commission.

Language model providers and international transfers. The conversational assistant on this site runs on AgenteUno. Chat messages are processed by Cerebras Systems Inc. (United States) as a processor. In voice conversations, the audio and its transcript are processed by Google LLC (Gemini Live, United States). Google LLC is certified under the EU-US Data Privacy Framework (DPF), so that transfer relies on the European Commission's adequacy decision, and its processor terms also incorporate the standard contractual clauses. Cerebras Systems Inc. is not on the DPF list: the transfer to this provider relies on the standard contractual clauses (Implementing Decision (EU) 2021/914) incorporated into its data processing agreement (DPA).

11. How long data is kept

  • Requests for a demo, a call or information: as long as needed to handle them; afterwards, blocked for the limitation periods of any claims that might arise.
  • Client account and business data: for the term of the contract and then for the periods required by commercial and tax law.
  • Saved searches: 180 days from when they are saved, unless the business sets a different period or the person unsubscribes earlier.
  • Recordings, transcripts and other data of the business's customers: while the business keeps the service and according to its instructions. When the contract ends they are deleted or returned to the business, unless a law requires them to be kept.
  • Cookies: the period stated in the cookie policy.

12. Your rights

You can request access to your data, its rectification or erasure, restriction of processing and portability, object to processing, and withdraw at any time any consent you have given, by writing to hola@beautysuite.pro. If we need to verify your identity we will ask you. We reply within one month.

If you believe we have not handled your request properly, you can complain to the supervisory authority, the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan, 6, 28001 Madrid, www.aepd.es).

13. Security

Communications are encrypted. Each business only accesses its own data, and each dashboard user according to their role. Credentials of connected calendars are stored encrypted and recordings are served through short-lived signed links.

14. Minors and changes to this policy

BeautySuite is a service for businesses and is not aimed at minors.

If we change this policy in a meaningful way, we will show it on this page with the new date and tell client businesses by email.

hola@beautysuite.pro