Updated 2026-09-03 · 4 min read
An assistant that answers a salon's WhatsApp sees a lot: who's writing, when, what they want, which photo they send. That's what lets it do the job well. But there's information it must not store, information it must not repeat and information it must never ask for, and the difference between a serious assistant and a dangerous one lies exactly there. Here's the list, with what ClaudIA does in each case.
1. The private notes on the client's record
«Doesn't like a short fringe», «always asks after her dog», «pays late». They're gold for good service, and they're for you. An assistant can use preferences about how somebody likes to be treated to speak naturally; what it can't do is repeat them to the client or mention what you wrote down for the team.
In ClaudIA there are two different things on the record: the preferences, which the assistant uses naturally, and the private notes, which belong to the salon alone and never go into what it replies.
2. Health data
Allergies, pregnancy, the patch test for a dye, medication. They come up in a salon because a service requires them. But they're health data, with extra protection under the GDPR (and the UK GDPR), and a WhatsApp conversation is not the place to keep them.
The right way: the assistant can point out that a service needs a patch test first and offer a booking for it; the allergies and the date of the test are written on the record, from the dashboard and by a person. What an assistant must not do is interrogate anyone about their health over chat or keep health answers in the message history.
3. Cards and money
Never over chat. If you take a deposit, it's taken with a method that doesn't pass through the conversation, such as a bank transfer app, or with a secure payment link from the provider, where the card number goes to the payment provider and not to your program. An assistant that says «send me your card number» is asking for something it can't protect, and putting you in the position of whoever stored it.
4. Photos
A client sends a photo of the look she wants, or of her hair now. It's useful: it points the service in the right direction. What you need to know is how long that photo is kept and where. In ClaudIA, photos and voice notes from conversations are kept for a maximum of 90 days on our systems and then delete themselves; the original message stays in the salon's WhatsApp, which is yours.
And a rule of the trade, not of the law: the assistant gives guidance with your prices from the photo, but doesn't settle a price from a photo. That's decided with the hair in front of you.
5. What you tell one client about another
It sounds obvious and it happens: «What time is Marta's appointment?», asked by somebody who isn't Marta. An assistant must talk to each person only about their own bookings. The same goes for families that share a phone: one record per person, and each one sees their own.
6. What gets used for training
It's the question worth putting to any provider: are my clients' chats used to train the model? The right answer is no, and in writing. In ClaudIA, businesses' data is not used to train artificial intelligence models, ours or anybody else's, it isn't sold, it isn't passed on and it isn't mixed between different businesses. It's in the privacy policy and in the data processing agreement signed at the start.
7. Messages to people who didn't ask for them
Whoever you bring in from your phone contacts or from another program hasn't given you permission to send them promotions. The law is clear on that, and a serious assistant handles it on its own: anyone who arrives by import gets no marketing message until that person writes to you or you create a booking for them. Reminders for their own appointments, yes, because that's service.
How to tell whether your provider does it right
Three questions are enough. Where is the data and under what contract? (European Union and a data processing agreement, with the list of companies involved.) Is it used for training? (No, in writing.) Can I take it with me? (Yes, from the dashboard, with no lock-in.) A provider that answers all three without searching the web has thought it through. One that can't, hasn't, and the data belongs to your clients.