Privacy Policy

This Privacy Policy explains how Pavel Rusev Barber Studio ("we", "us") collects, uses and stores information when you interact with our automated booking assistant through Instagram Direct Messages, Facebook Messenger, or our website. We operate in Sofia, Bulgaria.

1. Information we collect

• Message content: the text of the messages you send us via Instagram / Messenger.
• Booking details: name, phone number, service, date and time — only if you provide them to make a booking.
• Instagram / Meta identifiers: the Instagram-scoped User ID that Meta provides automatically when messages are exchanged. We do not collect passwords or email addresses.
• Technical data: message timestamps and minimal technical metadata used for debugging.

2. How we use the information

• To process appointment booking, cancellation and rescheduling requests.
• To answer questions about services, prices, working hours and location.
• To create an event in the barbershop's internal calendar (Google Calendar) when a booking is confirmed.
• To improve the quality of the assistant (anonymous debugging logs).

3. How we use the permissions we request

• instagram_business_basic: to identify the connected Instagram Business account and read basic profile information required to operate the assistant.
• instagram_business_manage_messages: to receive incoming Direct Messages via webhook and send automated replies back to the customer.

4. Who we share information with

We do not sell or share your personal data with third parties for marketing purposes. We share the minimum necessary information only with the following providers:

• Google Calendar API — to store confirmed bookings in the barber's schedule.
• Meta Platforms (Instagram / Messenger) — only to receive and send messages through the official API.
• Mistral AI — message text is processed by an AI model to understand the request and generate a reply.

5. How long we keep the information

• Bookings: stored in Google Calendar until they are no longer relevant (up to 60 days after the appointment).
• Message logs: up to 30 days, then automatically deleted.
• Cancelled / invalid requests: deleted within 7 days.

6. Your rights

In accordance with the GDPR (for users in the EU), you have the right to:

• Request access to the personal data we hold about you.
• Request correction or deletion of that data.
• Withdraw your consent at any time by contacting us.
• File a complaint with the Bulgarian Commission for Personal Data Protection (kzld.bg).

To delete your data, please use our Data Deletion page or contact us directly.

7. Security

We use reasonable technical and organisational measures to protect personal data against unauthorised access, loss or alteration. All API requests to Meta are secured via HTTPS and signed authentication.

8. Children

The service is not directed at persons under 14. When booking a haircut for a child, contact details are provided by a parent or guardian.

9. Changes to this policy

We may update this Policy from time to time. For significant changes, we will announce this through our website or Instagram channel.