Privacy policy

1. Who we are

Respio is a software service that lets businesses (for example salons, clinics and studios) answer the messages their customers send on WhatsApp from one inbox, with an AI assistant that answers from the business's own information and booking system and hands the conversation to the business's team when needed.

Respio is operated by SETCODER LIMITED, company number 13290239, registered in England and Wales, registered office 60 Millmead Business Centre, Millmead Road, London, N17 9QU, United Kingdom. Contact: info@respio.io.

2. Our role

• For business users (owners and staff who sign up to Respio) and for visitors of this website, SETCODER LIMITED is the controller.
• For the businesses' customers (people who write to a business on WhatsApp), the business is the controller. SETCODER LIMITED is the processor and handles that data only on the business's instructions.

3. Data we process

• Business users: name, e-mail address, workspace, role and session information, and a log of administrative actions (audit log).
• The businesses' customers: WhatsApp profile name and username, the WhatsApp user ID and, when Meta provides it, the phone number; message content and times; delivery statuses (sent, delivered, read); booking details from the business's booking system (service, date and time, staff, confirmation code); when the customer agrees to be called back, the phone number and preferred time; and the team's internal notes, support tickets and AI-written handoff summaries about the conversation.
• Content uploaded by the business: FAQs, service and price information and similar documents.
• Website contact form: your name, business name, sector, e-mail address, phone number if you give it, and your message.
• Respio does not ask customers for payment details, national ID numbers or special-category data.

4. Purposes and legal bases

• Receiving messages, showing them in the business's inbox and delivering replies on WhatsApp (performance of the contract with the business).
• Letting the AI assistant answer from the business's information, and create, move or cancel bookings or arrange a callback only after the customer's explicit confirmation (performance of the contract; the business's instructions).
• Handing conversations to the business's team, with an AI-written summary for the team (performance of the contract).
• Answering contact-form enquiries (steps at your request before a contract; legitimate interests).
• Security, abuse prevention and debugging (legitimate interests).
• Complying with legal obligations.

Respio does not use personal data for advertising and does not sell it.

5. AI processing

To write replies, the text of customer messages, the customer's name, relevant passages from the business's knowledge base and booking details are sent to Anthropic's Claude model. Phone numbers and e-mail addresses are not sent to the AI. The assistant says it is an AI assistant in its first message and whenever asked, and hands the conversation to a person on request. When the business's team takes over, the AI writes a short summary for the team; the summary is never sent to the customer. Booking changes and callbacks happen only after the customer's explicit confirmation. No automated decision with legal or similarly significant effects is made about anyone.

6. Recipients (sub-processors)

• Meta Platforms (WhatsApp Business Platform): receiving and sending messages.
• Supabase: database, sign-in and file storage, hosted in the EU (Frankfurt).
• Anthropic (Claude): AI replies and summaries, USA.
• Voyage AI: turning the business's documents into search vectors, USA.
• The booking system the business connects (for example Fabula): booking look-ups and actions.
• Vercel: hosting this website. Resend: delivering contact-form e-mails to us.

Transfers outside the UK, the EEA or Turkey rely on the safeguards the UK GDPR, the EU GDPR and KVKK (art. 9) require, such as standard contractual clauses or the UK International Data Transfer Addendum.

7. Retention

• Conversations and messages: according to the business's setting, by default 730 days.
• Message content in raw webhook records: 30 days.
• AI usage records (without message text): for the life of the service.
• Contact-form e-mails: up to 24 months after our last exchange.
• When a business closes its account, its data is deleted within 30 days.

8. Security

Data is encrypted in transit (TLS); booking-system and WhatsApp keys are additionally encrypted at rest. Each business's data is separated at database level (row-level security). Access is role-based and logged.

9. Your rights

Under the UK GDPR, the EU GDPR and KVKK (art. 11) you can ask for access, rectification, erasure, restriction, objection and portability. To delete data, follow the data deletion instructions.

• If you messaged a business that uses Respio: contact that business first; we help it answer you. You can also write to info@respio.io directly.
• If you are a business user or wrote to us through the contact form: write to info@respio.io.

We answer within 30 days. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or, in Turkey, to the Personal Data Protection Authority (kvkk.gov.tr).

10. Cookies

This website sets no cookies and uses no analytics or tracking. The Respio dashboard uses only the cookies needed to keep business users signed in.

11. Changes

We may update this policy. The date at the top shows the latest version; material changes are announced to business users in the dashboard.