Privacy policy

Last updated: 02/08/2026

1. Who is the data controller

Leturi is the data controller for the personal data of users of the management dashboard (client businesses) described in this policy, in connection with the Leturi service. For privacy questions you can write to hola@leturi.es.

Leturi is the commercial name under which Aitor Urrutia de Luis, self-employed, NIF 16096650P, operates.

Leturi is software that serves businesses (hair salons, dog grooming salons, physiotherapy clinics and similar, hereafter "client businesses") so they can manage appointments with their own end customers over WhatsApp. It's important to distinguish two roles:

• For the data of the client business (the person or people who use Leturi's dashboard: name, phone number, email, access credentials), Leturi acts as data controller.
• For the data of the business's end customers (the people who message on WhatsApp to book an appointment: name, phone number, appointment history, and where relevant their pet's data), Leturi acts as data processor on behalf of the client business, which decides what data to collect and for what purpose it's used in relation to its own customers.

2. What data we process

Depending on the type of user, we process these categories of data:

• Client business and team data: business name, sector, address, hours, name and phone number of dashboard users, access credentials, and business configuration (services, prices, staff).
• End customer data (via WhatsApp): name, phone number, content of messages written to the assistant, appointment history (service, date, time, status), and, for dog grooming businesses, the pet's name and species. If an end customer sends a voice note, it's automatically transcribed so the request can be understood.
• Calendar data: if the business connects its Google Calendar, we read and create events on the calendar the business itself authorises, solely to reflect its appointments and check availability.
• Technical data: connection logs, IP address and dashboard usage metadata, for security and incident-resolution purposes.

Leturi does not collect payment data (cards, bank accounts) from end customers.

3. Purposes of processing

• Managing the contractual relationship with the client business (sign-up, billing, support).
• Allowing the WhatsApp assistant to understand requests and manage appointments: create, change, cancel and remind.
• Syncing appointments with the calendar the business connects.
• Offering freed-up slots to customers on the waiting list.
• Generating aggregated usage analytics for the business itself (for example, appointments handled per week).
• Maintaining the security of the service and preventing misuse.
• Improving how the conversational assistant works.

4. Legal basis for processing

We process the client business's data for the performance of the service contract. We process end customer data on behalf of the client business, based on the data processing agreement between Leturi and that business, and on the legitimate interest of correctly managing each appointment requested by that person.

5. Who we share data with

To provide the service, Leturi relies on these providers:

• Meta (WhatsApp Business Platform): messages between the business and its customers are transmitted through Meta's WhatsApp Cloud API, subject to Meta's terms.
• Google (Google Calendar API): when a business connects its Google Calendar account, Leturi only accesses the events needed to sync its appointments. Leturi's use of information received from Google APIs complies with the Google API Services User Data Policy , including the Limited Use requirements. Leturi does not use Google Calendar data for advertising, does not sell it, and does not share it with third parties except as strictly necessary to provide appointment-syncing functionality.
• OpenAI: some messages may be processed using OpenAI language models to review the safety of automatic responses before sending them, and to extract appointments from photos of paper diaries when a business uses that optional feature. OpenAI processes this data as a data processor, under its own privacy policy.
• Hosting provider: data is stored on servers managed by Contabo, located in Europe.

We do not sell personal data to third parties or use it for advertising purposes.

6. International transfers

Some of the providers above (Meta, Google, OpenAI) may process data outside the European Economic Area. In those cases, the transfer is covered by the safeguards set out in the GDPR, such as the standard contractual clauses approved by the European Commission or equivalent adequacy mechanisms.

7. How long we keep the data

We keep the client business's data for the duration of the contractual relationship and, afterwards, for the legally required periods (tax, accounting). End customer data is kept for as long as the client business keeps the service active, unless that business requests its deletion earlier.

8. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to hola@leturi.es. If you are an end customer of a business that uses Leturi and want to exercise these rights over your own data, you can contact that business directly (as controller of your data) or contact us, and we will forward the request to the relevant business. You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

9. Security

We apply reasonable technical and organisational measures to protect data: encryption of sensitive credentials and access tokens, per-business access control (one business cannot see another business's data), and key-restricted access to internal services. No system is 100% invulnerable, but we work to reasonably minimise risk.

10. Minors

Leturi is intended for professional use by businesses. We do not intentionally direct the service at minors.

11. Changes to this policy

We may update this policy to reflect legal or service changes. We will publish the date of the last update at the top of this page.

12. Contact

Leturi (Aitor Urrutia de Luis) — Leturi · hola@leturi.es · +34 681 99 82 91 (WhatsApp)

Document reviewed internally based on how the service actually works. For specific legal questions, consult a professional.