Privacy Policy
This policy explains how Resaluxia processes personal data in connection with the service you use as a client: the Resaluxia booking assistant on WhatsApp. It is addressed to you, a passenger-transport professional (an independent private-hire driver, a private-hire operator or a ride-booking centre), and covers two levels: your own data as a Resaluxia client, and the data of your customers (the passengers) that passes through the assistant.
1. Who we are and who this policy is for
Resaluxia develops and operates an automated booking assistant running on WhatsApp, offered as a service to passenger-transport professionals. This policy is addressed to Resaluxia's clients: the independent private-hire drivers, private-hire operators and ride-booking centres that use the assistant to manage their bookings. For any question: [email protected].
2. Roles: who is responsible for what
Two levels of data coexist, with distinct roles within the meaning of the GDPR and the LGPD:
- Your data as a client (your account, contact details, billing, login credentials): Resaluxia is the data controller.
- Your customers' data, the passengers, that passes through the assistant (name, number, trip details, etc.): you are the data controller, and Resaluxia acts as your processor. Resaluxia processes this data only to provide the service to you, according to your use and instructions, and never on its own account.
For any question about your data or to exercise your rights: [email protected].
3. What data is processed
About you (as a client): your identification and business information, contact details, login credentials, subscription and billing data, and service usage and cost metrics.
About your customers (via the assistant): their name, WhatsApp phone number, WhatsApp profile name, WhatsApp username if they have one, and the technical code WhatsApp assigns to each customer's account for your business, trip details (pickup and drop-off locations, date and time, number of passengers, luggage, flight number where applicable, whether children will travel), data required to finalize a booking (e-mail address, tax identification number where required — for example the CPF — and the name to display on the welcome sign), the conversation content, and technical metadata necessary for delivery.
4. The purposes
Your data is used to provide and operate the platform, manage your account, handle billing and support, ensure security and improve the service.
Your customers' data is processed, on your behalf, to receive and qualify ride requests, provide an estimate based on your rate schedule, communicate about the booking and enable you to deliver the service.
The assistant may also send follow-up messages tied to an ongoing request, such as a reminder about an unanswered quote or a courtesy message after a ride; recipients can object at any time by replying STOP.
5. Legal bases
For your data: performance of the service contract between us (Art. 6(1)(b) GDPR), our legitimate interest in securing and improving the service (Art. 6(1)(f)), and compliance with our legal obligations, in particular accounting (Art. 6(1)(c)).
For your customers' data: Resaluxia processes it solely on your behalf and on your instructions. As the data controller, it is you who determine the legal basis applicable to this data (generally the performance of pre-contractual measures and of the transport contract) and who are accountable for it.
6. What Resaluxia does not see
Protection of your customers' data is built into the design of the service:
- Isolation: each Resaluxia client accesses only their own data; accounts are isolated from one another.
- Anonymised oversight: when Resaluxia consults a conversation for supervision or support, the content is automatically anonymised. Names, phone numbers, e-mails, postal addresses and accommodation names are replaced by markers. Your customers' real identifying data does not leave the server toward Resaluxia.
- Minimised logs: in normal operation, technical logs do not record message contents and mask phone numbers.
As a result, the complete, unmasked data of your customers is accessible only to you, in your interface.
7. Use of an automated assistant
The conversation is handled by an automated assistant based on artificial-intelligence technology, which qualifies the request and provides an estimate drawn from a predefined rate schedule. This assistant does not make decisions producing legal effects or similarly significantly affecting a person on a solely automated basis, within the meaning of Article 22 GDPR: committing to and delivering the service is your responsibility as a human, and you can take over the conversation at any time.
8. Sub-processors
To provide the service, Resaluxia uses sub-processors, which act under its responsibility:
- Meta Platforms Ireland Ltd, which provides the WhatsApp messaging channel; your use and that of your customers are also subject to Meta's privacy policy.
- Railway, the application and database hosting provider.
- Anthropic, the artificial-intelligence technology provider: message content is processed to generate the assistant's responses and, under this provider's terms, is not used to train its models.
- Cloudflare, the network and security provider: service traffic (including messages in transit) passes through its proxy and protection infrastructure.
- OVHcloud, hosting of the contact e-mail service (European Union).
- Brevo (France), routing of the platform's transactional e-mails (login links and notifications); data hosted in the European Union.
- Browser notification services (Google, Apple or Mozilla, depending on the operator's device): used solely to deliver dashboard notifications to the operator; no message or passenger data is ever included.
Data is never sold.
9. Transfers outside the European Union
Some sub-processors (in particular Anthropic and Railway) are established outside the European Union, notably in the United States. These transfers are governed by appropriate safeguards within the meaning of the GDPR, such as the European Commission's Standard Contractual Clauses and/or an applicable adequacy mechanism.
10. Retention periods
Your account and billing data is kept for the duration of our relationship, then for the applicable statutory periods, in particular accounting. Your customers' data is kept for as long as necessary for the service; as the data controller of this data, you set the exact periods in compliance with your obligations. Deletion may be requested at any time, subject to the periods required by law. By default, closed conversations are automatically erased from the platform 24 months after their last update (messages, reservations and associated metrics). The public site only keeps, in your browser, the language you chose, so it doesn't have to ask again on every page: it is a technical preference, not a tracker, and clearing your browser data removes it. This erasure only concerns data hosted by Resaluxia. The conversations in your WhatsApp app are not affected: Resaluxia never deletes anything on WhatsApp.
11. Your rights and those of your customers
If you are a natural person (independent driver), you have, over your own data, the rights of access, rectification, erasure, restriction, portability and objection, as well as the right to withdraw your consent where processing is based on it. To exercise them: [email protected].
Regarding your customers' data, it is you, as the data controller, who receive and handle their requests; Resaluxia assists you in its capacity as processor. It is also your responsibility to inform your own customers about the processing of their data.
In the event of a dispute, a complaint may be lodged with a supervisory authority: in France, the CNIL (www.cnil.fr); in Brazil, the ANPD (www.gov.br/anpd).
12. Security
Exchanges on WhatsApp benefit from the encryption provided by that service while in transit. Data is then processed and stored with appropriate technical and organizational measures: encrypted transmission (HTTPS/TLS), access restricted to authorized persons only through authentication, hosting with access controls, and the anonymisation and minimisation measures described in section 6.
13. Minors
The service is intended for professionals and for adult passengers. It is not directed at children and does not knowingly collect their data. The possible presence of children on a trip may be indicated in order to arrange the vehicle and seats, without collecting any identifying data about them.
14. Changes to this policy
This policy may be updated to reflect changes to the service or to applicable regulations. The date of the latest update appears at the top of the page.
15. Contact
For any question regarding this policy or the processing of your data: [email protected].