Privacy policy
Last updated: 2026-09-04
This policy explains what personal data PaseoClub processes, why, who we share it with and how you can control it. It is written in accordance with Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP).
Pending legal review: the legal entity name and registered tax address of the controller still need to be added.
Who is responsible
PaseoClub is the controller for the data described here. You can write to hola@paseo.club about anything concerning your personal data.
Two kinds of people, two different roles
We process data about two groups and it is worth keeping them apart. First, the people at the business using PaseoClub: owners, front desk and staff. For them we process name, email, phone and their activity inside the platform, and we are the controller. Second, the salon's own clients: for them we process name, phone, email, appointment history and payment history, but on the business's behalf, since the business decides what it is for. Towards those clients the salon is the controller and we are its processor. There is one exception, described in the next section: your client account on the platform.
Your client account: one for the whole platform
If you book online, PaseoClub gives you an account of your own, identified by your phone or email, that works across every business on the platform: from it you see your appointments, purchases and rewards at each place without creating a new account for each one. For that account we are the controller, not the salon. Each business still sees only its own relationship with you — its appointments, its charges and the record it filled in itself; no business sees what you do at another, and we do not use your cross-business activity for advertising or to profile you for third parties.
What we use the data for
To run the appointment book, take payments, issue receipts, send appointment reminders, handle WhatsApp conversations and produce the business's reports. Also to provide support and keep the service secure. We do not sell personal data, nor pass it to third parties for advertising.
WhatsApp: what we receive and what we do with it
When a business connects its number, we receive through Meta's WhatsApp Business Platform the messages its clients send, the phone number of the sender and the name that person has set on their WhatsApp profile. We use it for one thing only: showing the conversation to the business and letting it reply, including an automatic reply when the business turns that on. We do not use the content of those messages for advertising, nor to train artificial intelligence models, nor do we share it with other businesses on the platform.
Google Calendar: what we touch in your Google account
If a business chooses to sync its agenda with Google Calendar, we request a single scope: `calendar.events`, which allows reading and writing events on their primary calendar. Nothing else: we do not request access to the calendar list, Gmail, contacts, or any other data in their account. With that permission we do two things and only two: write the appointments received through PaseoClub into their Google calendar, and read their events so we never offer a time slot they already have booked. We store the calendar identifier, the email address of the connected account, and a refresh token kept encrypted (AES-256-GCM) that never leaves our servers. Google event data is not used for advertising, is not shared with other businesses or third parties, and is not used to train artificial intelligence models. A business can disconnect the sync at any time from its dashboard: doing so deletes the token and removes the appointments we had placed in their Google calendar, and they can also revoke access at any moment from their Google account security settings. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
When the automatic assistant replies
If the business enables automatic replies, the message text and the salon's public details — services, prices and opening hours — are sent to a language model provider to draft the answer. We send the conversation text, never the appointment history, the payments or the client record. The provider does not retain that content to train its models. The business can turn automatic replies off at any time, per number or per conversation.
Who we share it with
Only with providers delivering a necessary service, and only with what that service requires: hosting and database, payment processing, WhatsApp messaging, transactional email, electronic invoicing with the Mexican tax authority, and the language model provider described above. Each processes the data on our instructions. We may also hand over data when a competent authority legally requires it.
How long we keep it
For as long as the business keeps its account active. On closure we delete its data and its clients' data within thirty days, except what the law requires us to keep: tax information about transactions is retained for five years, as Mexican regulation demands. Technical security logs are kept for up to ninety days.
Your ARCO rights
You may request access to your data, its rectification if inaccurate, its cancellation when no longer needed, and object to a specific use. You may also withdraw your consent. Write to hola@paseo.club stating which right you wish to exercise; we answer within twenty working days at most. If you are a salon's client and want your record deleted, the fastest route is to ask the salon directly, since it decides about that data. For what belongs to your platform client account — your identity and its access — ask us at the same address.
Security
Data travels encrypted and is stored on servers with restricted access. Each business is isolated from the others at the database level; the only thing that crosses that boundary is your client account, and only to show you what is yours. Card data never passes through our servers: it is handled directly by certified payment gateways.
Minors
PaseoClub is aimed at businesses and is not intended for minors. If a salon registers a client who is a minor, it is the salon's responsibility to hold the consent of whoever holds parental authority.
Changes to this policy
If we change anything material we announce it inside the platform before it takes effect and update the date above.