# Privacy and consents in the automations

> Which client data the chat assistant, the haircut preview and the automatic messages use, which consents are needed and where they are recorded, how long data is kept and what the salon should know and tell its clients.

Last updated: 23 October 2026. Source: https://narciso.io/en/docs/privacy-e-consensi/

This entry explains **which client data the automations touch** and which consents control them. It does not replace the notice: the text the salon must give to clients is the public page **«Informativa per i clienti del salone»** (Notice for the salon's clients) (path `/legale/informativa-clienti`, see [Legal pages](https://narciso.io/en/docs/pagine-legali/)), which is read-only and should be shown to clients to read. The salon remains responsible for how it handles its clients' data.

## The overview

| What Narciso does | Which data it uses | Consent required | Where it shows |
|---|---|---|---|
| **Registering a client in chat** ([How the assistant recognises or registers a client](https://narciso.io/en/docs/riconoscimento-del-cliente/)) | First name, surname, phone, gender | The "yes" to registration counts as **signing the notice**: consent to data processing, with the date and version of the notice. It does **not** give consent to commercial communications | [Clients](https://narciso.io/en/docs/clienti/): record, consents |
| **Replying in chat** ([The chat assistant](https://narciso.io/en/docs/bot-in-chat/)) | The client's messages and, in order to reply, the data the assistant reads from their record (name, last visit, appointments, card, points, rewards, consents) | No specific consent | The notice, section on the assistant |
| **Voice messages** | The audio, transcribed by an artificial intelligence service. The temporary transcription file is deleted when the job ends | No specific consent | The notice |
| **The assistant's memory** | The summary of past conversations, used to remember the context | No specific consent | Stays until the salon deletes the contact or the record is anonymised |
| **Verification code by SMS** | The number already on the record | None | The number is never shown in full in chat; the code is sent only to the one on the record |
| **Haircut preview** ([Haircut preview (the mirror)](https://narciso.io/en/docs/previsione-taglio/)) | The **face photo**, the detected features, the images and the video | The notice signed when the record was created, **plus** the specific consent to the analysis of the photo, recorded when needed (with the client's own sentence) | Client record, consents |
| **Reminder one hour before** ([Automatic messages to clients](https://narciso.io/en/docs/notifiche-ai-clienti/)) | Name, appointment, services | **Consent to commercial communications** | Client record, «Marketing & Promozioni» (Marketing & Promotions) |
| **Review request** ([Review management](https://narciso.io/en/docs/recensioni/)) | Name, sale | **Consent to commercial communications** | As above |
| **Holiday greetings** ([Birthday, name-day and holiday greetings](https://narciso.io/en/docs/compleanni-e-onomastici/)) | Name, gender | **Consent to commercial communications** | As above |
| **Birthday and name-day greetings** | Name, date of birth | **Not** checked | — |
| **Receipt of the Documento Commerciale** (commercial document) | Sale | None (tax obligation) | — |

> **Warning.** Clients that the assistant registers in chat **do not have consent to commercial communications**: until it is added from the record ([Clients](https://narciso.io/en/docs/clienti/)), they do not receive the reminder, the review request or the holiday greetings. Birthday and name day are sent anyway: the program does not check commercial consent for these two messages. Consider whether to keep the switches on, depending on how you collected the consents.

## External services

The assistant and the automations rely on **third-party services**: artificial intelligence models to understand messages, transcribe voice messages and generate the voice; Google and graphics-processing services for the face analysis and the video; an SMS sending service for the verification code; the messaging channels (Meta, Telegram, mail) to deliver the messages. The database and the uploaded files are on a server in Italy, the files in chat and the backup copies in an area of the European Union; however, some providers also process data outside the EU. The up-to-date list, with the legal basis of each transfer, is in the notice for clients and in the sub-processors page ([Legal pages](https://narciso.io/en/docs/pagine-legali/)); the consequences when a service does not respond are in [External services](https://narciso.io/en/docs/servizi-esterni/).

## How long data is kept

| Data | How long it is kept |
|---|---|
| Client record, appointments, sales, points | As long as the relationship with the salon lasts; accounting documents for at least 10 years |
| Record **deleted** by the salon | It leaves the list and the tax code is erased; the other data stays for **12 months**, then the record is **anonymised** automatically. The salon can anonymise it earlier, at the client's request ([Clients](https://narciso.io/en/docs/clienti/)) |
| Conversations, attachments and voice messages | Until the salon deletes the conversation or the record is anonymised |
| The assistant's memory and archive | They follow the contact: if the contact is deleted, they go with it |
| Photo, features, images and video of the haircut preview | Until the start of the next season ([Haircut preview (the mirror)](https://narciso.io/en/docs/previsione-taglio/)) |

Anonymisation erases name, contacts, tax code, allergies, notes, photo and consents, and deletes the conversations with their attachments, the assistant's memory and the haircut preview analyses.

## Transparency

On the fact of writing with a virtual assistant:

- the assistant **introduces itself as a virtual assistant** if the client asks it; otherwise it does not mention it;
- its messages appear as messages from the salon;
- the public notice **states** that the replies are prepared by an assistant based on artificial intelligence, that the salon can hand the conversation over to a person and that the client can ask for this at any time.

## What to do

| Situation | What to do |
|---|---|
| A client asks not to be contacted any more | Remove «Marketing & Promozioni» from the record: reminders, reviews and holidays stop. Birthday and name day stop only by switching off the switch for everyone |
| A client asks to delete the photo and video of the haircut | Contact support ([Support](https://narciso.io/en/docs/assistenza/)) |
| A client asks for their data to be deleted | Anonymise the record ([Clients](https://narciso.io/en/docs/clienti/)) |
| You want clients to read the notice | Give the link to the public page of the notice; the assistant sends it by itself at registration |
| You have two records for the same client | Merge them ([Merging client records](https://narciso.io/en/docs/unire-clienti/)) |

## Related entries

- [Bots and automations](https://narciso.io/en/docs/bot-e-automazioni/)
- [Legal pages](https://narciso.io/en/docs/pagine-legali/)
- [How the assistant recognises or registers a client](https://narciso.io/en/docs/riconoscimento-del-cliente/)
- [What Narciso stores about channels and how it protects it](https://narciso.io/en/docs/dati-dei-canali/)