Privacy Policy - AraWeb CRM
AraWeb CRM is cloud-based business management software (SaaS) for restaurants and other businesses ("Client Businesses"), which use it to manage their customers, bookings and communications, including through WhatsApp Business. This notice explains how we process personal data and distinguishes two roles:
- AraWeb as data controller for software users (owners and staff of Client Businesses, and the consultants and agencies they authorise) and billing data: sections 1-10;
- AraWeb as data processor on behalf of Client Businesses for their end customers' data (including data exchanged via WhatsApp): section 11.
1. Data controller
Simone Garbuglia, owner of the AraWeb brand
VAT number IT02386250688. Address: Via Morrone 15, 65124 Pescara (PE), Italy
Email: simone@araweb.cloud. Telephone: +39 352 028 4636.
No Data Protection Officer (DPO) has been appointed, as one is not required for the activities carried out.
2. Data processed
- Users' identity and contact details (first name, surname, email, telephone);
- Access to Businesses (at which level, who invited whom, date of last access), including for consultants and agencies working for several Businesses;
- Client Business details (business name, VAT number, address, billing details) and details of agencies that buy licences from AraWeb to give to their clients (billing details, licences purchased and assigned);
- Support requests (name, email, message text and, in an internal note, the Business you are writing about, your access level, the subscription status and the page you wrote from);
- Login credentials (passwords are stored only in hashed form);
- Payment data, handled directly by Stripe: AraWeb neither receives nor stores card numbers;
- Connection to an AI assistant, if enabled by the Business: which app was connected, by which user and when, and the log of operations performed "via AI";
- Identifiers for the WhatsApp Business account, telephone number and message templates connected by the Client Business;
- Technical and log data (IP address, access date and time, operations performed in the software).
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and managing accounts, providing the service and technical support (including through support requests) | Performance of a contract (Article 6(1)(b) GDPR) |
| Connecting the Business's WhatsApp Business account through Meta's Embedded Signup procedure and managing message templates | Performance of a contract (Article 6(1)(b) GDPR) |
| Connecting an AI assistant to your login, at your request | User consent (Article 6(1)(a) GDPR), which can be withdrawn at any time by disconnecting the app from the AI Assistant page |
| Managing subscriptions, payments and billing | Performance of a contract (Article 6(1)(b)) and legal obligations (Article 6(1)(c) GDPR) |
| Service communications (invitations, password resets, notices about expiry dates and service changes) | Performance of a contract (Article 6(1)(b) GDPR) |
| Service security, access and audit logs, prevention of abuse and fraud | The controller's legitimate interest in protecting the service and Client Businesses' data (Article 6(1)(f) GDPR) |
| Compliance with tax and accounting obligations | Legal obligation (Article 6(1)(c) GDPR) |
We do not use users' data for marketing purposes or pass it to third parties for such purposes.
4. Provision of data
Account and billing data are necessary to enter into and perform the contract: without them the service cannot be activated. Connecting WhatsApp Business is optional; without a connection, WhatsApp features are unavailable.
5. Recipients
Data may be disclosed, to the extent necessary, to:
- Hostinger International Ltd. (61 Lordou Vironos Street, 6023 Larnaca, Cyprus), the provider of the hosting infrastructure with servers in Frankfurt (Germany) and of the mailbox that sends service emails (invitations, password resets), acting as a data processor;
- Stripe Payments Europe Ltd., for payment processing;
- Meta Platforms Ireland Ltd., for WhatsApp Business Platform (Cloud API) services, used only when the Business connects its WhatsApp Business account;
- FreeScout (support.araweb.cloud), the software we use to handle support requests, run directly by AraWeb;
- OpenRouter Inc., only if the Business chooses to use the AI assistant through an OpenRouter API key: it forwards requests to the selected artificial intelligence models and receives the data needed to answer them, as described in section 11;
- The AI assistant provider (for example Anthropic or OpenAI), only if the Business enables the connection and you authorise it: it receives the data needed to answer your requests, as described in section 11, under the Business's own relationship with that provider;
- Fiscozen and the accountant, for tax compliance;
- Competent authorities, where required by law.
Data are neither made publicly available nor sold.
6. Transfers outside the EU
The software's data are hosted on servers in the European Union. Some providers (Meta, Stripe, OpenRouter and AI assistant providers) may process data in the United States or other non-EU countries. In such cases, transfers rely on the EU-US adequacy decision (EU-U.S. Data Privacy Framework) for certified providers, or on Standard Contractual Clauses approved by the European Commission. A copy of the safeguards may be requested at the email address in section 1.
7. Retention
- Account data: throughout the contract and for 12 months after termination, then deleted automatically; the account of a person who no longer has access to any Business is deleted after 12 months without logins;
- Billing data: 10 years, as required by Article 2220 of the Italian Civil Code;
- Security and audit logs: 12 months, then deleted automatically;
- Backups: the database is backed up every night and each copy is kept for 14 days; deleted data may therefore remain in backups for up to 14 days, without being used.
7a. Cookies
We use only technical cookies, which do not require consent and are not used to profile you: the login session cookie (12 hours), the cookie that remembers which Business you are working on (1 year) and the cookie that remembers the view you chose for tasks, list or cards (1 year). We do not use analytics, advertising or third-party cookies. You can delete them from your browser: you will just need to log in again.
8. Automated decision-making
AraWeb does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect users.
9. Data subject rights
You may request access to your data, rectification, erasure, restriction of processing and portability, and object to processing based on legitimate interest (Articles 15-21 GDPR), at any time by writing to simone@araweb.cloud. We respond within one month, which may be extended by two months in complex cases.
You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it, Piazza Venezia 11, 00187 Rome).
10. Data deletion and disconnecting WhatsApp
To request deletion of your account and associated data, write to simone@araweb.cloud with the subject "Cancellazione dati" (Data deletion). The request is fulfilled within 30 days, except for data that must be retained by law (e.g. invoices). The Client Business may disconnect its WhatsApp Business account at any time in AraWeb CRM settings or Meta Business Suite; after disconnection AraWeb no longer sends or receives messages on its behalf.
11. Client Businesses' customer data (AraWeb as processor)
Client Businesses use AraWeb CRM to record their end customers' data (e.g. names, contacts, bookings, preferences and, only with explicit consent, allergies or intolerances). For these data, the Business is the data controller, provides its customers with the relevant privacy notice and collects the required consents. AraWeb acts as a data processor under Article 28 GDPR, pursuant to the Data Processing Agreement that the owner of each Business accepts in the software together with the Terms of Service, and processes these data only to provide the service and in accordance with the Business's instructions.
Sub-processors authorised by the Business for these data: Hostinger International Ltd. (Cyprus), for the servers in Frankfurt (Germany) and the service email mailbox; Meta Platforms Ireland Ltd., only if the Business connects its WhatsApp Business account. The up-to-date list is in the Agreement; changes are notified to Businesses 30 days in advance.
Retention: the data of an end customer with no contact for 24 months (visits, appointments, notes, forms or bookings) are anonymised automatically, after a notice to the Business 30 days beforehand. If the Business ends the service, its data remain exportable for 12 months and are then deleted; backups are removed within the following 14 days.
The Business may authorise external consultants or agencies to access its software, at an access level it chooses. These parties process end customers' data on behalf of the Business and according to its instructions; they cannot manage access or delete customer data. An authorised agency may specify which members of its team work on the Business's software, within the access level the Business has granted it. The Business can see at any time who has access, person by person, and can revoke it with immediate effect for one person or for the whole agency; the operations performed remain logged.
The Business may enable the connection to an artificial intelligence assistant (for example Claude by Anthropic or ChatGPT by OpenAI) chosen and contracted by the Business or its staff. It is off until the Business owner turns it on; each user connects their own AI with explicit consent and can disconnect it at any time. On the Business's instructions, AraWeb CRM sends the assistant the data needed to answer the user's requests (contacts, bookings, visits, notes) and logs the changes the assistant makes. Health data and end customers' consents are never sent, and the assistant cannot delete data, export lists or change settings. The assistant provider is not a sub-processor of AraWeb: the relationship with it (terms of use, any data processing agreement, use of conversations for training) is managed by the Business. Every operation remains logged with the label "via AI".
For the upcoming WhatsApp features that the Business will be able to connect:
- Messages (booking confirmations and reminders, form links, promotional communications) are sent from the Business's WhatsApp Business account through Meta's WhatsApp Business Platform;
- Promotional messages are sent only to end customers who have given specific consent for the WhatsApp channel, recorded in the software;
- End customers' replies (e.g. booking confirmations or cancellations) are received by AraWeb CRM only to update the booking in the Business's software;
- Each Business can access only its own data and WhatsApp Business account.
End customers wishing to exercise their rights must contact the Business (restaurant or establishment) with which they have dealt; AraWeb assists the Business in responding to requests.
12. Changes
This notice may be updated. The last updated date appears at the top; we notify users of material changes through the software or by email.