Privacy policy

1. Who is responsible for your data

HydraGroup LLC, with registered address at 1209 Mountain Road Place Northeast, Ste N, Albuquerque NM 87110, US, is the controller of the personal data collected through Crysea (the web panel and the assistant that replies on WhatsApp). For any privacy matter you can write to us at privacidad@crysea.app.

2. Two groups of people, two relationships

Crysea handles data about two distinct groups:

• The business using Crysea (the account holder): our direct customer, whose data we process to provide the service.
• The business's clients, who write to the business's WhatsApp: the business is the controller of their data and we process it on its behalf, on its instructions and only to book and manage appointments.

3. What data we collect

From the business: name, email, phone, details of the establishment, services, hours and scheduling rules, and the details of the WhatsApp Business account it connects.

• From people who write to the business: the name they give in the conversation, their WhatsApp phone number, message content, address when the appointment is on location, appointment history, and any notes or tags the business adds.
• Minimal technical data about use of the panel: access date and time, device type and error logs, to keep the service running and secure.

4. What we use it for

We use the data only to:

• Reply to messages, offer available times, and create, reschedule and cancel appointments.
• Send appointment reminders to the WhatsApp number the booking came from.
• Show the business its calendar, conversations and client history.
• Operate, debug and improve the service, and meet legal or accounting obligations.
• We do not sell personal data, do not share it with third parties for commercial purposes, and do not use it for advertising or for profiling beyond scheduling.

5. Legal basis

We process the business's data to perform the service contract. Data about people who write is processed on the business's behalf, on the legitimate interest of responding to a request that the person started by writing, and with consent where applicable law requires it. The business is responsible for telling its clients that its WhatsApp and calendar are supported by an external service.

6. WhatsApp and other providers

The service runs on Meta Platforms, Inc.'s WhatsApp Business Platform; messages travel through its infrastructure and are also subject to Meta's and WhatsApp's policies. We also use cloud hosting, database and language-model providers to generate the assistant's replies. All act as processors, under contract, instructed not to use the data for their own purposes or to train models.

7. International transfers

Our providers may store or process information on servers outside your country, including in the United States. In those cases we apply contractual clauses and safeguards requiring protection equivalent to that of your local law.

8. How long we keep it

We keep data while the account is active. If the account is closed, we delete or anonymise the data within a maximum of 90 days, except what we must retain for legal, accounting or claim-handling reasons. A specific client’s conversations and appointments are deleted sooner if the business or the client herself asks.

9. Security

Information travels encrypted (TLS) and is stored on servers with restricted access. Each business sees only its own data. Internal access is limited to the people who need it to operate or provide support, and is logged.

10. Your rights

You can request access to your data, its correction, update, deletion, the withdrawal of consent, or portability, by writing to privacidad@crysea.app. We reply within a maximum of 15 business days. If you write from the WhatsApp number you booked with, we will ask for a minimal confirmation that it is you before deleting anything. You can also follow the steps on our data deletion page.

11. Minors

Crysea is not directed at minors and we do not knowingly collect their data. If a business books a minor, it is responsible for having the authorisation of whoever holds parental responsibility.

12. Changes to this policy

If we change this policy we will publish the new version at this same address and update the date in the header. If the change is material, we will notify businesses with an active account by email or in the panel.