Privacy Policy — Pluto.AI

Last updated: August 12, 2026

Pluto.AI (published by WeMake, a SASU with share capital of €1,001, SIREN 934 421 629 (RCS Lille Métropole), 9 bis rue du Général Douay, Appt B251, 59200 Tourcoing, France, hereinafter "Pluto.AI", "we") publishes an automated conversational assistant (artificial intelligence) enabling client businesses (hereinafter the "Business") to respond to their end customers' requests and manage their bookings via WhatsApp.

1. Who does what

The Business (e.g. a spa, a hotel) is responsible for processing its end customers' data. Pluto.AI acts as a data processor within the meaning of the GDPR, on behalf of the Business, in the context of providing the conversational assistant service.

2. Data collected

• The end customer's WhatsApp phone number (provided by WhatsApp at the time of the message, never entered manually);
• The content of messages exchanged with the assistant;
• The booking information provided (name, date, time, requested service, and any free-text note spontaneously communicated — e.g. a preference or contraindication mentioned).

You are exchanging messages with an automated assistant (artificial intelligence), not a human, in accordance with Article 50 of the European AI Act — this is communicated to you from the very first message.

3. Purpose and legal basis

This data is used solely to respond to your requests and manage your bookings with the Business. If you already have an ongoing booking, the assistant may look it up to avoid asking you again for information you've already provided — only for your own phone number, never for another customer's. Any booking or cancellation generated by the assistant is systematically reviewed by a member of the Business's team before being confirmed. Legal basis: performance of pre-contractual/contractual measures taken at your request (GDPR art. 6.1.b).

4. Data recipients

The data may be processed by:

• Pluto.AI, as technical provider;
• Anthropic (provider of the artificial intelligence model used to generate responses);
• Meta (operator of the WhatsApp Business platform, the messaging channel used);
• The Business's team, for human review of responses and bookings before they are sent.

Some of these recipients may process data outside the European Union. [TO COMPLETE: specify the applicable safeguards — standard contractual clauses or equivalent, based on Anthropic's and Meta's actual contractual terms at launch].

5. Retention period

A conversation is automatically closed after a period of inactivity, after which its messages are permanently deleted and the associated phone number anonymized after [TO COMPLETE if different: 365 days by default] following closure. Data strictly necessary for the accounting management of bookings may be kept longer, in accordance with the Business's legal obligations.

6. Your rights

Under the GDPR, you have the right to access, rectify, erase, restrict, and object to the processing of your data. To exercise these rights, contact: contact@plutoapp-ai.com. See also the dedicated data deletion page.

7. Security

Exchanges are transmitted over HTTPS. Access to internal conversation management tools is protected by authentication and restricted to authorized team members.

8. Contact

WeMake, SASU with share capital of €1,001, SIREN 934 421 629 (RCS Lille Métropole)
9 bis rue du Général Douay, Appt B251, 59200 Tourcoing, France
contact@plutoapp-ai.com