Who is responsible?
Rosa ONE is operated by Rosa Group Ltd, company number 09766720, registered in England and Wales. Our registered office is 120a Church Road, Benfleet, Essex, SS7 4EP, United Kingdom. Use our private contact form.
Rosa Group is the controller of information used for its own accounts, subscriptions, enquiries and service security. When a business uses Rosa ONE for its customers and staff, that business normally determines the purposes of those records and Rosa ONE processes them on its behalf. Its own privacy notice also applies. Please contact that business first about your appointment, payment or staff record; we can help direct a request.
What information do we use?
Account and business details: names, email addresses, business contact and address details, language, country, staff roles, verified command-phone numbers, the WhatsApp number you sign in with, if you choose it, the email you give for invoices and notices, and sign-in records.
You sign in with a link we email you or, if you choose, with your WhatsApp number and a 6 digit code. The code is sent from Rosa ONE's own WhatsApp account and delivered by Meta, and it expires after 10 minutes. We keep only a hash of the code, a coded record that does not show it, and delete it when the code is used or replaced, or soon after it expires. An invisible Cloudflare Turnstile check and limits on repeated requests protect this step. Your WhatsApp number stays with your account as a way to sign in until you remove it or your account is deleted. If you sign up with WhatsApp, the email you give is used only for invoices and notices: it is not checked, and it is never a way into your account. We email that address, or your account email, when your account is signed in with WhatsApp and when its sign in number or contact email changes.
You can also choose a password. We keep only a scrypt hash of it, a coded record that cannot be turned back into your password, and we never show, send or share the password itself. Limits on repeated tries and an invisible Cloudflare Turnstile check protect it, and we email you whenever it is added, changed, reset or removed. It is deleted when you remove it or your account is deleted.
Workspace records: information entered or imported by a business, including customer contact details, appointments, services, payment history, stock, expenses and staff-related costs. Record changes can include the person responsible, the time and whether the action came from the dashboard or WhatsApp.
Records from a previous system: when a business moves to Rosa ONE from another system, we can import its records on its instructions, such as customers, appointments, services, payments, stock, expenses, team details and recent message history. The business remains responsible for these records and for telling its customers about the move. Nothing is sent to anyone during an import. A customer's agreement to appointment reminders carries over only where the previous system recorded it, and the business's staff can see where it came from; permission for promotional messages never carries over. The copy of the previous system made for the import is kept only as long as needed to complete and check the import.
Messages and connections: WhatsApp account and phone identifiers, message content, relevant contact information, delivery events, approved templates, authorisation credentials and assistant conversations. We also process support requests and feature suggestions.
Billing and technical information: subscription references and status, transaction information, browser and network information, and security or diagnostic events. Payment-card details entered in Stripe's payment interface are handled by Stripe; Rosa ONE does not store full card numbers.
Information comes from you, authorised colleagues, businesses that hold your records, and the connected providers needed for a feature. Providing sign-in and essential account details is necessary to use the account; optional information can be left out. Please include only information needed for the business task.
Health and other sensitive information: Rosa ONE is not designed for clinical records or other especially sensitive information. Please do not record diagnoses, treatment notes or other health details in Rosa ONE, or send them to Rosa in a message or a voice message; keep them in a system made for that purpose. The appointment details, such as the service booked, are enough for Rosa ONE to work. If a customer sends such details in a message, the business that receives it decides how to handle them.
Why do we use it?
We use information to sign you in, provide your workspace, carry out authorised instructions, organise appointments and business records, deliver requested communications, manage subscriptions and help with support.
For our own account administration, we rely on performing our contract with the account holder. Where the user is acting for a business, and for support, fraud prevention, access controls and service reliability, we rely on our legitimate interests in providing and protecting the service. Financial recordkeeping can also be necessary to comply with legal obligations. Where optional communications require consent, that consent can be withdrawn.
A subscribing business is responsible for its own lawful basis and the permissions needed to use its customer and employee records, including promotional messages. Connecting WhatsApp or reading this notice does not give blanket consent to marketing.
We do not sell personal information or use workspace customer lists for advertising. We do not use the assistant to decide eligibility for employment, credit, insurance or similar significant matters. It helps carry out business tasks under the user's permissions; users should check important results.
How does WhatsApp work?
Staff can link a phone to send commands to the Rosa ONE assistant. We use proof of phone ownership and current workspace permissions to decide which business and actions that person can access.
A business can separately connect its customer-facing WhatsApp number. Messages, replies and delivery information received through that connection are processed for that business. Automated reminders and other enabled messages use the connected business account.
Meta receives and processes information needed to provide WhatsApp. Sharing chat history during a supported connection is subject to the choices shown in Meta's setup. Connecting an account does not mean every historic phone conversation is automatically imported. Removing an integration stops the connection; it does not automatically erase business records, recipient copies or information held independently by Meta.
What does the AI assistant see?
When you use Rosa, your request, relevant conversation context and results from permitted business tools are sent to Anthropic's Claude API to prepare an answer or carry out your instruction. For example, checking tomorrow's diary may involve appointment and customer details. The same applies whether you ask through the dashboard or WhatsApp. WhatsApp messages, voice messages included, are never used to train or improve AI models.
Access checks apply to the assistant's tools as well as the dashboard. A separate API key does not remove the AI provider's processing. Please avoid including passwords, access keys, or unrelated sensitive information in a message. AI outputs can be mistaken, so review details before relying on them.
Website sales chat: when available, this optional chat asks for your name and email to identify a short enquiry about Rosa ONE. We keep those form details and the conversation encrypted in our platform database; we do not add the name or email fields to the AI request. Your questions, a limited history of this chat and public product information go to Anthropic’s Claude API to prepare replies. Information you type in a question may itself include personal details, so do not include customer records, passwords or sensitive information. This chat has no business-record access or action tools. When a chat with at least one question ends, your name, email and the conversation are emailed to our team so we can follow up on your questions; it does not create a support request or enrol you in marketing. When you ask in the chat to talk to our team or leave it a message, your name, email, the phone number you give (required to be called, optional with a message), your message and the chat so far are emailed to our team at that moment and kept, encrypted, as a sales lead for up to 30 days from its creation so we can be in touch; you can ask for its deletion through the privacy request form. The separate contact and trial links let you choose those next steps yourself.
Cloudflare Turnstile checks website-chat requests to reduce abuse. We use session identifiers and hashed visitor/network identifiers for access and rate limits. A chat expires after 30 minutes without activity or two hours from its start. Closing clears the browser’s chat window and requests deletion on our server; when that request succeeds, the server forgets the session’s private content. Expiry ends access; it is not a promise that stored content is physically deleted at that exact moment. Expired session records are removed through our authorised retention process. Pausing new chats does not itself delete retained records.
Separate chat accounting records keep opaque session/request references, timestamps, processing usage, costs and reservations, without names, emails or message text. They remain for cost control, reconciliation and accountability. An uncertain provider result keeps its reserved amount until it can be reviewed, including across monthly budget resets. The provider processing and backup information elsewhere in this notice also applies. Closing a chat does not erase copies held independently by a provider or retained in backups.
Customer booking on WhatsApp: a business can enable the booking add-on to answer incoming questions about its services and prices and help customers book, move or cancel appointments on its connected number. It starts switched off. Customers can ask for the business’s team; authorised people in that business can read the conversation in its Inbox and take over. A handoff does not guarantee an immediate human reply. The business’s own privacy information also applies.
Understanding a customer’s messages: when AI understanding is enabled, we send Anthropic’s Claude API the customer’s message and the customer’s other recent messages in that conversation, the question the assistant asked and the options offered, service names and aliases, professionals’ first names, relevant dates and times, and the business’s language, country and sector. We do not attach the sender’s phone number, customer record, notes, booking history, prices, the team’s messages or staff contact details. Messages may contain personal information the customer types, so avoid including sensitive or unrelated details. The AI interprets the request; the booking rules decide what can be offered and changed. Buttons can be used without AI understanding.
Customer messages and accepted replies, including short progress messages, are kept in the business’s Inbox under the retention periods below. Booking records remain part of the business’s records. Conversation state, temporary holds and message identifiers help prevent duplicate bookings and manage handoffs. AI usage records contain usage and cost information, not message text. For access, correction or deletion of a customer record, contact the business first; our private privacy request form can help route the request.
Voice messages: when voice messages are switched on for a business, a voice message that a member of its team sends to Rosa on WhatsApp is transcribed by ElevenLabs, our speech-to-text provider, in the United States, under its data processing addendum, and Rosa answers the text as if it had been typed. So that names are heard right, the request also names, as words to favour, the business's services, its team's names and the first names of the customers that team member may see. Rosa ONE does not keep the audio. Once the transcription is done, we ask ElevenLabs to delete the transcript; ElevenLabs may keep the audio and related data under its own retention terms, and deleted data can stay in its backups for up to 30 days. A customer's voice message to the booking add-on is understood the same way, with the business's services and its team's names as words to favour; the audio is not kept, and the words it was heard as are kept in the business's Inbox, with the rest of the conversation, so its team can read them.
Assistant usage: each time Rosa uses an AI provider for a business, we record which business and which person or channel it was for, when it happened, the AI model and how much processing it used (for a voice message, the length of the audio), with its cost. These records do not contain the messages. We use them to apply each business's monthly assistant allowance and hourly limits, to show the business's owners how much of the allowance has been used, to send usage alerts and to manage our costs and capacity. We also count the messages refused because an hourly limit was reached, for each business and person, by the hour: counts only, never what was written. We keep the detailed records for 13 months, and monthly totals after that.
Booking through a business's link
Your client account: a business that uses Rosa ONE can share a booking link where you can see its services and free times, book, and move or cancel your bookings within its rules. To book, you sign in to a Rosa ONE client account, created the first time you sign in, which works with every business that offers a booking link. Where a business allows it, you can also book without an account, as described below. My bookings shows your bookings at every business in one place. Your account holds your email address if you sign in with one, the name you give when booking so it is ready next time, any WhatsApp number you prove, your language, the date you last signed in, and which bookings you made with it and where. If a WhatsApp number you prove already has its own client account, made when you signed in with that number alone, that account can join the one you are signed in to: its bookings and the number move to your account, and the other account is deleted. We use your account to sign you in, show and manage your bookings and send the messages described here; we never use it for marketing.
What the business receives: each booking, with the name and phone number you give and your account's email address, goes to the business you booked with and becomes part of its records, so that business's own privacy information also applies. For a booking made without an account, it receives your name, phone number and email address exactly as you typed them, unchecked. The business uses the email address and WhatsApp number you have proved to recognise you if you are already its client. If your details look like those of a client it already has, its owners and managers may see the possible match and join the two records. When your accounts join, the business's records of you become one as well; this happens only when those records hold no phone number other than the WhatsApp number you proved. Team members who receive Rosa's alerts may get a WhatsApp message with your name, the services, the day and the time, without your phone number. Each business sees only the bookings you make with it, never those you make with other businesses.
Signing in: you sign in with a link that we email to you through Resend, our email provider. It works once, for 15 minutes, and only in the browser where you asked for it. Where a business has set up its WhatsApp for this, you can also prove your WhatsApp number with a six digit code, sent from the business's own WhatsApp account and delivered by Meta, and, if the business offers it, sign in with your number and a code alone, without an email address. In Brazil, a business that can send these codes asks you to prove your number this way before you book, unless it has turned that off. The code expires after 10 minutes. We never keep the code itself, only a hash of it, a coded fingerprint that does not show the code, and we delete that hash when the code is used or replaced, or soon after it expires. As on our other sign in forms, an invisible Cloudflare Turnstile check and limits on repeated requests protect these steps.
Signing in with Google: you can also choose to sign in with your Google account. Google then gives us that account's email address and an identifier for it, which we keep with your client account so we can sign you in. We never see your Google password or anything else in your Google account.
Reminder emails: each business chooses whether to send appointment reminders by email. If it does, an automatic reminder that cannot be sent to you on WhatsApp goes by email instead, never both: for a booking made on its link, to your account's email address, and otherwise to the email address the business holds for you. For a booking made without an account, they go to the address you gave. Resend sends it from Rosa ONE's email address under the business's name, and your replies go to the business. It shows your name, the business's address and your visit's day, time, services and professional, and it can include a button to manage your booking. Resend tells us whether each email was delivered. Every reminder email has a link to stop reminder emails from that business; the business then keeps a hash of your email address so that they do not start again. If you have told a business that you do not want reminders, it sends you none by email either. Meta, for the WhatsApp codes, and Resend, for the sign in and reminder emails, act as our service providers, listed under “Who helps us deliver Rosa ONE?” below.
Booking without an account: where a business allows it, you can book on its booking link by typing your name, phone number and email address, without signing in. We do not check these details. The business receives them as you typed them, as part of its own records, and its own privacy information applies. The business sends nothing to your number on WhatsApp until it has confirmed the number with you. We email that address the booking's details and a private link to change or cancel that booking, which stops working when the visit starts. Anyone with the link can use it, so keep it to yourself. If the business must confirm your request, or moves or cancels the booking, we email you about it. If it sends reminder emails, they go to this address, each with a link to stop them. No Rosa ONE client account is made and the booking does not appear in My bookings. An invisible Cloudflare Turnstile check and limits on repeated requests protect the form; for those limits we keep coded fingerprints of the details for up to a day. For a copy or deletion of these details, ask the business, or use our private request form and we pass your request on.
Deleting your client account: you can delete it yourself in My bookings. You can also ask us for a copy of what it holds, or for its deletion, through the private request form linked at the end of this page; we first check that the account is yours. Deleting it removes your account, your sign in details and the links between your account and your bookings, and each business you booked with is asked to forget that link. It does not cancel your bookings: future ones stay in each business's diary, and each business keeps its own records of your visits and of you as its client, as it does for any client. To cancel a booking, do so before you delete your account, or contact the business.
The waiting list
When new workspaces are full or sign-up is paused, our sign-up page offers a waiting list. If you join it, we keep your email address, the plan you chose, your country or region and your language. We use them only to invite you when a place opens, in your language and for the plan you chose. We do not use the list for marketing, and we do not share it with other businesses.
Your email address is stored encrypted. We delete your entry 12 months after you last joined, or 6 months after we invite you, whichever comes first. Joining again with the same email address updates your entry rather than adding another.
To be removed sooner, use our private request form or the contact details at the end of this page. We delete your entry; our record of the removal does not include your email address.
Who helps us deliver Rosa ONE?
The providers below process information relevant to their role. The linked notices explain their processing. Depending on the service and purpose, a provider may act on our instructions or have responsibilities of its own.
Authorised Rosa Group personnel may access information for support, maintenance, security and administration. Your colleagues' access depends on their workspace role. Information may also be disclosed where required by law or necessary to establish or defend legal rights.
ElevenLabs
Speech-to-text for staff voice messages to Rosa, when voice messages are switched on
Privacy informationWhere is information processed?
The main Rosa ONE application and databases are currently hosted with Hetzner in the United States (Ashburn, Virginia), and encrypted backups are kept on a separate Hetzner server in Finland, in the European Union. Rosa Group is established in the United Kingdom. Our providers and authorised support operations may process information in the UK, EU, United States and other countries described in their notices. We do not promise that all processing stays in your country.
International-transfer protection depends on the countries, provider and applicable law. For UK/EU data, the relevant provider processing terms include contractual protections such as standard contractual clauses and the UK addendum where applicable, or a recognised adequacy arrangement. Anthropic, Resend and Cloudflare publish these terms. Brazilian transfers require a mechanism recognised under the LGPD; European clauses alone should not be taken as ANPD approval.
You can contact us for details of the safeguards applicable to your information and to request a copy. Provider terms: Anthropic, Resend and Cloudflare.
How long do we keep it?
We assess retention by the purpose of the record rather than apply one deletion period to every type of information. Workspace records remain available while needed for the business's use of the service, its instructions and applicable recordkeeping obligations. An expired trial or cancelled subscription does not itself erase the workspace; account closure and deletion can be requested separately.
For support and enquiry records, we consider whether the request is still open, whether follow-up is needed and whether a dispute requires the history. For security and activity records, we consider incident investigation, abuse prevention and accountability. Subscription and financial records may need to be retained for applicable accounting, tax or legal obligations. Information that is no longer needed is deleted or anonymised through our retention and request-handling process.
Client accounts: a client account created through a business's booking link is kept while you use it. If an account has never been used to book and nobody has signed in to it for 24 months, we review it and then delete it; this deletion is never automatic. An account with bookings is kept until you delete it or ask us to delete it. Expired sign in links and sessions stop working at once and are removed through our authorised retention process. For a booking made without an account, we keep no account: only an anonymous reference to the booking, with no name, number or address, while the business uses Rosa ONE.
Backups are kept for recovery. The encrypted copies on our separate backup server are kept for up to 12 months: every copy from the last 48 hours (one an hour), then one for each of the last 14 days, 8 weeks and 12 months; older copies are deleted automatically. The encrypted copies on the server that runs Rosa ONE are kept for up to 14 days: every copy from the last 48 hours, then one for each of the last 14 days; older copies are deleted automatically. A deletion request includes review of backup copies; deletion from active systems may not immediately remove an older protected backup. Where a backup is retained, its use is restricted to recovery and required legal purposes, and completed deletions must be reapplied before restored data is used. We will explain any retention exception relevant to your request.
How do we protect it?
We use HTTPS, account access controls, workspace permissions, separate operational databases and application environments, encrypted credentials, and protected backups. Workspaces share hosting infrastructure; authorised platform administrators retain technical access needed to operate the service. No online service can guarantee absolute security.
To protect our sign-in and sign-up forms and the form for booking without an account from automated abuse, we use Cloudflare Turnstile: an invisible check in your browser, confirmed by our servers, shares limited technical data with Cloudflare (such as your IP address and browser signals) solely to tell people apart from bots, as described in Cloudflare's Turnstile Privacy Addendum.
Your choices and rights
Depending on the law that applies, you can request confirmation of processing, access, correction, deletion, restriction or a portable copy of your information. Where processing relies on consent, you can withdraw it without changing the lawfulness of earlier processing. You may also ask about the organisations with which information is shared.
You can object to processing based on legitimate interests and to direct marketing. Contact us to make a request or explain your concern. We may need proportionate information to verify your identity or authority, and we will explain any lawful exception that applies.
Who handles your request, and how fast: privacy requests are handled by Rosa Group's owner, Maicon Da Rosa, who is also our data protection contact and our encarregado (data protection officer) under Brazil's LGPD. Reach them through our private request form, which gives you a reference straight away. We reply within one month of receiving your request and, where Brazil's LGPD applies, within 15 days to confirm whether we process your data or to give you a copy of it. If a request is complex, UK law allows up to two more months; we will tell you within the first month. A request about a business's records is passed to that business promptly, and we help it reply.
You can also email our data protection contact at [email protected].
Use our private contact form, or follow our data-deletion instructions. You can also raise a concern with the UK Information Commissioner's Office, Brazil's ANPD, or the regulator responsible for your location. Where US state privacy rights apply, you may exercise them without unlawful discrimination and ask us to review a refused request.
Changes and getting in touch
We update this notice when the service or its processing changes and show the revision date here. Material changes will be brought to affected users' attention where required. If something is unclear, please use our contact form—we will help you understand how it applies to your information.
We are here to help.
Tell us what you need through our private form. You do not need to sign in.
Open contact form →Also by email: [email protected]