In short: SAR.AI is an AI voice receptionist that answers salon phone lines, checks availability and books/reschedules/cancels appointments in the salon owner's calendar. This policy explains what data we process when a call comes in, who we share it with to make that happen, and the rights callers and salon customers have under UK data protection law.
1. Who we are
SAR.AI is operated by Abdul Rahim Holdings Ltd ("SAR.AI", "we", "us"), a company registered in the United Kingdom. We provide an AI-powered telephone receptionist service to independent beauty salons ("salon", "our client"), who in turn use SAR.AI to handle calls from their own customers ("caller", "you").
For most calls, the salon is the data controller of the caller's personal data (it's their business relationship with the customer), and SAR.AI acts as a data processor on the salon's behalf. Where we determine our own means and purposes of processing (for example, service reliability logs, or fraud/abuse prevention), we act as a controller in our own right for that limited processing.
2. Call recording
Calls handled by SAR.AI may be recorded and transcribed. Every call begins with a spoken notice telling the caller that the call may be recorded for quality, training, and booking-accuracy purposes, before any booking details are discussed. If a caller objects during the call, they can ask to be transferred to the salon owner directly.
Recordings and transcripts are used to: process the booking request in real time, resolve disputes about what was booked, and improve the accuracy of the assistant. They are not used for marketing purposes.
3. What we collect
Call metadata: caller phone number, call time, duration, and call outcome.
Voice audio and transcript: the spoken content of the call, converted to text for processing.
Booking details: name, phone number, the service requested, and preferred/booked appointment date and time.
Existing customer records: where a caller is already a customer of the salon, we look up their existing record (e.g. by phone number) to confirm or amend a booking.
Website form data: if a salon owner or prospective client submits an enquiry or onboarding form on this website, we collect the details they provide (name, contact details, salon information) to set up or discuss the service.
4. Who we share data with (our data processors)
To answer a call and complete a booking, data passes through the following specialist processors. Each is bound by a data processing agreement and only processes data as instructed:
Processor
Role
Data involved
Vapi
Voice AI orchestration — runs the phone-call assistant
Call audio, transcript, call metadata
Twilio
Telephony carrier — routes and connects the phone call
Caller phone number, call routing metadata
OpenAI
Language model — interprets caller requests and drafts responses
Transcript text, booking intent
Make.com
Automation/integration layer — routes data between the above systems and the salon's tools
Call transcript excerpts, booking details, phone number
Square
Payments and appointment booking system — the salon's live calendar and customer records
Name, phone number, appointment details, customer record
Airtable
Operational data store — service catalogue lookups and call/booking logs
Phone number, service requested, booking log entries
We do not sell personal data, and we do not share it with third parties for their own marketing purposes.
5. Our legal basis for processing
Under UK GDPR
Legitimate interests — for handling the call itself, checking availability, and completing a booking the caller has actively requested. This is a service the caller is contacting the salon to receive, and processing is limited to what's necessary to provide it.
Contract — where completing a booking forms part of the contract between the caller and the salon.
Consent — where we ask for it explicitly, for example if a salon owner or prospective client opts in to marketing communications, or ticks a consent box on our onboarding form.
Under PECR (Privacy and Electronic Communications Regulations)
Call recording: callers are notified at the start of the call, which serves as the basis for recording under PECR's transparency requirements; a caller who objects can request to be transferred to a human instead.
Electronic marketing: we only send marketing emails or SMS to salon owners or prospective clients who have given consent (e.g. via the onboarding form or a direct enquiry), and every marketing message includes a way to opt out. We do not send marketing communications to callers who ring a salon's SAR.AI line — that data is used solely to handle the call and booking.
6. How long we keep data
Call recordings and transcripts: retained for a limited period to resolve booking disputes and for quality review, then deleted on a rolling basis. We aim to keep these no longer than necessary and typically no more than 90 days, unless a longer period is required to resolve a specific complaint or legal request.
Booking and customer records: retained in the salon's Square account for as long as the salon maintains its own customer records, in line with the salon's own retention practices.
Operational logs (Airtable): retained for as long as needed for service operation and debugging, then periodically purged.
Website enquiry/onboarding form submissions: retained while we are in discussion with the prospective client, and for a reasonable period afterward for our own business records.
7. Your rights
Under UK GDPR, you have the right to:
Access the personal data we (or the salon, as controller) hold about you.
Rectification of inaccurate or incomplete data.
Erasure ("right to be forgotten") of your data, subject to any legal or contractual reason we may need to keep it.
Restriction of how your data is processed in certain circumstances.
Object to processing based on legitimate interests.
Data portability, where technically feasible.
Withdraw consent at any time, where we rely on consent (this won't affect processing already carried out).
Complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, if you believe your data has been mishandled. Visit ico.org.uk or call 0303 123 1113.
If your call was handled by a specific salon using SAR.AI, you can also direct data requests to that salon directly, as they are typically the controller of your booking data.
8. Contact us
For any question about this policy, or to exercise a data protection right, contact: