What is Aura 300 Booking
Aura 300 Booking is a booking broker operated by Aura 300 ("Aura", "we", "us"). It lets AI assistants — Claude, ChatGPT, and other MCP (Model Context Protocol) compatible agents — search participating salons and clinics, check availability, and book, reschedule, or cancel appointments directly on that business's own booking system (CRM), on behalf of a customer. This policy explains what data passes through Aura 300 Booking to make that possible, and what we do — and don't do — with it.
Data we process
- Salon catalog data — service names, prices, durations, staff names, and availability, read from each participating business's own CRM. This is business data, not personal data about an individual.
- End-customer booking details — the name, phone number, and (optionally) email address of the person being booked, provided by the customer or by the AI assistant acting for them. This is sent only to that specific salon's own booking system, only to create, confirm, move, or cancel that one appointment. Aura 300 Booking does not build a customer profile, marketing list, or account from it.
- Hosted verification challenges — for salons that require phone verification before confirming a booking, we create a single-use hosted verification challenge. The challenge stores a hash, allows five attempts, expires after 10 minutes, and its SMS send cooldown is 60 seconds.
- Appointment type — the service being booked. At a medical or aesthetic clinic this can reveal health-related information (for example the treatment chosen). It is used only to make and manage that appointment with the salon or clinic, and never for marketing or profiling.
- Connected-application registrations (OAuth) — when an AI application (e.g. Claude, ChatGPT) connects to Aura 300 Booking, we record the application's name and callback address, and issue it a per-connection identifier used to attribute and rate-limit its requests. This identifies the connecting application, not the end customer — there is no end-customer account, login, or password anywhere in this system.
- Operational logs — timestamps, the action taken (e.g. "search availability", "book"), the salon involved, and the connecting application's identifier, kept as an audit trail for security, rate-limiting, and troubleshooting. We do not log full conversation text.
Who we share data with
Personal data is shared only with the parties needed to make a booking work:
- The salon or clinic you book with — receives the customer name, phone, optional email, and appointment details in its own booking system (run on the Aura platform).
- Amazon Web Services (AWS) — hosts the broker service and its database (AWS privacy notice).
- Twilio — delivers SMS verification codes; receives the phone number and the code (Twilio privacy notice).
- Anthropic — only on the salon chat booking pages at booking.aura300.ai: chat messages are processed by Anthropic's Claude model to answer and make the booking (Anthropic privacy policy).
When you use Aura 300 Booking through your own AI assistant (for example Claude or ChatGPT), your conversation stays with that assistant's provider under its own privacy policy. Aura 300 Booking receives only the details the assistant sends in a tool request, such as the salon, time, and contact details for the booking.
What we don't do
- The customer-facing chat service keeps message history in server memory for the active session and removes it after up to 30 minutes of inactivity. It is not written as a durable chat transcript by this service.
- We do not sell, rent, or share personal data with third parties for marketing or advertising.
- We do not use booking or conversation data to train AI models.
- We do not require end customers to create an account, username, or password with Aura 300 Booking.
- We do not process payments or financial transfers through this system.
Data residency
Aura 300 Booking's broker service and its database run on AWS in Paris (eu-west-3), as do the underlying Aura platform services it connects to. SMS delivery (Twilio) and the chat booking pages' AI model (Anthropic) are provided by companies that may process that data outside the EU.
Storage and retention
Aura 300 Booking keeps personal data only as long as it needs it to run and support bookings, and deletes it automatically on this schedule:
- Booking contact details (the customer's name, phone number, and email) are erased 12 months after the appointment date. The booking record stays without personal data. The salon's own booking system keeps its copy under the salon's own policy.
- Audit and reconciliation log entries are deleted after 12 months.
- Sign-in tokens for connected AI applications are deleted 30 days after they expire. Connected-application registrations are kept while the connection is in use.
- A booking whose outcome is still being reconciled keeps its details until that is resolved, then follows the same 12-month schedule.
- Hosted verification challenge hashes are single-use, limited to five attempts, expire after 10 minutes, and are removed when used or during cleanup.
- Verification grants expire after 10 minutes; held slots expire after 5 minutes; SMS send cooldown records expire with their verification window.
- Server-memory chat sessions expire after up to 30 minutes of inactivity.
Security
Data in transit is encrypted (HTTPS/TLS). API access requires either a scoped OAuth 2.1 access token (short-lived, limited to booking:read and/or booking:write) or a private bearer token issued to a specific integration. Salon CRM credentials are stored server-side only and are never exposed to the connecting AI assistant or the end customer.
Your rights
Because Aura 300 Booking does not maintain end-customer accounts, the durable record of a booking lives in Aura 300 Booking's operational database and, separately, in the salon's own CRM (governed by that business's own privacy policy). To request access to, correction of, or deletion of your data, email info@aura300.ai with the salon name and the name/phone number used for the booking. We will locate and action the request, coordinating with the salon's CRM as needed, within a reasonable time.
Children
Aura 300 Booking is not directed at children and is not knowingly used to process data about children beyond what a parent or guardian submits to book a service on their behalf.
Changes to this policy
We may update this policy as the service evolves. The "last updated" date at the top always reflects the current version.