Privacy notice

Salon Demo is a sample salon, built by James Carl Sitsit to show how an automated booking and reminder system works. It is not a real business: nothing is really booked and nothing is paid. You chat with an AI assistant, not a person. This notice follows the Philippine Data Privacy Act of 2012 (RA 10173).

Who is responsible

James Carl Sitsit, a freelance developer in the Philippines. Contact: jamescarlsitsit@gmail.com or the contact form at sitsit.dev.

Why

To run the demo you chose to use, and to stop abuse of it (a bot check and limits on how much one visitor can send or book). Nothing is used for advertising, sold, or used to train AI models by this demo. The basis is your consent (the checkbox before you start) for the chat and bookings, and a legitimate interest in stopping abuse for the human check and the limits.

What is collected

• The messages you type in the chat.
• The bookings you make: the service, day and time, and whether you confirmed, moved or cancelled them.
• The messages the demo sends to the phone on the page (booking confirmations and reminders).
• A random session id, so the page knows which bookings and messages are yours. It is shared with the order demo on this site, which uses the same human check.
• A salted, one-way hash of your IP address, used only to limit how many sessions one connection can open. Your IP address itself is not stored by the demo.
• If you tap "Talk to James" or "Hire me", James's assistant on sitsit.dev opens so you can ask questions or share project details. Nothing is sent until you press Send there.

The salon's schedule on the page is public: anyone viewing it sees the week's bookings by service, time and status. It never shows who booked.

The demo never asks for your name, phone number, address or email. Please do not type them in the chat. The "phone" on the page is part of the page; no real SMS or message is sent.

In your browser

Your browser keeps your session id and chat in session storage, so a refresh does not lose them. It clears when you close the tab. Cloudflare's human check loads with the page and may set a cookie it needs for bot detection.

Who processes it

• Anthropic (Claude): your chat messages are sent to Anthropic's API to write the replies. Anthropic keeps API messages for up to 30 days, or longer if its safety systems flag them, under its own policy. Bookings you make by tapping a time are not sent to Anthropic.
• Cloudflare Turnstile: checks that a person, not a bot, is starting the demo. Cloudflare sees your IP address and browser details to do this.
• The system runs on a server in Germany operated by netcup GmbH. If a step fails, the developer gets an alert on Telegram with the error details, which normally do not include your messages.
• All of this is processed outside the Philippines: on the demo's server in Germany, and by Anthropic and Cloudflare in other countries.
• The photo on the page is stored on the same server; loading it sends nothing to Wikimedia.

How long it is kept

Bookings, the phone's messages and sessions are deleted every day at 3:00 AM Philippine time. Chat messages are not saved by the demo after a reply is sent. Failed runs of the booking workflows are not kept. Anthropic's copy follows its own policy, as above.

Your rights

Under the Data Privacy Act you can ask to be informed about, access, correct, object to, or erase data about you, get a copy in a portable format, and claim damages, and you can complain to the National Privacy Commission. Write to jamescarlsitsit@gmail.com. Everything is deleted by 3:00 AM Philippine time the next morning, so after that there is nothing left to give or erase. Before then, write with the day and time you booked and roughly when you made the booking.

Last updated 24 October 2026.