Privacy
How Ruche handles your data and your clients' data, in plain language.
Atualizado em 28 de setembro de 2026
Company clients
When the owner turns on Company clients, only branches with the same root CNPJ share contact details, birthdays, appointments and notes. Each unit's page shows the participating branches. Health records, consent forms and before and after photos remain at the unit that served the person, with separate access. Turning the option off or leaving the company stops the sharing without deleting local records.
What we collect on this site
When you send the contact form, we store your name, your email or phone, the type of business and the message, in order to reply. Visits are counted without cookies and without storing the visitor's address. We do not use tracking cookies or ads.
What Ruche stores for your business
Business and team data, services, appointments and clients, with contacts, notes and history, are kept separate for each business. Only you and whoever you authorize can see them. The Ruche team sees your clients' data masked; opening the full data, to resolve a ticket, requires a reason, which is logged.
People who book with a business
Whoever books an appointment provides a name, a phone number and, if they want, an email. The email is used for the confirmation, the reminders, the notices about that appointment, the invitation to review the appointment and, if the business uses them and the person does not decline, that business's email campaigns (see below). Whoever turns on the browser notification on the appointment page leaves with us only the technical address of that notification, which is erased when the appointment has passed. This data belongs to the business that serves the person: requests for access or deletion go to it, and Ruche helps the business comply.
Payments
When a business asks for payment through the page, Ruche stores only the status of each payment (amount, deadline, paid, refunded or turned into credit), to show to the business and to the person who booked. The money goes straight from the payer to the business, through its bank or its Asaas account: Ruche does not see or store card or bank account data of the payer. When the business is paid through Asaas, the payer's CPF or CNPJ goes straight to Asaas, which asks for it to generate the charge; Ruche stores only the customer code there. The business's access key to Asaas is encrypted and is used only to create, query, cancel and refund the page's charges.
Forms, intake forms and signed consents
When a business uses forms in Ruche, the person being served answers through the link or together with the business, at the appointment. Answers and signatures are encrypted in our database and only the business itself can see them; the Ruche team sees only numbers, never the content. Health answers are sensitive data (LGPD, art. 11; GDPR, art. 9) and are never sent by email. When a consent form is signed, we store as proof of acceptance the date and time, the version, a code of the text (SHA-256), the typed name, the drawn signature (if any), the browser and the full IP address. This proof is kept as long as the form exists and is removed along with it. The person who answered requests access or deletion from the business, which downloads or deletes it in the dashboard; when the business account is deleted, all of this is erased.
Reviews
When a business asks for reviews, the person who was served receives an invitation by email a few hours after the appointment (and also sees it on the appointment page). The review is public on the business's page, with the first name and the initial of the surname or without a name, as the person chooses; the business knows who reviewed. We store the rating, the comment, the service and the date. The person who reviewed deletes their own review at any time, through the same link, and it is removed right away; they can also ask not to receive more invitations from that business (for that we store only a code of the email, not the email). The Ruche team reads the reviews that the filter holds back or that the business reports, and only hides those that break the rules. When the business account is deleted, the reviews are removed with it.
What we use it for
To make Ruche work: schedule, booking page, reminders and the rest of the system. We do not sell data and we do not use your clients' data for any other purpose, except for the industry comparison, only if the business turns it on and only as aggregated numbers (see below). The subscription is paid through Stripe: Ruche does not see or store the card number.
Downloading and deleting your data
In the dashboard, under Settings, Your data, you can download a copy of everything whenever you want, as spreadsheets and as a complete file to take to another system, and request deletion of the account. Deletion waits 30 days, and until then you can change your mind with one tap. On the 30th day the account closes and, within 24 hours, everything is erased for good. Only the record of charges that the law requires us to keep remains.
Unused account
An account that goes unused and without a paid subscription for 3 months (6 months for those who have subscribed before) is closed and erased in the same way as a requested deletion, after three email notices (1 month, 2 weeks and 3 days before); signing in to the dashboard already counts as use. This way, we do not keep the data of those who no longer use Ruche, nor that of the clients of that account (LGPD, art. 16; GDPR, art. 5(1)(e)). To know whether the account is in use, we store only the date of the last use (signing in to the dashboard, a booked appointment, a payment) and when each notice went out.
Your rights
You can request access, correction or deletion of your data at any time. Almost everything is resolved in the dashboard itself; what cannot be, through the contact form. We follow the LGPD in Brazil and the GDPR in Europe.
Business logo and photos
The logo and the service photos that a business puts in Ruche appear on its page, in the appointment emails and on receipts. Every photo is reprocessed on our server: it comes out without the camera data, such as location, and at a size suited to the page.
Client photos
Before and after photos are encrypted, stored only for the business that served the person, without the camera data (not even the location). They go to the business's page only when the client authorizes it through the image-use consent form: without the face or with the face, and without the name of the person served. The authorization is recorded with the proof of signature, and whoever authorized it can withdraw it whenever they want: the photos leave the page right away. A photo of a health procedure is sensitive data (LGPD, art. 11; GDPR, art. 9) and is treated as such. The photos are included when the business downloads its data and are removed when the account is deleted.
Email campaigns
A business can send, through Ruche, campaign emails to people it has already served: a birthday greeting, an invitation to come back when more than the usual time has passed and notices (news, holiday hours, promotions). Whoever books through the business's page sees this notice and can decline on the spot; the first appointment email repeats the notice, with the link to opt out. Every campaign email carries the link to stop receiving them, which takes effect immediately, and works with the unsubscribe button of the email program. We store when the person was notified and when they asked to opt out (with a code of the email, not the email), the date of each send, whether they tapped the booking button and whether they booked afterward. We do not use a pixel to know who opened. An address that the server rejects (no longer exists) is removed from campaigns, and no one under 18 according to the record receives them. In Brazil, the basis is the business's legitimate interest (LGPD, art. 7, IX); in Europe, the email of someone who already bought, for similar services from the same business, with the chance to refuse (ePrivacy Directive, art. 13). When the business account is deleted, all of this is removed with it.
Ruche's WhatsApp
Ruche has an official WhatsApp number, through the Meta API, which handles the confirmation and notices of appointments for all businesses. Each message says which business it is from. Whoever books through a business's page chooses to receive the confirmation and notices for that appointment there: in Brazil the box is already checked, with the text beside it, and can be unchecked; in Europe and in other countries it comes unchecked. The business can also send the confirmation from the dashboard, after confirming that the person agreed. We store the date, the origin and the text of each consent. When the person writes to the number, the bot replies and uses their number to find their appointments, at any business. Replying PARAR, SAIR or STOP ends notices from all businesses right away, and VOLTAR resumes them; a conversation the person started themselves is still answered. For each message we store only when it went out, whether it arrived and whether it was read, for 180 days. No advertising through WhatsApp. Meta, the owner of WhatsApp, also processes these messages, under its own rules.
WhatsApp conversations
What the bot cannot answer goes to the business, which replies in the dashboard, in the Conversations inbox. Each business sees only the conversations with it, and on the team only those with permission (the professional, only those for their own appointments); the Ruche team does not read the conversations. The text of the messages (the person's, the bot's and the business's) is encrypted in our database for 180 days and then erased; photos, audio and files are not downloaded or stored. The conversations are included when the business downloads its data and are removed when the account is deleted.
Chat on the appointment page
Whoever has the appointment link can send a question to the business from the page itself, without another app. The link is the key: we do not ask for a login, and getting the code wrong many times in a row blocks the address for a while. The chat is valid until the end of the appointment plus 24 hours; after that, the page stops showing the messages. The conversation reaches the business in the Conversations inbox, with the same rules as WhatsApp conversations: each business sees only its own, the Ruche team does not read them, the text is encrypted for 180 days, is included when the business downloads its data and is removed when the account is deleted. When the business replies, we notify you by browser (if you turned on notifications) and by email (if it has yours); neither carries the text of the reply.
Ruche's Telegram
Ruche has a bot on Telegram, through Telegram's official API, which sends the confirmation and reminders of appointments to those who ask for them. The person turns it on by tapping "Get on Telegram" on the appointment page (or by sending the appointment code to the bot) and then Start; we store when they turned it on, for which business and the text the bot showed. From Telegram we receive the chat id, the name and the @ the person shows and the app language; never the phone number. With this link, the bot finds the person's appointments with that business and sends reminders the day before and close to the time, as the business chose. Sending /parar (or PARAR, STOP) ends right away what Ruche sends there, from all businesses, and /voltar resumes it; blocking the bot also stops everything. What the person writes to a business goes to the Conversations inbox, as on WhatsApp, encrypted for 180 days. For each message we store only when it went out and whether it arrived, for 180 days. Conversations with Telegram bots stay on Telegram's servers, without the end-to-end encryption of secret chats, and Telegram also processes this data, under its own rules. No advertising through Telegram.
Ruche's Messenger and Instagram
Ruche has a Facebook Page and an Instagram professional account, connected to Meta's official API, which send the confirmation of appointments to those who ask for it. The person turns it on by tapping "Get on Messenger" or "Get on Instagram" on the appointment page (or by sending the appointment code in the chat); we store when they turned it on, for which business, the text the bot showed and its version. From Meta we receive the id the person has in the conversation with Ruche (one on Messenger and another on Instagram, which are valid only for Ruche), the name and, on Instagram, the @ they show; never the phone number. Messenger and Instagram only let the bot write up to 24 hours after the person's last message: within that window, reminders arrive there; outside it, by email and by browser notification. Sending PARAR, SAIR or STOP ends right away what Ruche sends there, from all businesses, and VOLTAR resumes it; blocking the Page or the account also stops everything. What the person writes to a business goes to the Conversations inbox, encrypted for 180 days. For each message we store only when it went out and whether it arrived, for 180 days. Meta Platforms, in the United States, and Meta Platforms Ireland, in Ireland, the owners of Messenger and Instagram, also process these messages, under their own rules: the data leaves Brazil and the European Union. No advertising through Messenger or Instagram.
Discreet messages
In health care and mental health, what Ruche sends about an appointment (the confirmation and reminders on WhatsApp, Telegram, Messenger and Instagram, the browser notification, the appointment emails and the calendar event) goes out without the service name: it says the business, the day, the time and the link. Any business can turn on the same option. The service appears on the appointment page, which opens only with the link of the person who booked.
Compare with the industry
A business that wants to can turn on, in the dashboard, the comparison with similar businesses (Settings, Compare with the industry); it comes turned off and only the owner or a partner can turn it on. When on, Ruche stores for up to 24 months a monthly summary of the whole business (no-show, cancellation and occupancy rates, lead time and return rate, the field, the size and the city), calculated from the schedule, and combines that summary with that of at least 9 other businesses of the same field, size and region. Only the median and the range of the group appear, and only to those who also take part. Never included are the name of the business or the team, client data, service names, amounts, records, photos, conversations or notes; in health care and mental health, only the structure of the schedule. The basis is the business's consent (LGPD, art. 7, I; GDPR, art. 6(1)(a)) and, for the clients' appointments within the account, legitimate interest with these safeguards (LGPD, art. 7, IX; GDPR, art. 6(1)(f)). We store when each switch was turned on and off, by whom and with which version of the text, as proof of consent, for up to 5 years after the account is deleted. Turning it off takes effect immediately: the business's summary is erased and it leaves the next calculation; the group figure already published is anonymous and remains. Ruche does not sell data.
