Privacy policy

Status: November 2026

Citara is a service by Geisterwelt that lets small businesses answer customers on WhatsApp and take appointments with the help of an AI assistant. This policy covers (A) this website and (B) the WhatsApp service.

1. Who is responsible

Website: Markus Geist (Geisterwelt), Hipfelsberger Straße 46, 72516 Scheer, Germany. Email: geisterwelt@mail.de

WhatsApp service: The business you are chatting with (for example a salon) decides why and how your data is used. It is the controller. Geisterwelt runs the technology on behalf of that business and acts as its processor under a data processing agreement. For your rights you can contact the business or us at the email above, and we will pass your request on.

A. This website

2. Hosting and server logs

The site is hosted on a server in Germany (IONOS SE). The web server temporarily records technical data: IP address, date and time, requested page, browser and operating system. This is needed to deliver and secure the site (Art. 6 (1)(f) GDPR). Logs are deleted after a short period.

3. Cookies and tracking

This website sets no cookies and uses no analytics or advertising tools. No external fonts or scripts are loaded.

4. Contact by email

If you write to us, we process your email address and your message to answer you (Art. 6 (1)(b) or (f) GDPR). We delete it when the matter is closed, unless the law requires us to keep it.

B. The WhatsApp service

5. What data is processed

• Your WhatsApp phone number and the profile name you set in WhatsApp.
• Your messages to the business and the replies of the assistant.
• Appointment data: the service you booked, date and time, and the name you give us for the booking.
• Technical data such as message IDs and timestamps.

Please do not send sensitive information (for example health details) in the chat. The assistant is built for booking and general questions only.

6. Why and on what basis

To answer your messages, check free times, make, change and cancel your appointments, and to protect the service against abuse (for example limits on how many messages one number can send per hour). The basis is the contract or the steps you ask for before a contract, and the legitimate interest of the business in running its bookings (Art. 6 (1)(b) and (f) GDPR). For customers in Ghana, processing is also based on the Data Protection Act, 2012 (Act 843).

7. You are talking to an AI

Replies are written by an AI assistant, not by a person. The assistant can only book within the opening hours and services the business has set up. Bookings are made by fixed rules in our software, not by the AI alone.

8. Who receives the data

• Meta Platforms Ireland Ltd. / WhatsApp carries the messages (WhatsApp Business Platform). Their own privacy policy applies to that part.
• Anthropic, PBC (USA) processes the chat text to generate the assistant's replies, through its API. According to Anthropic's terms, API data is kept for a limited period and not used to train its models by default.
• IONOS SE hosts our server in Germany, where appointments and chats are stored.
• The business you are booking with sees your appointment and the chat.

Where data leaves the EU (for example to the USA), we rely on appropriate safeguards such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework, where the recipient is certified.

9. How long we keep data

Chat messages are deleted automatically after 30 days. Appointment records are kept as long as the business needs them for its bookings, and are deleted earlier when you ask us to.

10. Delete your data

You can ask us to delete your data at any time.

1. Send an email to geisterwelt@mail.de with the subject Delete my data.
2. Write from, or name, the WhatsApp phone number that was used, and (if you know it) the business you chatted with.
3. We delete your chats and appointment records and confirm by email, normally within 30 days.

11. Your rights

You can ask for access, correction, deletion, restriction and a copy of your data, and you can object to processing based on legitimate interests. You can also complain to a data protection authority. In Germany this is for example the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg. In Ghana it is the Data Protection Commission.

12. Changes

We may update this policy when the service changes. The current version is always on this page.