Privacy Policy

The controller responsible for processing personal data collected through this website and SaviaIA services is:

• Entity: [COMPANY NAME]
• Tax ID: [TAX ID / CIF]
• Registered Address: [REGISTERED ADDRESS]
• Contact Email: [CONTACT EMAIL]
• Data Protection Officer: [DPO EMAIL — if applicable]

We process different categories of data depending on your interaction with SaviaIA:

• Account and contact data: name, email address, encrypted password, company name, website URL, and business sector.
• Service usage data: access logs, IP address, assistant-generated conversations, and usage metrics.
• Billing data: corporate details, tax identifiers, and payment information managed securely by our payment processor.
• Browsing data: essential technical information stored via necessary local storage (see Cookie Policy).

In addition, when a person converses with an assistant published by a SaviaIA customer, we process the following data on behalf of that customer, who acts as the data controller:

• The full content of the conversation with the assistant, including messages sent and received.
• Contact details voluntarily provided during the conversation: name, email address, and phone number.
• A hashed value of the IP address and the browser identifier. The IP address is never stored in clear text.
• Consent to receive commercial communications, together with its date, only where the person explicitly opts in.

No registration or sign-in is required to converse with an assistant.

We process personal data under the following legal bases:

• Service delivery and management — basis: contract performance.
• Account creation and administration — basis: contract performance.
• Responding to demo and information requests — basis: consent / pre-contractual steps.
• Billing and tax compliance — basis: legal obligation.
• Service security and optimization — basis: legitimate interest.

We retain your personal data for the duration of your contract and thereafter as required by applicable tax and legal liabilities.

• Technical messaging channel logs: 180 days.
• Assistant conversations and messages: retained while the customer keeps the assistant active. They are not deleted automatically when a trial expires.
• Documents uploaded by the customer: until the customer deletes them.
• When an assistant is deleted, all associated data is permanently and cascadingly erased, including conversations, messages, and contacts.

Any person may request erasure of their data at any time, regardless of these periods.

We utilize trusted sub-processors under GDPR Article 28 data processing agreements:

• Anthropic (United States) — the language model that generates assistant responses. It receives the content published by the customer company and the messages in the conversation.
• Google (United States) — automated extraction of the company profile from web content, plus sign-in and calendar management where the customer enables that integration.
• Stripe (United States and Ireland) — payment processing and subscription billing.
• Meta Platforms (United States and Ireland) — WhatsApp channel, where enabled by the customer. It receives messages and the phone number.
• Telnyx (United States) — telephone channel, where enabled by the customer. It receives call audio and metadata.
• The outbound email provider designated by each customer for their transactional communications.
• The application and database hosting provider.

The models used to generate semantic representations of content and to transcribe voice notes run on our own infrastructure: that data is not sent to any third party.

We do not share your data with third parties except where legally required.

Some of the providers listed above are established outside the European Economic Area, primarily in the United States. In particular, the language model that generates assistant responses runs on infrastructure operated by a US provider.

These transfers rely on the safeguards set out in Chapter V of the GDPR: Standard Contractual Clauses approved by the European Commission or, where applicable, the EU–US Data Privacy Framework adequacy decision. You may request a copy of those safeguards at the address below.

You may exercise your rights of access, rectification, erasure, restriction, objection, and data portability by contacting [CONTACT EMAIL], stating which right you wish to exercise and providing proof of identity.

If you have conversed with an assistant published by a customer company and wish to exercise your rights over that conversation, you may contact that company or us: we have the technical means to locate and erase your data based on the email address or phone number you provided.

Where you have consented to receive commercial communications, you may withdraw that consent at any time, without affecting the lawfulness of prior processing.

If you believe your data is not being processed in accordance with applicable law, you have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es), C/ Jorge Juan 6, 28001 Madrid.