Privacy Policy

In compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), and Spanish Organic Law 3/2018 of 5 December on Personal Data Protection and guarantee of digital rights (LOPDGDD), Jose Manuel Lopez Pena informs users of this privacy policy.

1. Data controller

2. Data we collect and purposes

2.1 Contact forms and service enquiries

We collect your name, email or telephone, business type and enquiry to respond, assess feasibility and, when requested, prepare a proposal. Comments are optional on the appointment management and social media content landing pages. We also record language, requested service, originating page and, if present in the URL, campaign parameters (source, medium and campaign).

Legal basis: taking pre-contractual steps at your request to assess the services you have asked about (Art. 6(1)(b) GDPR). The reading checkbox acknowledges presentation of privacy information; it is not a subscription or consent to other purposes.

If you act on behalf of a company, processing your professional contact details to address the requested relationship relies on legitimate interests (Art. 6(1)(f) GDPR and Art. 19 Spanish LOPDGDD), limited to that purpose; you may object where applicable.

Name, contact details and business type enable us to identify and address your request. We cannot reply without a contact method. Please do not include health data, passwords or personal data about your own customers in comments.

Requests are recorded in the Ardeiro.AI administration system. Requests from the appointment management and social media content landing pages are also managed in Baserow, self-hosted under Ardeiro.AI control, and a notification is emailed to [email protected] using Resend. Only authorised personnel access this information to handle the request.

The mobile alerts for these landing pages use a generic Chatwoot message identifying the requested service, with no applicant name, email, telephone, business, comment or identifier. Form data is not included in the alert or its notification relay. This process does not start a conversation with the chatbot.

Submitting an enquiry does not subscribe you to the newsletter or authorise unrelated advertising. The newsletter has its own form, information and separate consent.

2.2 Browsing data

The server automatically collects standard technical logs (IP address, browser, operating system, pages visited, date and time of access). This data is used exclusively for security, technical maintenance and detection of unauthorised access. It is not associated with individual user profiles.

Legal basis: the controller's legitimate interest (Art. 6.1.f GDPR).

2.3 Support chatbot (WhatsApp, Telegram and Web Chat)

When a user interacts with the Ardeiro.AI chatbot via WhatsApp, Telegram or the Site's chat widget, the following data is collected:

• Name — if provided by the user during the conversation.
• Phone number or messaging account identifier — required to maintain the conversation on the chosen channel.
• Content of the exchanged messages — to handle the query and generate a response.
• Appointment data (date, time, requested service, contact email) — when the user requests to book, change or cancel an appointment through the chatbot.

Purpose: to handle the query, provide automated support through an artificial intelligence system, manage the booking, modification or cancellation of appointments, and follow up on the service (reminders, satisfaction surveys).

Legal basis: performance of a contract or taking requested pre-contractual steps (Art. 6(1)(b) GDPR) to contract or manage a service. Additional purposes requiring consent must be separately authorised; that permission is not presumed from merely starting a conversation.

Automated decisions: chatbot replies are generated through an artificial intelligence system (language model). The user may request to be assisted by a human agent at any time by stating so within the conversation. The system does not make automated decisions with legally significant effects on the user.

3. Data retention

• Service enquiries: our retention criterion is the time needed to manage the enquiry and proposal. After handling is complete, only information needed for legal obligations or potential liabilities should be retained, restricted where required under Art. 32 of the Spanish LOPDGDD. If a service is contracted, additional contractual, accounting and tax record requirements apply; a five-year period is not automatically applied to every enquiry.
• Our own systems: the administration system and Baserow do not currently delete enquiries automatically based on age. Erasure and necessity reviews are handled manually; request erasure at [email protected]. Technical retention does not authorise reuse for advertising.
• Security logs and conversations: retention depends on their necessity to resolve incidents, provide requested assistance, comply with obligations or address applicable liabilities, with restricted access. There is no single period assigned to every type of record.
• Matomo analytics: the configuration enables periodic deletion of visit records older than 780 days and statistical reports older than 60 months (5 years), to compare website evolution and interest in our services across years. Basic metrics and monthly and annual reports are retained as historical records and excluded from automatic age-based deletion. These technical thresholds remain subject to keeping only what is needed for that purpose: personal information that is no longer needed must be erased or anonymised. Withdrawal stops future collection; exercise your rights at [email protected].
• Email and backups: erasure handling includes copies in our own systems and the email used to address the enquiry. Resend and operational backup conditions are detailed in the Newsletter section; requests requiring provider action are also referred to that provider.

4. Recipients and international transfers

Data is not sold for third-party purposes. Enquiry handling and website operation use our own systems and technical providers. Access is limited to the purpose and information needed for each operation:

• Infrastructure controlled by Ardeiro.AI: website hosting, enquiry administration, databases and automation. Baserow and Chatwoot are self-hosted. Requests from the appointment management and social media content landing pages are recorded in the administration system and Baserow; their Chatwoot alerts contain only the generic messages described in section 2.1.
• WhatsApp Business Platform (Meta group) — sending and receiving messages when the user contacts us via WhatsApp. Its data processing terms and transfer addendum describe processing on the business's behalf and transfers to the United States using the EU-US Data Privacy Framework or the alternative mechanisms stated there. More information: WhatsApp Business data processing terms and transfer addendum.
• OpenAI — processing of message content through a language model to generate the chatbot's automated replies. Its DPA provides for transfers outside the European Economic Area under Standard Contractual Clauses or applicable adequacy decisions. See the OpenAI Data Processing Addendum.
• Google Ireland Limited (Google Calendar) — managing availability and appointments booked through the chatbot.
• Resend (Plus Five Five, Inc., USA): emails notifying our team of requests, confirmations, newsletters and transactional communications. It processes recipients, email content and delivery records. Data is stored in the United States; its DPA includes Standard Contractual Clauses. See the Newsletter section for details and the DPA link.

International transfers arising from email delivery are described under Resend in the Newsletter section. Messaging channels and integrations you use have their own conditions. Request information about providers and applicable safeguards at [email protected].

5. Data subject rights

Exercise access, rectification, erasure, restriction, objection and portability where applicable by emailing [email protected]. Do not attach an identity-document copy by default: additional identity information will only be requested where reasonable doubts exist and limited to what is needed to resolve them. Consent may be withdrawn without affecting earlier lawful processing.

• Access: to know what data is processed about you.
• Rectification: to correct inaccurate or incomplete data.
• Erasure ("right to be forgotten"): to request deletion of your data when, among other cases, it is no longer necessary for the purpose for which it was collected.
• Restriction of processing: to request that processing of your data be restricted in certain circumstances.
• Objection: to object to processing based on the controller's legitimate interest.
• Portability: to receive your data in a structured and commonly used format so it can be transmitted to another controller.

We will respond within a maximum of one month from receipt of the request (extendable by two additional months in especially complex cases, with notice of the extension).

6. Right to lodge a complaint with the AEPD

If you consider that the processing of your data breaches applicable regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), the competent supervisory authority in Spain: www.aepd.es.

7. Minors

Ardeiro.AI services are intended exclusively for people over 18 years old or, where applicable, people over 14 years old with authorisation from their legal representatives. The controller does not knowingly collect data from children under 14. If it is detected that data from a minor has been received without the corresponding consent, it will be deleted immediately.

8. Cookies, local storage and analytics

Visual theme preference is stored in browser local storage (theme), not a session cookie. When using web chat, the identifier needed to retrieve that conversation may be stored (ardeiro_chatwoot_session). Delete these items through browser settings.

Visit analytics uses Matomo at analytics.ardeiro.ai. It starts only after you accept analytics. You can reject it or withdraw permission through the analytics preferences control without losing website or form access. Consent is the basis for this measurement (Art. 6(1)(a) GDPR).

Matomo, managed by Ardeiro.AI, may process your IP address, visited pages, traffic source, browser characteristics and interactions, including confirmed enquiry submission. New records mask two IPv4 octets and use the masked IP for visit-information enrichment. Conversion events do not contain form names, emails, phone numbers, business information or comments.

Matomo is configured with analytics cookies disabled. Your decision to allow or decline analytics is saved in local storage (ardeiro-analytics-choice-v1) for 180 days and then requested again. Withdrawal stops future measurement. We do not treat this configuration as consent-exempt: analytics runs only with your prior permission.

Clearing browser storage removes your saved choice and the website asks again. External videos and links have their own conditions when accessed.

Instagram reel and social media links: the embedded reel loads only after you select «Cargar el reel aquí» (load the reel here). Your browser then connects to Instagram servers and may share your IP address and browsing information under its privacy policy. Links to posts on Facebook, Instagram and LinkedIn open services outside Ardeiro.AI, subject to their own terms and privacy policies.

9. Security

The controller applies appropriate technical and organisational measures to ensure the security of personal data, including encryption of communications (HTTPS/TLS), system access control and limiting data access to strictly necessary personnel.

10. Changes to this privacy policy

The controller reserves the right to modify this policy to adapt it to legislative or case law changes, or to changes in industry practices. Relevant changes will be communicated to users who have provided their email, and the updated version will always be available at ardeiro.ai/en/privacidad.