Legal Notice and Privacy Policy

Last updated: 23 October 2026

This page contains the legal notice for Xerinolia's websites (xerinolia.com and core.xerinolia.com) and their privacy policy. It explains what personal data we process, why, on what legal basis, for how long and with whom we share it, how we handle the data we receive from WhatsApp and Meta, and how you can exercise your rights, including the right to ask us to delete your data. A summary comes first, followed by the full information.

1. Summary

Basic data protection information (first layer). Each point is developed in the sections below.

2. Legal notice

In compliance with Article 10 of Spanish Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (LSSI-CE), you are informed that the owner of the websites xerinolia.com and core.xerinolia.com is:

Xerinolia's activity is not subject to any prior administrative authorisation scheme. Xerinolia does not adhere to any code of conduct.

Accessing and using these websites makes you a user and implies acceptance of this legal notice. The owner reserves the right to modify the content of the websites without prior notice.

What core.xerinolia.com is

It is Xerinolia's technology platform (Xerinolia Core), which we use to configure and run AI assistants for our clients. It includes:

• the management console, with access restricted to Xerinolia's authorised staff;
• the demo pages, where we show a business how its assistant would work;
• the single-use links we send to our clients so that they can accept the contract, connect their WhatsApp number, or connect a calendar or another tool;
• the technical services for clients' assistants: the chat program that businesses embed in their websites and the connection endpoints used by WhatsApp, the phone and other services.

If you talk to a business's assistant (through its WhatsApp, the chat on its website or its phone line), the provider of that service and the controller of your data is the business. Xerinolia acts solely as a technology provider on its behalf. Use of the platform and of the public pages is governed by the Terms of Service.

Use of the websites

You may not use these websites for unlawful purposes, introduce malicious software into them, overload them, extract their content by automated means, or carry out load or penetration testing on them without Xerinolia's written authorisation. Only people to whom Xerinolia has issued credentials may access the console.

Intellectual property

All content on these websites (text, images, logos, design and code) and the Xerinolia Core software are owned by Albert Farré Puche or are published with the authorisation of their owners. Their reproduction, distribution or transformation is not permitted without express authorisation, except for uses permitted by law.

The names, logos and content of the businesses that appear in the demos belong to their owners, and Xerinolia uses them only to show the business a personalised demo. If you are the owner and want us to remove a demo, write to hola@xerinolia.com and we will remove it within 48 hours at the latest.

Some geographic data comes from OpenStreetMap: © OpenStreetMap contributors, available under the Open Database License (ODbL).

Liability

The owner is not liable for misuse of the content of the websites or for the content of third-party websites accessible through links (for example, Instagram or WhatsApp). The answers generated by artificial intelligence in the demos may be incomplete or inaccurate and do not constitute any offer, quotation or advice from Xerinolia or from the business they refer to.

XerinoliaCoreBot crawler

Xerinolia uses an automated crawler that identifies itself with the user agent XerinoliaCoreBot. It visits public pages of business websites to prepare a business's demo or the knowledge base of a business's assistant (at most 15 pages per website) and to carry out a basic technical analysis of the website for commercial prospecting purposes (section 6.3). It follows the instructions in the robots.txt file, does not log in and does not fill in forms. To stop its visits, add the lines User-agent: XerinoliaCoreBot and Disallow: / to your website's robots.txt.

Contact point

For any enquiry, notice of allegedly unlawful content or communication from authorities: hola@xerinolia.com, in Catalan, Spanish or English.

3. Data controller

The controller of the data described in this policy is Albert Farré Puche, a sole proprietor trading as Xerinolia, with NIF 78086337A and address at Avda. de les Basses, 8 — 25133 Vilanova de Segrià (Lleida), Spain.

For any matter concerning your data, write to hola@xerinolia.com with the reference “Data protection”, or by post to the address above.

Xerinolia has not appointed a data protection officer. The address above is the contact channel for all privacy matters.

This policy applies in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

4. When we are the controller and when we process data on behalf of a business

Xerinolia has two different roles, depending on the data concerned:

As controller (our own data)

We decide why and how this data is used:

• people who visit xerinolia.com or write to us through the contact form, by email or by WhatsApp (section 5);
• representatives and contact persons of business clients: contract, invoicing, evidence of acceptance, WhatsApp signup and calendar connection (section 6.1);
• users of the platform console (section 6.2);
• businesses to which we direct our commercial prospecting (section 6.3);
• businesses for which we prepare a demo, people who appear on their public website and people who try a demo (section 6.4);
• security logs of the console, the demo pages and the single-use links (section 6.5);
• the register of requests to exercise rights (section 6.6).

As processor (on behalf of business clients)

When a person writes to or calls a business that uses Xerinolia's assistants, the business is the controller of their data: it decides what the data is used for and how long it is kept. Xerinolia processes the data only on the business's documented instructions, under a data processing agreement (Article 28 GDPR), and does not use it for its own purposes. This includes WhatsApp, web chat and phone conversations, contacts, leads and bookings, evidence of consent, reports and alerts for the business, and technical logs of the assistants' traffic (section 7).

In these cases, the main information about the processing is in the business's privacy policy. If you write to us about this data, we will forward your request to the business within 1 business day at the latest and let you know.

Independent controllers

Some providers also process data for their own purposes, as independent controllers and in accordance with their own policies: Meta and WhatsApp (for their own purposes and for Facebook Login), Twilio (traffic data as a telecommunications operator) and Google, Microsoft and Cal.com (on their sign-in pages).

5. The xerinolia.com website and contact form

What data we collect and why

The data you voluntarily provide through the contact form or when you write to us by email or WhatsApp:

We do not create profiles, we do not make automated decisions with this data and we do not use it to send you unsolicited advertising.

The form fields marked as required are needed to reply to you; if you do not provide them, we will not be able to handle your request.

Automatically collected data. As with any website, when you visit xerinolia.com the server (OVHcloud) and Cloudflare's network automatically process your IP address, the date and time, the page requested and your browser, in order to serve the pages and protect the site against abuse and attacks (legitimate interest, Art. 6(1)(f) GDPR). These technical logs are kept for a limited time and we do not use them for analytics or advertising.

How long we keep it

Contact data is kept for as long as necessary to handle your request and for a maximum of 2 years from the last contact, unless a contractual relationship follows (in which case section 6.1 applies) or there is a legal obligation to retain it.

Who we share it with

We do not sell this data or transfer it to third parties. The following providers (processors) are involved in the technical operation of the website:

• OVHcloud (web hosting, servers in the EU).
• Cloudflare, Inc. (DNS, security and email routing). It may process IP addresses to provide the service.
• Resend / Amazon Web Services EMEA (sending the form emails, EU region).
• Google Fonts (fonts served by Google; when they load, your browser discloses your IP address to Google).

Some of these providers have their parent company outside the European Economic Area; in these cases the processing is covered by the European Commission's Standard Contractual Clauses or by the EU-US Data Privacy Framework (section 10).

6. Xerinolia Core platform: data we process as controller

6.1 Clients: representatives and contact persons

• Who: people who represent a business that is a client or is in the process of contracting, or who are its contact (owner, manager, the person who accepts the contract, the person who connects WhatsApp or a calendar, the people who receive alerts).
• Data: name, phone number and email of the owner or contact person; email addresses that will receive alerts, reports and security alerts; the business's trade name, legal name, NIF (tax ID) and address (which are also personal data if the client is a sole proprietor); communications and billing data.
  • When accepting the contract and the data processing agreement: the name of the person accepting and the business's NIF, the date and time, the IP address, the browser, the cryptographic digest (hash) and a full copy of the accepted document and of the list of sub-processors.
  • When connecting WhatsApp: a record of the signup with the date, the IP address and the identifiers of the WhatsApp Business account and of the number (details in section 8).
  • When connecting a calendar or another tool: the access authorisation (stored encrypted) and the identifier of the connected account; in the case of Microsoft, the account's name and email.
• Source: the person themselves or the business they represent.
• Purposes: preparing, entering into and performing the contract; providing the service, support and alerts; invoicing and complying with accounting and tax obligations; evidencing the contract and defending ourselves against possible claims.
• Legal basis: performance of the contract or pre-contractual measures (Art. 6(1)(b) GDPR); compliance with legal obligations (Art. 6(1)(c) GDPR); legitimate interest in maintaining the relationship with the contact persons of the client company and in keeping evidence of the contract (Art. 6(1)(f) GDPR and Art. 19 LOPDGDD).
• Retention: for the duration of the contract. Afterwards, blocked for the statutory periods: accounting records and invoices, 6 years; evidence of acceptance of the contract and of the data processing agreement, for as long as it is needed to evidence the contract or defend ourselves against claims, within the limitation periods for legal actions. When a client's data is erased, we keep a minimal record (name, legal name, NIF, sector, service type and dates).
• Recipients: the hosting providers listed in section 10; the accountants and banks that provide services to us; the Spanish Tax Agency and other authorities, where required by law. When you connect WhatsApp, you sign in directly with Meta; when you connect a calendar, with Google, Microsoft or Cal.com: each of them processes the sign-in data as a controller, in accordance with its own policy.
• Required data: identification, contact, billing and acceptance data are needed to enter into and provide the service; if you do not provide them, we will not be able to contract with you.

6.2 Console users

• Who: Xerinolia staff and sales collaborators with a console account.
• Data: name, email and role; password (stored only as a cryptographic hash, never in plain text); two-factor authentication secret (encrypted); date and IP address of the last access; sessions (IP address and browser); browser notification subscriptions, if you enable them; an audit log of the actions taken (what, when and from which IP address); assigned clients and prospective businesses, and logged activities.
• Purposes: providing access and managing the account; protecting the platform (authentication, two-factor authentication, detection of anomalous access); keeping a record of who has accessed data and what they did.
• Legal basis: the employment, commercial or collaboration relationship (Art. 6(1)(b) GDPR); legitimate interest in network and information security, and the security obligation (Arts. 6(1)(f) and 32 GDPR).
• Retention: sessions expire after 14 days at most, and earlier after 12 hours (administrators) or 24 hours (sales users) without activity; the audit log, 2 years; the account, for the duration of the relationship and, afterwards, for as long as necessary to preserve the integrity of the audit log.
• Limited access: users with sales functions can only see clients in demo mode, not the conversations of clients whose service is live.

6.3 Commercial prospecting aimed at businesses

• Who: companies, sole proprietors and professionals who might be interested in Xerinolia's services. A company's data is not personal data; the data of a sole proprietor or a professional is.
• Data: trade name or company name, sector, address, website, published business contact phone numbers and email addresses (at most five phone numbers and three email addresses), technical signals from the website (for example, whether it uses HTTPS or adapts to mobile devices), an opportunity score from 0 to 100, notes and activities of our team, the Xerinolia person assigned, and a record of when we informed you and of the checks made against advertising opt-out systems.
• Data we do not process: we do not store the NIF (tax ID) of sole proprietors; from the Official Gazette of the Commercial Registry (BORME) we only use data on companies and we do not store the names of directors or shareholders; from Google Maps we only keep the place identifier (place_id), and the other data we receive from it is shown to our team for one hour at most and is not stored.
• Source: publicly accessible sources (OpenStreetMap, the BORME, Google Maps Platform and the business's public website, analysed by our crawler); data you provide yourself; and lists that our team adds manually. At the first contact we will tell you the specific source of your data.
• How we will contact you: in person or by phone, always by a human being. We will not send you commercial emails, SMS or WhatsApp messages unless you have asked us to, and we do not make automated calls. If you are a sole proprietor or a professional, we will only call you after checking the Robinson List (the Spanish advertising opt-out register); otherwise, the contact will be in person.
• Purposes: identifying businesses that could benefit from our services, contacting them to present the services, preparing a demo for them if they are interested, and following up.
• Legal basis: Xerinolia's legitimate interest in making its services known to other businesses (Art. 6(1)(f) GDPR and Art. 19 LOPDGDD). We have balanced this interest against your rights: the data is professional and public, we make minimal use of it, we contact you through unintrusive means and you can object at any time.
• Information: we inform you of this processing at the first contact and, in any case, within one month of adding your data. If we have not informed you within that period, we erase your data.
• Right to object: you can object to prospecting at any time, without giving reasons, by telling the person who contacts you or by writing to hola@xerinolia.com. We will stop processing your data for this purpose and, so that we do not add you again in future searches, we will keep only a cryptographic digest (hash) in an internal suppression list.
• Retention: if we have not informed you, the data is erased within 30 days; if there is no activity, 12 months; if you decline our services, 90 days; the results of each search, 3 days; the suppression list, for as long as Xerinolia carries out commercial prospecting. If you become a client, section 6.1 applies.
• Recipients: only the hosting providers. We do not share this data with anyone.

6.4 Demos

a) Businesses for which we prepare a demo, and people who appear on their website.

• Data: the business's name, logo, opening hours, contact details, published services and prices, and the text of the public pages of its website (fifteen at most).
• Source: the business's public website and, if the business asked us for the demo, the business itself.
• Purpose: preparing a personalised demo so that the business can see how its assistant would work. The website text is sent to the AI provider so that it can suggest frequently asked questions.
• Legal basis: legitimate interest in demonstrating the service (Art. 6(1)(f) GDPR) or, if the business asked us for the demo, the application of pre-contractual measures (Art. 6(1)(b) GDPR).
• Retention: the text extracted from the website, 7 days; the business's profile, for as long as the demo is needed. We remove the demo within 48 hours at the latest if the business asks us to.
• Results: we only tell the business, in general terms, how the demo went. We never give it the conversations or the data of the people who tried it.

b) People who try a demo. A demo can be tried in the chat on the demo page, by writing to Xerinolia's demo WhatsApp number or with the browser voice test. In these cases, Xerinolia is the controller of the data. Demos are reserved for adults and we recommend that you use made-up data and do not enter health, banking or identity data, passwords or other people's data.

• Data:
  • Chat: the messages; a random browser identifier, which our server stores only as a cryptographic hash; the page you write from; and a cryptographic hash of the IP address to limit usage.
  • WhatsApp: the WhatsApp number or identifier, the profile name and the messages. If you write without a valid demo code, we do not store the message on the platform: it only passes through a temporary routing memory that expires automatically. While the demo line is running, the technical data that the WhatsApp service needs to encrypt and deliver messages with each number is kept.
  • Voice test: your voice is processed in real time to convert it into text and reply to you; we store the transcript, a summary and a cryptographic hash of the IP address. We do not record the audio.
  • In all cases: the conversation summary and a score of the interest shown, generated by the AI, and any data you voluntarily provide.
• Purposes: allowing you to try the assistant; allowing our team to assess how the demo went; and preventing abuse.
• Legal basis: Xerinolia's legitimate interest in showing its service, assessing how it performs and protecting it (Art. 6(1)(f) GDPR); for the person who asked us for the demo, the application of pre-contractual measures (Art. 6(1)(b) GDPR). You can object, including to the score.
• Retention: demo conversations are kept for a maximum of 90 days from each message, and the demo data is erased when it is no longer needed.
• Recipients: the AI providers that generate the replies, summaries and scores; ElevenLabs and Google, for the voice test; and WhatsApp, which provides the messaging service as a controller under its own policy (section 10).
• Safeguards: the assistant identifies itself as artificial intelligence from the first message. In a demo, nobody from the business attends to you: if you want to talk to a person at Xerinolia, write to hola@xerinolia.com.

6.5 Security and automatically collected data

• Who: people who access the console, the demo pages and the single-use links on core.xerinolia.com.
• Data: in the web server logs, the IP address, date and time, requested page, response code and browser; in the application logs, technical operating data; cryptographic hashes of the IP address to limit the number of requests; security alerts.
• Purpose: ensuring the security of the platform, preventing abuse and attacks, and diagnosing errors.
• Legal basis: legitimate interest in network and information security (Art. 6(1)(f) and Recital 49 GDPR) and the security obligation (Art. 32 GDPR).
• Retention: server and application logs are kept for a limited time and are rotated periodically; resolved alerts are erased after 180 days; the audit log, 2 years.

We process the technical logs of the requests made to business clients' assistants (web chat, WhatsApp and phone) on behalf of each business (section 7).

6.6 Requests to exercise rights

When you exercise a right, we store the request, the response and the dates, with the minimum data needed to identify it, so that we can show that we have dealt with it (Art. 6(1)(c) GDPR). We keep this record for 3 years.

7. Data we process on behalf of business clients

For transparency, this section describes the data we process as a processor when a person talks to a business client's assistant. The controller is the business, which sets the purposes and retention periods and must inform you through its own privacy policy. We process this data only to provide the service to the business, under the data processing agreement, and we do not use it for our own purposes.

What data

• WhatsApp: the phone number or WhatsApp identifier, the user identifier that WhatsApp assigns for each business, and the profile name and username; the content of messages (text, captions, file names, shared locations, shared contacts and button replies); the delivery status of messages; and the messages the business sends from the WhatsApp Business app. If the business uses the app and the assistant at the same time (coexistence), also the recent conversation history, up to the retention period it has set, and the names in its contact book, which are used only to update the names of contacts we already hold.
• Voice notes and images: we do not store audio, image or video files. If the business enables voice note transcription or image description (disabled by default), the file is processed in memory only and we store the transcript or the description, encrypted.
• Web chat: the messages; a random visitor identifier, which the server stores only as a cryptographic hash; the page the visitor writes from (without parameters); and a cryptographic hash of the IP address to limit abuse. The chat session lasts 6 hours.
• Phone: the calling number, and the transcript, summary and duration of the call. By default, the audio is not recorded; if the business enables recording, the opening message says so. Each answered call generates a contact record for the business, unless the person says they are a minor.
• Derived data: a summary of the conversation, the intent, a score from 0 to 100 of the likelihood that the person will become a customer of the business (with the reason), contact records (leads) and booking records, and evidence of consent (for example, to receive appointment reminders).
• Technical logs of the assistants' traffic.

What for

Answering enquiries, handing the conversation over to a person at the business when needed, managing appointments, sending appointment reminders to those who have consented, and sending the business alerts and reports on its assistant's activity.

How long

• Conversations: the period set by the business; by default, 90 days. A daily task erases those that have exceeded it.
• Conversation content copied into leads and bookings is erased within the same period.
• Contact details in leads and bookings: for as long as the business needs them, until it requests their erasure or until the contract ends.
• The business's test conversations: 7 days.
• Phone conversations held by the voice provider: the same period that the business has set for conversations.
• Evidence of consent (for example, to receive appointment reminders): for as long as the processing lasts and for up to 3 years afterwards, so that it can be demonstrated.
• When the contract ends, we erase all the data we process on the business's behalf within 45 days at the latest (after a 30-day period during which the business can ask for a copy), except data that the law requires us to keep (Terms of Service, section 14).

How to exercise your rights

Contact the business directly. If you write to us (hola@xerinolia.com), we will forward the request to the business within 1 business day at the latest and carry it out when the business instructs us to. More information at How to request deletion of your data.

8. WhatsApp and Meta data

This section explains how we process the data we obtain from Meta through the WhatsApp Business Platform (WhatsApp Cloud API), Meta's Embedded Signup and Facebook Login for Business. In this policy we refer to it as “Platform Data”.

8.1 How it works

• Xerinolia acts as a Tech Provider of the WhatsApp Business Platform: the business client connects its number to our Meta app so that the assistant can receive and reply to messages.
• The signup is carried out by an authorised person at the business in a Meta window, where they log in, choose or create the WhatsApp Business account (WABA) and the number, accept Meta's and WhatsApp's terms, and grant Xerinolia's app the whatsapp_business_management and whatsapp_business_messaging permissions.
• The business remains the owner of its WhatsApp Business account and of its number, and keeps full access to them from Meta's WhatsApp Manager. It can withdraw Xerinolia's access at any time (instructions).
• We process Platform Data only on behalf of the business client and on its instructions, as a processor, and we keep each client's data separate.

8.2 What Platform Data we receive

When the business signs up:

• a single-use code, which Meta delivers to the signup page and which we immediately exchange for an access authorisation to the business's WhatsApp Business account; the code is neither stored nor logged;
• the access authorisation (token) and, if Meta provides it, its expiry date;
• the identifiers of the WhatsApp Business account, of the number and of the business portfolio; the number in international format; the verified name; the number's quality rating; whether the number also uses the WhatsApp Business app (coexistence), and the platform type;
• the technical signup data and, for security purposes, the date and the IP address from which the signup is made;
• if the number is registered on the API only, a 6-digit two-step verification PIN that Xerinolia generates and stores encrypted; if the number uses coexistence, we ask Meta for the one-time synchronisation of the app's contacts and history.

We do not request or store data from the personal Facebook profile of the person carrying out the signup (such as their photo, friends or posts).

While the service is provided, Meta sends us notifications (webhooks) about:

• the messages the business receives from its end customers and the delivery status of the messages sent (data described in section 7);
• the messages the business sends from the WhatsApp Business app and, in coexistence, the history and status of contacts;
• changes to the account, to the quality rating and messaging limit of the number, and to the status of message templates.

We store, linked to the business's channel: the identifiers, the number, the display name, the quality rating and the messaging limit; the access authorisation and the PIN, encrypted; the latest account events and the status of the templates; and synchronisation counters.

Calls we make to Meta: checking the status of the number every 15 minutes; sending the assistant's replies within the 24-hour window following the end customer's last message; sending appointment reminder templates only to people who have given their explicit consent; downloading media files from Meta only when the business has enabled transcription or description; and, when a channel is disconnected, unsubscribing the app from the account.

8.3 What we use it for

Only to provide the business with its assistant service: replying to messages, routing them, handing the conversation over to a person at the business, alerting the business and the Xerinolia team to channel incidents, maintaining the number's connection, and sending reminders to people who have consented. The platform has no bulk messaging function and blocks promotional messages that do not have recorded consent.

8.4 How we protect it

• The access authorisation and the PIN are encrypted with AES-256-GCM using a key specific to each client, and the encryption is bound to the client and to the purpose. They are decrypted only at the moment of making a call to Meta and never appear in logs, job queues or platform responses.
• We verify the signature of every notification from Meta and raise an alert if we receive several invalid ones within a short time.
• Each client's data is kept logically separate and our staff's access is limited by roles (section 15).

8.5 Who we share it with

Platform Data is disclosed only:

• to the business client to which it belongs;
• to the providers that process it on our behalf to provide the service (hosting and backups, the AI models that generate the replies and, if the business enables it, voice note transcription), which have committed in writing to confidentiality and data protection obligations (section 10); and
• to the authorities, when the law requires us to do so.

We do not sell, license or purchase Platform Data, and we do not use it for advertising, to build or augment profiles of individuals (the only assessment we make is the contact score that the assistant calculates for the business from the content of the conversation itself, section 12), to make decisions about their eligibility (for example, for credit, housing, employment or insurance), to discriminate, or for any kind of surveillance.

8.6 Meta and WhatsApp

Meta and WhatsApp process the messaging service data on behalf of the business and also as independent controllers for their own purposes, in accordance with their terms and privacy policy. WhatsApp may process and transfer data to the United States and other countries. Local storage in the EU for the WhatsApp API is not enabled. To find out how Meta processes data, see the WhatsApp Privacy Policy and the Meta Privacy Policy.

8.7 Retention and erasure

• Conversations and contacts follow the period set by the business (section 7).
• If the business removes our app's access from Meta, we receive the notice, mark the channel as disconnected and stop using the access authorisation. We delete the access authorisation when the business asks us to and, at the latest, when the contract ends, at which point we also unsubscribe the app from the account.
• We erase Platform Data when the data subject or the business requests it, when the business stops being a client, when the data is no longer necessary for the purpose for which we obtained it, when we stop providing the service, or when Meta asks us to, unless the law requires us to retain part of it.
• How to do it: How to request deletion of your data.

8.8 Compliance with Meta's and WhatsApp's terms

We process Platform Data only as described in this policy and in accordance with the Meta Platform Terms, the Developer Policies, Meta's and WhatsApp's terms for the WhatsApp Business Platform, and the WhatsApp Business Messaging Policy. We contractually require our clients to comply with them as well (Terms of Service). If Meta asks us to, we delete Platform Data or suspend a client's service.

8.9 WhatsApp signup page

The WhatsApp signup page (a single-use link on core.xerinolia.com) loads Meta's Facebook software development kit (SDK), which is needed to open the Embedded Signup window. See section 17.2.

9. Artificial intelligence

• AI notice. On WhatsApp and web chat, the first message says, for example: “Hi! I'm the virtual assistant (AI) of {business}. If you'd rather talk to a person, just let me know.” On the phone, the opening message says “Hello, you are being assisted by an artificial intelligence assistant” and warns that the call is transcribed (and, if the business has enabled it, recorded). The business cannot disable these notices.
• Human attention. The assistant hands the conversation over to a person at the business when the person asks for it and in situations that require it; requests to exercise rights and complaints are handed over to a person. When someone at the business replies from the app, the assistant stops replying in that conversation for 120 minutes.
• Limits. The assistants are dedicated to each business's customer service. They do not make diagnoses or give medical advice; in an emergency, they refer people to 112. AI answers may contain errors.
• Models. Replies, summaries and scores are generated by the AI model providers listed in section 10. For each business, only the providers on the list of sub-processors it has accepted are used. For healthcare businesses and professional firms, text AI models are only used in EU locations; the phone assistant, if the business takes it, runs on ElevenLabs in the US.
• No training. Xerinolia does not use conversations or Platform Data to train, fine-tune or improve AI models, and uses text model providers under commercial terms under which they do not train their models on this content.
• No biometrics. We do not use voice to identify anyone and we do not perform emotion recognition.
• Minors. If the person says they are a minor, the assistant does not ask them for any data or store any contact record about them.

10. Recipients, providers and international transfers

We do not sell personal data or share it for advertising. The following providers have access to it, processing it on our behalf (or, where indicated, as independent controllers), only to the extent necessary for each service:

When the platform sends alerts to the team by email or through a notification service, it does so through providers acting as processors. The list of sub-processors that applies to each client, with the location and safeguard of each one, is set out in the annex to that client's data processing agreement.

The advisers who keep our accounts and the banks that handle payments may also access clients' billing data, as may public authorities and courts when required by law.

The business's own tools. When a business connects its calendar (Google Calendar, Microsoft 365, Cal.com) or its CRM (for example, HubSpot, Pipedrive, Holded, Zoho, Odoo, Salesforce or Dynamics), we send it the data the business indicates, on its instructions. These providers are the business's providers, not Xerinolia's.

Where the data is located. The platform server and its backups are in the EU. Some providers process data outside the EU: voice (ElevenLabs), telephony (Twilio), some AI models (Anthropic and, if enabled, OpenAI) and Meta.

Transfers outside the European Economic Area. When a provider processes data outside the EEA, the transfer is based on the Standard Contractual Clauses approved by the European Commission, with the necessary supplementary measures, and, where the provider is certified under it, on the adequacy decision for the EU-US Data Privacy Framework. You can request information about these safeguards at hola@xerinolia.com.

11. Retention periods

We keep data only for as long as necessary for each purpose. Afterwards, we erase it or, where the law requires us to retain it, we keep it blocked, available only to judges, courts and competent authorities.

12. Profiling and automated decisions

Xerinolia does not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. We carry out the following simple automated assessments, which are a form of profiling:

• Opportunity score for prospective businesses (from 0 to 100), based on technical signals from the website, the sector and the contact details available. It only serves to help our team prioritise its work; it is always a person who decides whether to contact you.
• Interest score for the interest shown in demos, so that our team can assess how the demo went.
• Contact score that the assistant produces for the business client (from 0 to 100, with the reason), based on the content of the conversation itself. We produce it on behalf of the business, only so that it can prioritise follow-up and receive alerts about priority contacts. The contract prohibits the business from using it to take automated decisions.

You can object at any time by writing to hola@xerinolia.com or, in the case of the contact score, to the business.

13. Your rights

You can exercise the following rights at any time:

• Access: to know whether we process your data and to obtain a copy of it.
• Rectification: to correct inaccurate or incomplete data.
• Erasure: to ask us to delete your data, among other cases when it is no longer necessary, when you withdraw your consent or when you object to the processing. This right is available to everyone, wherever they are.
• Objection: to object to processing based on legitimate interest, including profiling. In the case of commercial prospecting, the objection is absolute: we will stop processing your data for that purpose without you having to give any reason.
• Restriction of processing: to ask us to keep the data but not use it while a complaint or an objection is being resolved.
• Portability: to receive, in a structured, machine-readable format, the data you have provided to us, where the processing is based on consent or on a contract.
• Withdrawal of consent at any time, without affecting the lawfulness of the processing carried out beforehand.

How. Write to hola@xerinolia.com with the reference “Data protection”, or by post to Avda. de les Basses, 8 — 25133 Vilanova de Segrià (Lleida), Spain, stating which right you wish to exercise. We will only ask you for additional information to identify you if we have reasonable doubts about your identity, and in that case we will ask for the bare minimum. If a representative acts on your behalf, they must provide proof of their authority.

Time limit and cost. We will reply within one month of receiving the request. This period may be extended by two further months if the request is complex or we receive a large number of requests; in that case we will inform you within the first month. Exercising your rights is free of charge.

Data processed on behalf of a business. If the data comes from conversations with a business's assistant, contact the business. If you write to us, we will forward the request to the business within 1 business day at the latest.

Complaint. If you believe we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) or the Catalan Data Protection Authority (APDCAT).

14. How to request deletion of your data

You can ask us to delete your data at any time. We have prepared a page with step-by-step instructions for each case: How to request deletion of your data. In short:

• If you have talked to a business's assistant (WhatsApp, web chat or phone): contact the business or write to us at hola@xerinolia.com with the subject “Data deletion”, the phone number you used and the name of the business.
• If your business has connected WhatsApp to Xerinolia: you can remove our app's access from Meta Business Suite and ask us to erase the data.
• If you have tried a demo, if we contacted you for prospecting or if you wrote to us from the website: write to us at the same address.

15. Security

We apply administrative, physical and technical measures appropriate to the risk, including:

• encrypted connections (HTTPS with TLS 1.2 or 1.3, and HSTS);
• encryption with AES-256-GCM and client-specific keys of WhatsApp access authorisations, PINs, integration credentials and two-factor authentication secrets;
• passwords stored using a strong cryptographic hash (scrypt), two-factor authentication for administrators, protected session cookies and session expiry after inactivity;
• role-based access, on a least-privilege basis, and an audit log of actions;
• logical separation of each client's data;
• rate limiting and signature verification of notifications from Meta and ElevenLabs;
• a server in the EU, with isolated containers and a database that cannot be accessed from the Internet;
• measures against manipulation of the assistants through malicious instructions;
• removal of secrets from technical logs;
• encrypted backups.

If a security breach affecting personal data occurs, we will act in accordance with the GDPR and, if it affects a business client's data, we will inform the client so that it can meet its obligations.

Reporting a vulnerability. If you detect a vulnerability or a security issue, write to hola@xerinolia.com with the subject “Security”, without exploiting it or accessing third-party data. We will reply as soon as possible.

16. Minors

Xerinolia's services are aimed at businesses and professionals, and demos are reserved for adults. We do not knowingly collect data from minors. If a person tells an assistant that they are a minor, the assistant does not ask them for any data, does not create any contact record about them and does not make bookings for them.

17. Cookies and local storage

17.1 xerinolia.com

This website does not use cookies. Neither first-party nor third-party cookies, and neither advertising nor analytics cookies.

The only storage technology we use is your browser's localStorage, solely to temporarily save the text of the contact form while you fill it in, so that you do not lose what you have written. This information never leaves your device, is not sent to us and is deleted automatically when you submit the form. As a strictly technical function requested by the user, it is exempt from consent under Article 22(2) LSSI-CE. Fonts are loaded from Google Fonts (section 5).

17.2 core.xerinolia.com

The platform does not use cookies or any other technologies for analytics or advertising (the only exception is Meta's kit on the WhatsApp signup page, explained below), and the fonts are hosted on the same server. Apart from that, it only uses the technical elements necessary for the service you have requested:

• Contract acceptance page: does not use cookies or local storage.
• WhatsApp signup page: when it is opened, Meta's Facebook software development kit (SDK) is loaded, which is needed for Embedded Signup. Meta may read or set cookies on its own domain and receive browsing data and automatic technical events from the page, in accordance with its cookie policy. Xerinolia has no access to them and does not use them for advertising. This page is only used by the representatives of businesses that connect WhatsApp.
• Calendar connection: we redirect you to the sign-in page of Google, Microsoft or Cal.com, which apply their own policies.
• Third-party resources in demos: the business's logo is loaded from its own website (which receives the visitor's IP address, but not the address of the demo page); if you start the voice test, your browser connects to ElevenLabs and, in some browsers, may download an audio component from the jsDelivr network.

17.3 Xerinolia chat on business websites

The business owns its website and is responsible for its cookie policy. The chat it embeds uses:

These elements are normally created when the visitor opens the chat. If the chat is embedded within the page, or if there has been a conversation in the last 24 hours, they are created when the page loads; in that case, the business must assess whether it needs the visitor's consent. When the page loads, the browser downloads the chat program from core.xerinolia.com, which receives the visitor's IP address as the business's processor.

17.4 How to manage them

You can delete cookies and local storage at any time from your browser settings. If you delete the session cookie, you will have to log in again; if you delete the chat storage, you will start a new conversation. If in the future we introduce cookies or tools that are not strictly necessary, we will update this policy and ask for your consent before activating them.

18. What we do not do with data

• We do not sell personal data or Platform Data, and we do not license or buy it.
• We do not advertise using the data, nor do we use analytics or advertising tools; the only third-party technology of this kind is Meta's kit on the WhatsApp signup page (section 17.2).
• We do not train AI models on conversations or Platform Data.
• We do not use the data of businesses' customers for our own purposes (for example, for our prospecting), nor do we combine it with that of other clients.
• We do not take automated decisions with legal effects, we do not determine anyone's eligibility for services such as credit, housing, employment or insurance, and we do not use data to discriminate against or monitor people.
• We do not send commercial communications by email, SMS or WhatsApp to anyone who has not asked for them.

19. Changes to this policy

We may update this policy to adapt it to regulatory, technical or service changes. We will publish any change on this page, with the date of the update. If the change is significant, we will notify our clients and console users through the usual channels before it applies to them. This policy is available in Catalan, Spanish and English, and all versions are equally valid.

20. Contact

For any question about this legal notice or about the processing of your data: hola@xerinolia.com or Avda. de les Basses, 8 — 25133 Vilanova de Segrià (Lleida), Spain.

Related documents: Terms of Service · How to request deletion of your data.