Privacy Policy

The controller responsible for the personal data collected through this website is AizuaLabs, based in Málaga, Spain.

For any privacy-related query, you can contact us at: info@aizualabs.com

We only collect the data you voluntarily provide through the contact form:

• First and last name
• Email address
• Company name
• Message or project description

We do not collect sensitive data, payment data or banking information through this website.

The data collected is used exclusively to:

• Respond to your inquiry or audit request (legal basis: consent of the data subject, GDPR art. 6.1.a)
• Manage the business relationship and send proposals (legal basis: performance of a contract or pre-contractual measures, GDPR art. 6.1.b)
• Send you email updates on AI, automation, websites and SEO for business, only if you accepted them on the form or in the window shown after sending it (legal basis: your consent, GDPR art. 6.1.a and art. 21.1 of the Spanish LSSI-CE). You can withdraw it at any time using the unsubscribe link in every email or by writing to info@aizualabs.com.
• Send our clients communications about services similar to the ones they already contracted (legal basis: art. 21.2 LSSI-CE), with the option to object in every email.
• Comply with legal obligations where applicable (GDPR art. 6.1.c)

Your data will be kept for as long as necessary to handle your inquiry and, in the case of a contractual relationship, for the period required by applicable commercial and tax law (generally 5-6 years from the last transaction).

Data used to send you updates is kept until you unsubscribe or withdraw your consent.

After that period, the data will be securely deleted.

We do not share your data with third parties for commercial purposes. Your data may only be disclosed to:

• Technology service providers acting as data processors under contract, based in the EU or under adequate safeguards. As of this policy, they are:
  • Supabase — database and storage.
  • Vercel — website hosting and delivery.
  • Stripe — payment and subscription processing.
  • Resend — transactional email delivery.
  • Brevo — newsletter and marketing communications.
  • Twilio — voice calls and messaging.
  • 360dialog — WhatsApp Business messaging.
  • Anthropic and OpenCode — the language models that generate our agents' replies.
  • Google — Google Calendar (only if you connect your calendar to a booking agent) and Google Fonts.
  • PostHog — website usage analytics, EU-hosted.
• Public authorities when required by law.

If we add or remove a processor in the future, we will update this list.

If any technology provider is located outside the European Economic Area, we ensure that such transfer has the adequate safeguards provided for under the GDPR (adequacy decisions, Standard Contractual Clauses, etc.).

Under the GDPR (EU Regulation 2016/679) and Spain's LOPDGDD (Organic Law 3/2018), you have the right to:

• Access: request what data of yours we process.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion of your data when it is no longer necessary.
• Objection: object to processing under certain circumstances.
• Restriction: request that processing be restricted.
• Portability: receive your data in a structured, machine-readable format.
• Withdraw consent at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, email info@aizualabs.com stating your name, the right you wish to exercise and a copy of your ID document.

If you believe the processing does not comply with the regulation, you may file a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

This website includes a conversational assistant based on artificial intelligence. When you use it, we process the messages in the conversation and any contact details you voluntarily provide (name, email, phone).

• Purpose: to handle your query, follow up on it and, where applicable, prepare a commercial proposal.
• Legal basis: the taking of steps at your request prior to entering into a contract — writing in the chat is that request — and our legitimate interest in handling and following up on enquiries received (GDPR art. 6.1.b and 6.1.f). Consent is not requested because it is not the applicable basis; you may object to the processing at any time.
• Retention: 12 months from the last message, unless a contractual relationship begins, in which case the periods in section 4 apply.
• Processors and sub-processors: the assistant relies on language-model providers acting as sub-processors, some located outside the European Economic Area, with the safeguards set out in Chapter V of the GDPR (see sections 5 and 6).
• No automated decision-making: the assistant informs and hands over to a person; it does not take automated decisions producing legal effects concerning you or similarly significantly affecting you (GDPR art. 22).

Do not enter passwords, bank or card details, or special category data (health, political opinions, religion, ethnic origin, trade union membership, sex life or sexual orientation) into the chat. The assistant is instructed not to request or process them.

Without your consent, this website sets no cookies at all. This is not a generic promise: it was verified by measuring it in a clean browser, and before you decide anything there is not a single cookie from this site.

This is the complete inventory of what may be stored in your browser:

• aizua_cookie_consent — first-party, in local storage. Stores your choice about analytics, so we do not ask again on every page. Strictly necessary: without it the notice would reappear constantly.
• alw_uid and alw_cid_… — first-party, in local storage, and only if you open the chat. They link the messages of a single conversation so the assistant keeps track. They are created when you open the chat, not when the page loads.
• ph_…_posthog — from PostHog (usage analytics hosted in the European Union), a cookie plus local storage, and only if you accept analytics. It records page views and clicks on specific buttons and links. It does not record your screen, it does not automatically capture everything you do, and it is not used for advertising. If you withdraw consent, sending stops immediately and any identifier created is discarded.

Two further services are involved without storing anything in your browser: Google Fonts, which serves the site typefaces from Google servers and therefore receives your IP address; and Vercel Speed Insights, which measures load speed from our own domain and is provided by our hosting provider, who already receives every request. Neither sets cookies. Recipients are listed in section 5.

We do not use advertising or profiling cookies, and we do not share your browsing with advertising networks or social networks.

You can change or withdraw your consent at any time, with the same effort it took to give it:

🍪 Manage cookies

You can also clear this site's storage from your browser settings. Legal basis: art. 22.2 of the Spanish LSSI-CE for what is strictly necessary, and your consent (art. 6.1.a GDPR) for analytics.

We apply appropriate technical and organizational measures to protect your data against unauthorized access, loss, alteration or disclosure, including encryption in transit (HTTPS), access control and periodic security reviews.

We may update this policy periodically to reflect changes in our practices or in applicable regulation. We recommend reviewing it regularly. The date of the last update is shown at the top of this document.