In accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), we inform you about how your personal data is processed.
This English version is provided for convenience. The Spanish original (Política de Privacidad) is the legally binding text and prevails in the event of any discrepancy.
Through this website's contact form we collect the data you voluntarily provide: name, email, phone, company and the message or information relating to your enquiry. If you write to us through the website chat, we also collect the messages you send and any data you choose to give us in the conversation. If you ask our voice agent to call you, we collect your name and phone number: the call is made by an artificial intelligence agent and may be recorded and transcribed to provide the service.
The data is used solely to:
The legal basis for processing your data is the consent you give by ticking the acceptance box on the contact form.
The data will be kept for as long as there is a mutual interest in maintaining contact or the business relationship, and until the data subject requests its erasure, at which point it will be deleted after being blocked for the period required by law.
No data is disclosed to third parties unless required by law. To provide the service we use the following providers, which act as processors and with which the relevant contract under Article 28 of the GDPR has been signed:
The safeguards applicable to each of these transfers are detailed in the next section.
Some of the providers listed in the previous section process data outside the European Economic Area (EEA). These transfers rely on the mechanisms provided for in Chapter V of the GDPR, as follows:
You can request further information about these safeguards by writing to contacto@miaia.ai.
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability by sending an email to contacto@miaia.ai, stating the right you wish to exercise together with a copy of your identity document.
miaIA.AI acts as a Meta technology provider (Tech Provider) and, in that capacity, manages WhatsApp Business accounts on behalf of business clients. The processing described in this section is separate from that in the previous sections, which refer to the data you provide to us directly through this website.
Roles of the parties. The business client that contracts the platform is the controller of its own end users' data: it determines the purposes of the processing and is responsible for the lawfulness of the communications it sends. miaIA.AI acts as processor under Article 28 of the GDPR and processes that data solely on the client's documented instructions and for the purpose of providing the contracted service. If you are an end user and have written to a business that uses our platform, the controller of your data is that business; you can contact it directly or write to us at contacto@miaia.ai so that we forward your request to the controller.
Data we access and purpose. To provide the service, the platform accesses the following data from connected WhatsApp Business accounts:
Excluded uses. Data obtained through WhatsApp is not used to create or enrich user profiles, for advertising targeting, or to train general-purpose artificial intelligence models. It is not sold, transferred or licensed to third parties, nor combined with data from other sources for purposes other than providing the contracted service. The only third-party access is that of the infrastructure providers strictly necessary to operate the platform, subject to the relevant data processing agreement.
Automated text processing functions. The platform is a business messaging service. Among its auxiliary functions it includes automated text processing for specific customer service tasks: classifying the incoming enquiry, extracting the data needed to complete a request (for example, a date or a booking number) and suggesting or sending replies within the flows that the business client has configured beforehand.
For this purpose, the content of the specific message being handled and the minimum context strictly necessary from that same conversation are transmitted to OpenAI Ireland Ltd., which acts as processor. No contact databases, full histories or data unrelated to the ongoing conversation are sent. Under the OpenAI API terms, data sent through the API is not used to train or improve its models, nor to build profiles of end users.
These functions always operate within the customer service scope defined by the business that contracts the service and under its control. The platform does not offer, or provide access to, general-purpose artificial intelligence assistants through WhatsApp.
International transfers. Providing this service involves international data transfers, on the terms and with the safeguards detailed in section 7 of this policy.
Retention and deletion. Data is kept for as long as the client's account remains connected to the platform and the contract is in force. When the client disconnects its WhatsApp Business account or the contract ends, the associated data is deleted from active systems within a maximum of 30 days. In backup copies, data is deleted in the normal rotation cycle of those copies, within a maximum of 90 days of disconnection or of the request; while it remains in a backup it is encrypted, not actively used and available solely to restore the service after an incident. Data that must be kept by law is excluded; it is blocked and limited to that purpose. The detailed procedure, including how to request earlier deletion, is described on the data deletion page.
A cookie is a small file that is downloaded to your device when you visit a web page. This site uses its own and third-party cookies in accordance with Article 22.2 of Spanish Law 34/2002 (LSSI-CE) and the Spanish Data Protection Agency's Guide on the use of cookies.
Apart from strictly necessary cookies, no cookie is set until you give your consent. The measurement scripts are not even loaded until you accept: they do not merely sit inactive. You can accept them all, reject them all or choose by category from the notice shown on your first visit.
These do not require consent because without them the site cannot work or remember your choices. They are not used to track you or to build profiles.
Owner: Google Ireland Limited. Purpose: to learn, in aggregate, how many people visit the site, where they come from and which pages they view, in order to improve the content. They are not used for advertising or to build individual profiles, and Google Analytics 4 does not store the full IP address.
Owner: Microsoft Ireland Operations Limited. Purpose: to record, in aggregate, clicks, scrolling and pointer movement in order to spot friction points in the page design. Clarity masks content typed into forms by default, so it does not capture the data you enter in them.
The website chat runs on our own platform, hosted on our servers in the European Union. It is not loaded when you visit the page: it is only activated when you open it from the contact button, or when you come back to the website with a conversation already open. From then on it stores in your browser the cookie needed to provide the service you have requested:
You can change your decision at any time, as easily as you gave it, from the "Cookie preferences" link in the footer of every page. Withdrawing consent deletes the corresponding cookies that are under our control.
Your choice is kept for 12 months; after that period you will be asked again. Regardless of the above, you can block or delete cookies from your browser settings (Chrome, Firefox, Safari or Edge). Rejecting measurement cookies does not restrict access to any content on this site.
We reserve the right to amend this policy to reflect legislative or case-law developments. In such cases, the changes will be announced on this page reasonably in advance of their implementation.