Privacy
Privacy policy
What data we process, why, for how long, who with and how you can exercise your rights.
Updated
1. Controller and contact
- Controller
- Adrián Puig de la Morena (Meypi Developers)
- Tax ID (NIF)
- 49322385N
- hola@aipiter.com
- Website
- aipiter.com
This policy explains how personal data is processed on aipiter.com and in the Aipiter service, under the EU data protection regulation (Regulation (EU) 2016/679, GDPR) and Spanish Organic Law 3/2018 on data protection and digital rights. The controller’s address is in the legal notice.
2. Controller or processor, depending on the case
We are the controller of the data on this website, of demo requests and of client businesses’ accounts, with their support and billing.
When a business uses Aipiter to serve its customers, that business is the controller of those conversations, records and bookings: it decides what they are used for and how long they are kept. Aipiter processes them on its behalf, as a processor (article 28 GDPR), under the agreement it signs with each business. If you wrote to a business that uses Aipiter, its privacy policy explains that processing; this one tells you what Aipiter does with that data.
One business’s data is never used for another.
3. Website and demo data
- Browsing: the IP address, the date, the page requested and technical browser data, which the hosting provider logs to serve the website and protect it.
- Demo request: your name, your email, your company, what you want to solve and, if you give it, your phone or WhatsApp number; plus the language of the page and the version of this policy you accept.
- Form protection: an encrypted fingerprint of your IP address used only to slow down repeated submissions: it is not stored with your request and is deleted within about two hours.
- Email: whatever you tell us if you write to hola@aipiter.com.
Only if you accept it in the cookie notice does the website load Google Analytics and Microsoft Clarity to learn how it is used: which pages are visited, where the visit comes from and on what device. If you then start or send the form, they are told that it happened, without your name, your email or your message. The cookie policy has the details.
Microsoft Clarity also records clicks and scrolling on the page, with all text hidden: it does not see what you type into the form.
4. Data in the service for businesses
- Business account: name, email and role of the people on the team, their access and their second factor, support, and contract and billing details.
- WhatsApp channel: the identifiers of the WhatsApp Business account the business connects and the permissions it grants; the phone number and name the channel provides; messages, their dates and their sending, delivery and read status.
- Instagram channel: the identifier and username of the professional account the business connects, and the permissions it grants; for anyone who writes to it by direct message, their Instagram identifier, name and username (not their photo or followers) and the messages and files they send; the business’s replies, with their date and status. If one of the business’s rules requires it, whether the person follows the account is checked at that moment, without storing it.
- Instagram comments: Aipiter reads the comments on the business’s posts only to apply the rules the business switches on: a public reply and, if the rule says so, a private message to the person who commented. It does not store the text of the comment or the username of the person who wrote it; of their identifier it keeps only a fingerprint, never the identifier itself, for just as long as it takes to apply the rule’s limits and 7 days at most.
- Meta authorisations: the technical connection keys are used to operate the channel. We never ask for or store your Meta password.
- Records and operations: the business’s customer records (name, phone, email, language and notes), the contact decisions each customer has made, their bookings, their enrolments and their privacy requests.
- AI assistant: the text of the conversation it needs to reply, what it looks up and prepares, confirmations and the log of its activity.
Voice notes, images and other messages without text do not go to the assistant: someone on the business’s team reviews them.
5. Purposes and legal basis
| Processing | Purpose | Legal basis |
|---|---|---|
| Website | Serve it, protect it and fix faults | Legitimate interest in a secure website (art. 6.1.f GDPR) |
| Demo | Reply to your request and prepare the demo | Pre-contractual steps you ask for (art. 6.1.b GDPR) or, if you write on behalf of your company, our legitimate interest in handling a business contact (art. 6.1.f) |
| Form | Stop spam and abusive submissions | Legitimate interest (art. 6.1.f GDPR) |
| Measurement | Learn how the website is used in order to improve it | Your consent (art. 6.1.a GDPR and art. 22.2 LSSI), which you can withdraw at any time in «Cookie settings», at the foot of every page |
| Clients | Provide the service, manage accounts and handle support | Contract (art. 6.1.b GDPR) |
| Obligations | Meet tax and accounting duties and answer data protection requests | Legal obligation (art. 6.1.c GDPR) |
The legal basis for a client business’s conversations and operations is decided and explained by that business. We do not sell personal data, we do not use it for our own advertising, and requesting a demo does not subscribe you to anything.
Data coming from WhatsApp and Instagram is used to provide the features the business has switched on and to keep them secure. It is never used to monitor anyone, to sell profiles or to decide on employment, credit, housing or education.
6. Artificial intelligence
Aipiter’s assistant uses Google’s Gemini models, processed within the EU, and receives only what it needs to reply. It makes no solely automated decisions with legal effects on anyone (article 22 GDPR): it proposes, and the person confirms bookings and data changes.
What it does, which model it uses and what happens to the data it receives is set out under AI transparency.
7. Who else processes the data
These providers process website and demo data on our behalf, only for the purpose stated:
| Provider | Purpose | Where | Safeguard |
|---|---|---|---|
| Hostinger International Ltd. | Hosting of the website and the demo database, and the hola@aipiter.com mailbox | European Union, with a global delivery network | GDPR; standard contractual clauses for anything leaving the European Economic Area |
| Plus Five Five, Inc. (Resend) | Sending the notice of each demo to the team | Ireland (sending) and United States (company) | EU-US Data Privacy Framework and standard contractual clauses |
| Google Ireland Limited | Receiving the notice of each demo in the inbox of whoever handles them (Gmail) | European Union and United States | EU-US Data Privacy Framework and standard contractual clauses |
| Provider | Tool | Where | Safeguard |
|---|---|---|---|
| Google Ireland Limited | Google Analytics | European Union and United States | EU-US Data Privacy Framework and standard contractual clauses |
| Microsoft Ireland Operations Limited | Microsoft Clarity | European Union and United States | Standard contractual clauses with Microsoft Corporation |
The providers of the service for businesses, with what each one does and where, are listed under subprocessors. Meta processes WhatsApp and Instagram messages under its own relationship with each business and with you, and authorities receive data only when the law requires it.
8. International transfers
Some providers are US companies or use global networks. Those transfers rely on the safeguards in chapter V of the GDPR: the adequacy decision for the EU-US Data Privacy Framework for participating companies and, otherwise, the standard contractual clauses approved by the European Commission, with additional measures where needed. You can ask for a copy of those safeguards by writing to hola@aipiter.com.
9. How long we keep it
- Demo request: stored encrypted and deleted automatically after 90 days. The email notice we receive follows the period for emails.
- Emails: as long as needed to deal with your enquiry, at most 12 months, unless a business relationship begins or a law requires us to keep them longer.
- Website logs: the hosting provider keeps them for as long as it needs for security and diagnosis.
- Clients: for the length of the relationship and then for the legal periods: six years for commercial records (article 30 of the Spanish Commercial Code) and four years for tax matters (article 66 of the Spanish General Tax Law).
- Client businesses’ data: the period each business sets. When the service ends, it is returned or deleted as its agreement says, except what the law requires us to keep (article 28.3.g GDPR).
If you accept measurement, Google Analytics keeps visit data for the period set in its configuration, 14 months at most.
Microsoft Clarity keeps visit recordings for 30 days and heatmaps for 9 months.
In the service, server technical logs are kept for 30 days and message queues for 7 days at most. Gemini data caching is switched off: Google does not keep in memory what goes into and comes out of the model. It may log requests to monitor abuse, in line with its zero data retention policy.
10. Your rights
You can ask for access to your data, its rectification or erasure, the restriction of its processing and its portability, object to our processing it, and withdraw your consent at any time without affecting what was processed before.
Write to us at hola@aipiter.com; you do not need an Aipiter account. If your request concerns a business that uses Aipiter, tell us which one and which channel you used to write to it: we pass it on and help them handle it, because the decision is theirs. How to request erasure, step by step, is explained under data deletion.
We reply within one month at most; if the request is complex or there are many, the period may be extended by two more months and we will tell you so within the first month (article 12.3 GDPR). We will only ask for more information if there is reasonable doubt about your identity, and never for passwords or access codes.
You can also complain to the supervisory authority where you live or work, or to the Spanish one, the Agencia Española de Protección de Datos, without having to write to us first.
11. Children and sensitive data
The website and the service are aimed at businesses and professionals, not at children. The assistant never asks for card or account numbers, identity documents or health data, and a business must not use Aipiter to store clinical information.
12. Security
Getting into the dashboard takes a personal account and a second factor; each business’s data is kept apart from the others’, and the service’s data stays in the EU. The controls, one by one, are on the security page.
If a breach affects your data, we notify the supervisory authority within 72 hours and, if the risk is high, you as well (articles 33 and 34 GDPR). When we act as a processor, we tell the controller business without delay.
13. Changes to this policy
Every change is published here with its date at the top, and client businesses are notified of those that affect them.