Privacy policy

This is a courtesy translation. In case of discrepancy, the Spanish version prevails.

1. Data controller

• Controller: Francisco José Plaza González (sole trader), trading under the name Nyxel Labs
• NIF (Spanish tax identification number): 77238218D
• Address: Avenida de la Libertad, 82, 29120 Alhaurín el Grande, Málaga (Spain)
• Contact: hola@nyxel.es · +34 711 274 720

This policy applies to the data processed through nyxel.es and through the contact channels linked from it. It complies with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).

2. What data is processed and why

Contact by form, email, WhatsApp or telephone

Data: name, business name, email address or telephone number, and the information you include in your message (for example, which task you want to automate).

Purpose: to deal with your enquiry, carry out the free assessment and, if you ask for it, prepare a quotation.

Legal basis: taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and, where applicable, your consent when you send us the message (Art. 6(1)(a)).

Retention: for as long as the conversation lasts and, if no contract is entered into, up to 12 months from the last contact. If a contract is entered into, for the duration of the professional relationship and the statutory limitation periods (generally 5 years for contractual obligations and 4 years for tax obligations).

Call booking

The 20-minute call is booked on the website itself (nyxel.es/en/book, or nyxel.es/reservar in Spanish). Your name, business, telephone number, email address if you provide it, the text you write and the time you choose are stored in a database hosted by Cloudflare (Western Europe region). Purpose: to call you at the agreed time. This data is kept for 12 months from the call, unless a contract is entered into.

Website chat assistant

If you write to the assistant, your messages and its replies are stored, together with any contact details you decide to give it (name, telephone number or email address, what you want to automate and how many hours you spend on it). Purpose: to reply to you and, if you ask, for the owner to contact you. Legal basis: your request (Art. 6(1)(b) GDPR). The replies are generated by an artificial intelligence model from Anthropic, which receives the text of the conversation solely in order to generate the reply. This data is kept for 12 months, unless a contract is entered into. Your browser stores the conversation in its local storage so that it is not lost when you move to another page; you can delete it by clearing the site data.

Voice assistant (calls)

If you call Nyxel’s telephone number and I am unable to take your call, or if you use the call button at nyxel.es/llamar (in Spanish), you will be attended by an artificial intelligence voice assistant, which identifies itself as such at the start of the call. Your voice is converted into text in real time so that the assistant can understand you and reply; the call is not recorded and its transcript is not stored. Only the following are stored: the number you are calling from, the duration of the call, the details you decide to give (name, business, what you would like to automate) and a one-sentence summary of what you wanted, so that you can be called back or your message can be dealt with. For calls made from the website, in order to prevent abuse, an anonymous code calculated from your connection, which does not allow you to be identified, is also stored for 48 hours; while you are speaking, the page itself shows you the text of the conversation, but it is not stored. Legal basis: your request (Art. 6(1)(b) GDPR). This data is kept for 12 months, unless a contract is entered into. The voice platform provider deletes the technical data of the call after 30 days.

Browsing and usage statistics

The hosting provider (Cloudflare) temporarily logs technical data such as the IP address, the browser and the pages requested, in order to provide the service and protect it against attacks.

In addition, the site measures its use in aggregate form and without cookies or storage in your browser: pages viewed, sections read, time on the page, buttons clicked (WhatsApp, booking, email), the website you came from, device type and approximate city based on the network. To group together the actions of a single visit, an anonymous identifier is calculated from the IP address and the browser, combined with a random value that is changed and destroyed every day. The IP address is not stored, the identifier does not make it possible to recognise you from one day to the next, and it is not used for advertising or disclosed to anyone. It is only associated with a person if, during that same visit, you submit your details (booking, form or assistant). Legal basis: legitimate interest in knowing which parts of the website work and in improving it (Art. 6(1)(f) GDPR). The data is deleted after 13 months. You may object by writing to hola@nyxel.es.

The savings calculator runs in your browser: only the fact that it has been used is recorded, not the values you enter.

WhatsApp service for client businesses (Meta’s WhatsApp Business Platform)

When a business engages Nyxel Labs to automate its WhatsApp, we connect its WhatsApp Business number to the official WhatsApp API (Meta’s Cloud API) through Embedded Signup, while the business keeps using its mobile app (coexistence).

• Who is the controller: the client business is the controller of its customers’ data. Nyxel Labs acts as a data processor, on behalf of the business and in accordance with its instructions, under a data processing agreement (Art. 28 GDPR).
• What data: the telephone number and WhatsApp profile name of the person writing to the business, the content of the messages sent and received, their date and delivery status, and the booking or service details needed for each notification.
• For what purpose: solely to send and receive the business’s own messages: utility notifications (booking reminders, check-in instructions, notices about incidents) and the replies of its assistant. The data is not used for advertising, for profiling or for training models.
• Who is involved: WhatsApp Ireland Ltd. and Meta Platforms Ireland Ltd. (messaging platform), Cloudflare (hosting in the European Union) and, if the business activates the assistant, Anthropic (which generates the replies). We do not sell or disclose the data to third parties.
• The business remains in control: it continues to see and manage all its conversations from its WhatsApp Business app and can disconnect the integration whenever it wishes.
• Retention: for the duration of the contract with the business; when it ends, the data is deleted or returned to the business, unless there is a legal obligation to retain it.
• Your rights: if you have written to a business that uses this service, you can exercise them with that business or by writing to hola@nyxel.es, and we will pass your request on to the business.

3. Recipients and processors

No data is disclosed to third parties except where required by law. To provide the service, the following providers are used, acting as data processors:

• Cloudflare, Inc. (hosting and content delivery network). Headquartered in the USA, with data centres in the European Union. Transfers covered by the EU-US Data Privacy Framework and standard contractual clauses.
• Google LLC (Google Fonts). When the fonts are loaded, your browser sends your IP address to Google’s servers. Transfer covered by the EU-US Data Privacy Framework.
• Anthropic PBC (artificial intelligence model for the chat assistant and the WhatsApp assistant), only if you write to the assistant. Headquartered in the USA; transfers covered by standard contractual clauses.
• Retell AI, Inc. (voice assistant platform: speech recognition, conversation and call handling), with voices from ElevenLabs and language models from OpenAI, only if you call the assistant. Headquartered in the USA; transfers covered by standard contractual clauses. No recording and no stored transcript.
• Resend (sending of confirmation emails and notifications), only if an email needs to be sent to you.
• WhatsApp Ireland Ltd. (messaging), if you choose to write via WhatsApp, and WhatsApp Ireland Ltd. / Meta Platforms Ireland Ltd. as the platform for the WhatsApp service for client businesses (see section 2). Processing within the app is governed by WhatsApp’s policy.

When an automation is developed for a client, the data of the client’s business remains in the client’s own accounts and tools. The owner accesses it only to the extent necessary and under a data processing agreement (Art. 28 GDPR) signed before work begins.

Requests from public authorities

If a public authority requests personal data (including data received through Meta’s WhatsApp platform), Nyxel Labs follows these rules:

• Review of legality: before anything is disclosed, it is verified that the request comes from a competent authority and has a sufficient legal basis (for example, a court order).
• Challenge: if the request is considered unlawful, disproportionate or insufficiently substantiated, it is refused or challenged through the legal channels available.
• Data minimisation: only the data strictly necessary to respond to the request is provided.
• Record-keeping: each request is documented, together with the response given, its legal basis and the parties involved.

Where the law permits, the client business that is the controller of that data will be informed.

4. Your rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw any consent you have given, by writing to hola@nyxel.es and stating which right you wish to exercise. A copy of an identity document may be requested if there are reasonable doubts about your identity.

If you consider that the processing does not comply with the applicable regulations, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) (www.aepd.es).

5. Security

Technical and organisational measures appropriate to the risk are applied: encryption of communications (HTTPS), restricted access to data, two-factor authentication on work accounts and minimisation of the data collected.

6. Minors

The services are aimed at businesses and professionals. Data relating to children under the age of 14 is not knowingly collected.

7. Changes to this policy

This policy may be updated to reflect changes in the law or in the service. The date of the latest version appears at the top of the page.