1. Data Controller
In compliance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD):
- Owner: Codelabs Studio, S.L.
- Tax ID (CIF): B88708797
- Registered address: Pasaje Federico García Lorca, 6, 3º E, 29130 Alhaurín de la Torre (Málaga), España
- Registration details: Registro Mercantil de Málaga (Companies Registry of Málaga), sheet MA-198508, entry 1
- Phone: +34 910 781 801
- Privacy email: privacidad@agenteuno.ai
- General email: legal@agenteuno.ai
- Trade name: AgenteUno
2. Personal Data We Collect
2.1 Data provided directly
- Registration data: Full name, email, phone, company name
- Billing data: Payment information processed by Stripe (we do not store bank card data)
- Contact data: Name, email, company, phone, subject and message sent through forms
2.2 Data generated through service use
- Configuration data: AI agent settings, conversation flows, knowledge bases
- Conversation histories: Chat messages, WhatsApp, SMS, email and social media interactions
- Voice data: Recordings and transcriptions of phone calls handled by AI agents
- Voice profiles: Audio samples used for agent voice cloning (provided by account holder, not end user)
2.3 Technical data collected automatically
- Browsing data: IP address, browser type, operating system, pages visited
- Cookies: Strictly necessary, plus cookieless product analytics (Plausible, self-hosted in the EU), marketing attribution (
au_attr) and advertising (Meta Pixel,_fbp/_fbc) only with your consent (see Cookie Policy) - Error data: Anonymous error reports through Sentry (no personally identifiable data)
3. Purposes of Processing
| Purpose | Legal basis (GDPR) | Data processed |
|---|---|---|
| Provision of contracted service | Art. 6(1)(b) Contract performance | Registration, configuration, conversations, voice |
| Billing and payment management | Art. 6(1)(b) Contract performance | Billing |
| Customer support | Art. 6(1)(b) Contract performance | Contact, registration |
| Service communications | Art. 6(1)(b) Contract performance | |
| Marketing communications | Art. 6(1)(a) Consent | |
| Error monitoring and stability | Art. 6(1)(f) Legitimate interest | Technical data (anonymous) |
| Legal compliance | Art. 6(1)(c) Legal obligation | Billing, consent records |
| Service improvement (aggregated) | Art. 6(1)(f) Legitimate interest | Anonymized usage data |
4. Voice Data and Artificial Intelligence Processing
4.1 How we process voice
When an end user interacts with an AgenteUno voice agent:
- The call is handled by an artificial intelligence system (not a person)
- Voice is transcribed to text using speech recognition services
- Text is processed by a language model (LLM) to generate a response
- The response is synthesized into voice using TTS (text-to-speech) technology
4.2 AI Transparency
In accordance with Regulation (EU) 2024/1689 (EU AI Act):
- All voice agents clearly identify that the user is speaking with an artificial intelligence assistant
- End users have the right to request transfer to a human operator
- We do not use voice to biometrically identify individuals. We analyse the sentiment of the conversation (inferred by AI from the transcript, not from voice tone) for service-quality purposes; this analysis is not used for automated decisions with legal effects nor to infer special category data
4.3 Voice data and automated decision-making
In accordance with Art. 22 GDPR:
- AI agent responses are generated automatically based on the knowledge base configured by the account holder
- These automated decisions do not produce legal effects and do not significantly affect the end user
- If an interaction could have significant effects, the user may request human intervention
5. Data Processors (Sub-processors)
We share data with the following providers, all under Data Processing Agreements (DPA) pursuant to Art. 28 GDPR:
| Provider | Purpose | Data location | Basis |
|---|---|---|---|
| Hetzner Online GmbH | Server infrastructure, application hosting and deployment | Germany (EU) | DPA |
| Stripe Inc. | Payment processing | EU (configured region) | DPA + SCCs |
| Telnyx LLC | Telephony and voice calls | EU (dedicated infrastructure) | DPA + SCCs |
| Sentry (Functional Software Inc.) | Error monitoring | EU (configured region) | DPA + SCCs |
| Plausible (self-hosted, analytics.codelabs.studio) | Aggregate web analytics, cookieless (consent only) | EU (Germany) | Own processing |
| Groq Inc. | Natural language processing (LLM) and voice transcription (Whisper) | USA (Zero Data Retention enabled) | DPA + SCCs |
| Cerebras Systems Inc. | Natural language processing (LLM) of the agents' chat messages (web, WhatsApp and other text channels) | USA | DPA + SCCs (not certified under the DPF) |
| Google LLC | Real-time conversational voice engine (Gemini Live): understanding the caller's speech and voice synthesis | USA/EU (depending on region) | DPA + DPF + SCCs |
| Cloudflare, Inc. | Call recording storage (R2) | EU (configured region) | DPA + SCCs |
| Meta Platforms, Inc. | WhatsApp, Instagram DM and Facebook Messenger messaging; and advertising pixel (Meta Pixel) on agenteuno.ai, only with your advertising consent | USA/EU (depending on region) | DPA + SCCs |
| Resend | Transactional email delivery (verification, password reset, notifications) | USA | DPA + SCCs |
| ElevenLabs, Inc. | Voice synthesis (TTS) for agent calls, includes caller name and appointment details | USA | DPA + SCCs |
Note: Most providers process data on servers located in the EU. Groq (LLM) processes in the USA with Zero Data Retention enabled; Cerebras (chat messages) and Google LLC (voice) process in the USA. These transfers are made under Standard Contractual Clauses (Art. 46(2)(c) GDPR); the transfer to Google LLC is also covered by the EU-US Data Privacy Framework (DPF). For more information, see the international transfers section.
6. International Data Transfers
Most of our providers process data exclusively on servers located in the European Union. For natural language processing (LLM), we use Groq Inc. (USA) with Zero Data Retention enabled, meaning request content is not stored on their servers. This transfer is made under Standard Contractual Clauses (SCCs) approved by the European Commission, pursuant to Art. 46 GDPR.
Language model providers and international transfers. The conversational assistant on this site runs on AgenteUno. Chat messages are processed by Cerebras Systems Inc. (United States) as data processor. In voice conversations, the audio and its transcript are processed by Google LLC (Gemini Live, United States). Google LLC is certified under the EU-US Data Privacy Framework (DPF), so that transfer relies on the European Commission's adequacy decision, and its data processor terms also incorporate the standard contractual clauses. Cerebras Systems Inc. is not on the DPF list: the transfer to this provider relies on the standard contractual clauses (Implementing Decision (EU) 2021/914) incorporated into its data processing agreement (DPA).
The safeguards applied for transfers outside the EEA are:
- EU-US Data Privacy Framework (DPF): European Commission adequacy decision, applicable to Google LLC
- Standard Contractual Clauses (Art. 46(2)(c) GDPR): Implementing Decision (EU) 2021/914
- Zero Data Retention: the provider does not retain communication content
- Transfer Impact Assessment (TIA): we verify that safeguards are adequate
7. Data Retention
| Data type | Retention period | Legal basis |
|---|---|---|
| Account data | While account is active + 5 years | Legal obligation (Commercial Code) |
| Conversation histories | Per plan: 90 days (Free/Starter), 365 days (Growth/Business), 730 days (Enterprise) | Contract performance |
| Voice recordings | Same window as the associated conversation (90/365/730 days per plan) | Contract performance |
| Billing data | 6 years | General Tax Law (Art. 66) |
| Consent records | Duration of processing + 3 years | Legitimate interest (proof of consent) |
| Technical logs | 90 days | Legitimate interest |
| Anonymized/aggregated data | No limit | Not personal data |
After the indicated periods, data is securely and irreversibly deleted.
8. User Rights
Under Arts. 15-22 of the GDPR and Title III of the LOPDGDD, you may exercise:
- Right of access (Art. 15): obtain confirmation and a copy of your data
- Right to rectification (Art. 16): correct inaccurate or incomplete data
- Right to erasure (Art. 17): request deletion of your data ("right to be forgotten")
- Right to restriction (Art. 18): restrict the processing of your data
- Right to portability (Art. 20): receive your data in a structured, commonly used, machine-readable format
- Right to object (Art. 21): object to processing based on legitimate interest
- Right not to be subject to automated decisions (Art. 22): request human intervention
How to exercise your rights
- Email: privacidad@agenteuno.ai
- Response time: Maximum 30 days (extendable to 60 days in complex cases, with prior notification)
- Identification: We may request proof of identity to protect your data
Right to lodge a complaint
If you believe your rights have not been adequately addressed, you may file a complaint with:
Spanish Data Protection Agency (AEPD)
- Web: www.aepd.es
- Address: C/ Jorge Juan, 6, 28001 Madrid
- Phone: 900 293 183
9. Cookies
We use strictly necessary cookies for platform functionality. Product analytics (Plausible, self-hosted in the EU) sets no cookies and stores no identifier on your device; it is still only activated with your consent, just like the marketing attribution cookie (au_attr, first-party, 90 days) and the Meta Pixel advertising cookies (_fbp, _fbc), which only install with your advertising consent, separate from your analytics consent. See our Cookie Policy for detailed information.
10. Security
We apply technical and organizational measures in accordance with Art. 32 GDPR:
- Encryption in transit (TLS 1.3) and at rest (AES-256)
- Access control based on principle of least privilege
- Multi-factor authentication for system access
- Daily encrypted backups with 30-day retention
- Continuous security and error monitoring
- Regular security audits
11. Minors
In accordance with Art. 7 of the LOPDGDD, the processing of data of minors under 14 years of age requires parental or guardian consent. AgenteUno is not directed at minors under 14.
12. Google User Data (Google Calendar and Google Contacts)
If you connect your Google Calendar to AgenteUno, we access data from your Google account only with your explicit authorization and only to provide the appointment features of your assistant.
- What data we use: your email address and name (to identify the connected account), the list of your calendars (to choose the primary one), the events on your calendar (to show your schedule and check conflicts), free/busy availability information, and the creation, update and deletion of the appointments your assistant books. If you enable it, we also create a secondary calendar named "AgenteUno Citas".
- Why: to offer people who call or write to your business only times that are actually free, create the appointment in your calendar and prevent double bookings. We do not use this data for any other purpose.
- Storage and security: we store access tokens encrypted on servers located in the EU, with restricted access and the measures described in section 10. We do not keep a copy of your schedule beyond the data of the appointments created by AgenteUno.
- We do not sell or share Google user data with third parties, nor transfer it to data brokers, advertising platforms or similar entities, except as necessary to provide the feature, comply with the law, or with your consent. We do not use Google Calendar data for advertising or to train generalized artificial intelligence models.
- Human access: our staff do not read your Google data, except with your consent, for security purposes, to comply with the law, or when necessary for internal operation of the service using aggregated or anonymized data.
- Control and deletion: you can disconnect Google Calendar at any time from Settings > Calendar, and revoke access at myaccount.google.com/permissions. You can also request deletion of your data at privacidad@agenteuno.ai.
Google Contacts (contact import). If you connect Google Contacts from Settings > Integrations, we access your Google contacts in read-only mode and only to import them into the contact list of your AgenteUno account.
- What data we use: for each contact, the name, the first email address, the first phone number and the company. Contacts with neither email nor phone are not imported. We never modify or delete anything in your Google account.
- Why: so that your assistant and your team recognize your customers when they call or write, and so you can manage them in AgenteUno. While the connection is active, the import runs again once a day to keep the list up to date. We do not use this data for any other purpose, for advertising or to train generalized artificial intelligence models, and we do not sell or share it with third parties.
- Storage and security: access tokens are stored encrypted on servers located in the EU; imported contacts are stored in your AgenteUno account with the measures described in section 10.
- Control and deletion: you can disconnect Google Contacts at any time from Settings > Integrations, and revoke access at myaccount.google.com/permissions. When you disconnect we stop importing; contacts already imported stay in your AgenteUno contact list until you delete them, or until you request their deletion at privacidad@agenteuno.ai.
Limited Use disclosure: AgenteUno's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
13. Changes to This Policy
We reserve the right to update this policy. We will notify you by email of any material changes at least 30 days in advance. The last update date is indicated at the beginning of this document.