Privacy Policy

1. Data controller

SoloAtiendo (the “Service”). Privacy contact: hello@soloatiendo.com.

2. Two distinct roles

Website and client (business) data: SoloAtiendo is the data controller for contact and billing data of the businesses that subscribe to the Service.

Call data (callers): the client business is the data controller of its callers' data. SoloAtiendo acts as data processor on behalf of the business under a data processing agreement (art. 28 GDPR).

3. Data we process

From calls: caller number, call recording, transcript, and any data the caller voluntarily provides to manage an appointment (name, requested service, preferred time).

From client businesses: identification and contact details, business configuration (hours, services) and subscription data.

From the launch waitlist: email address, language, signup origin on the website, and the date and version of the consent. Of the IP address we only keep a hash (not the IP) for a maximum of 2 hours to curb abuse. To check you are not a bot we use Cloudflare Turnstile, which processes technical data from your browser (such as IP address, TLS fingerprint and User-Agent header) solely for that purpose.

In-call notice: every call starts by informing the caller that a virtual assistant answers and the call is recorded.

4. Purposes and legal basis

Managing appointments and phone enquiries on behalf of the client business (processing agreement).

Providing, billing and improving the Service for client businesses (contract performance, art. 6.1.b GDPR).

Launch waitlist: notifying you of the Service launch and when accounts open (consent, art. 6.1.a GDPR, given through the form checkbox). You can withdraw it at any time by writing to hello@soloatiendo.com, without affecting processing already carried out.

The Service is not intended to process health data or any other special categories of data (art. 9 GDPR). The Customer undertakes not to use it for activities that require processing them.

5. Data recipients

To provide the Service we rely on technology providers acting as processors or sub-processors, in the following categories: cloud infrastructure and storage (the backend and application data are hosted on AWS, Ireland region), website hosting and delivery, telephony and numbering, conversational voice processing, calendar management (only when the business connects its own calendar), payment processing and web analytics (PostHog, hosted in the European Union, consent only). Some of these providers, such as Cloudflare and ElevenLabs, may process data outside the EEA: see section 7.

Cloudflare, Inc. (hosting and delivery of the website and dashboard): provides the content delivery network (CDN), security (WAF) and application runtime. It processes in transit the data shown by the website and the dashboard: account data and, for the business owner, the transcripts and data of callers. It also logs technical request data (IP address and headers) for security and operation, retained under its own policy. We do not store recordings or transcripts at Cloudflare.

All of them are bound by data processing agreements under art. 28 GDPR. Client businesses receive the detailed sub-processor list in their data processing agreement, and it can be requested at the contact address above.

6. Retention

Call recordings and transcripts: up to 90 days, unless the client business requires a shorter period.

Waitlist: until launch and, at most, 12 months from signup, or until you withdraw your consent if earlier.

Client data: for the duration of the contract plus applicable legal retention periods.

7. International transfers

Primary storage (recordings, transcripts and account data) is in the European Union. Conversational voice processing during the call is performed by a provider that may process the audio outside the EEA; that transfer, and any other provider outside the EEA, is covered by the European Commission's Standard Contractual Clauses and the corresponding data processing agreement.

Cloudflare operates a global network: traffic to the website and dashboard may be processed in data centres outside the EEA, including in the United States. Those transfers are covered by the European Commission's Standard Contractual Clauses incorporated into Cloudflare's data processing agreement and, for the United States, by its certification under the EU-U.S. Data Privacy Framework.

8. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to hello@soloatiendo.com. If you called a business that uses the Service you may also contact that business directly (the controller). You may lodge a complaint with the Spanish DPA (www.aepd.es). For the waitlist, write to the same address to access your email, delete it or withdraw your consent.