Privacy Policy

The data controller is Marta Oryl, trading as ExpressAi, operating the website expressai.bot and providing AI agents over WhatsApp Business for local businesses and tourism in Benicàssim, Spain.

• Email: contact@martaoryl.com
• Spain: +34 605 101 253

Data protection contact: for any question about how your personal data is processed, or to exercise your rights, contact us at contact@martaoryl.com.

We collect information in the following categories:

• Contact information: name, email, phone number, business name.
• Business information: industry, role, type of services offered, business hours.
• Communication data: messages exchanged via WhatsApp, email, or website forms — including any media, attachments, and the WhatsApp profile information shared by your device (display name, profile picture, phone number).
• Service configuration data: agent settings, knowledge base content, prompts, and integrations you configure in our dashboard.
• Technical data: IP address, browser type, device, pages visited, timestamps, and basic analytics events.

We process personal data under the following GDPR lawful bases:

• Contractual necessity: to deliver the AI agent service you have requested, respond to demo requests, and operate your account.
• Legitimate interest: answering tourism and local-business queries on WhatsApp, securing our website, improving service quality, and preventing abuse.
• Consent: marketing communications and non-essential cookies. You can withdraw consent at any time.
• Legal obligation: tax, accounting, and any applicable record-keeping or law-enforcement requirements.

Our service uses the WhatsApp Business Platform provided by Meta Platforms Ireland Ltd. When you message us on WhatsApp:

• Your messages, phone number, and WhatsApp profile information are processed by Meta Platforms in accordance with WhatsApp's Privacy Policy.
• Replies may be generated by an AI assistant. You will be informed at the start of the conversation, and you can request human assistance at any time by replying with “human” or “agente”.
• Conversation content is processed to generate responses and may be stored in encrypted form to maintain context, audit quality, and improve the service.
• WhatsApp communication with us is voluntary. You may stop the conversation at any time by writing “stop” or by blocking the number.

We may share data with the following categories of recipients:

• Meta Platforms — for delivery and processing of WhatsApp messages.
• AI providers (such as OpenAI and Anthropic) — to generate AI responses; messages are sent over encrypted channels and are not used to train their public models when processed via the business APIs we use.
• Hosting and infrastructure providers (such as AWS, in the EU region where possible) — to host the application and store data securely.
• Email and analytics providers — to send operational emails and measure traffic.
• Local businesses you choose to contact through our WhatsApp bot — only the information necessary to fulfil your request is forwarded.
• Authorities — when required by law or legal process.

We do not sell your personal data, and we do not use it for automated decision-making with legal or similarly significant effects.

Our infrastructure is hosted in the European Union where possible. Some processors (such as Meta and AI providers) may process data in the United States or other jurisdictions. Such transfers are safeguarded by the EU-US Data Privacy Framework and/or Standard Contractual Clauses, in accordance with GDPR.

We keep personal data only for as long as necessary:

• Client and contract data: duration of the relationship plus 6 years.
• Demo requests and website submissions: up to 12 months.
• WhatsApp conversation logs: up to 12 months, unless a longer period is required by law.
• Tax and accounting records: 5–10 years per Spanish law.

Under GDPR you have the right to:

• Access, rectify, and erase your personal data.
• Restrict or object to processing.
• Data portability.
• Withdraw consent at any time.
• Lodge a complaint with the Spanish Data Protection Agency (AEPD, aepd.es).

To exercise any of these rights, email contact@martaoryl.com. We respond within 30 days.

Our website uses essential cookies (no consent required) and optional analytics and marketing cookies (consent required). You can manage your choices through the cookie banner shown on first visit, or by clearing site data in your browser to see the banner again.

We protect your data with TLS encryption in transit, encrypted storage at rest, role-based access controls, and confidentiality agreements with our processors. API keys you upload are encrypted before reaching our database.

Our service is not directed at individuals under 16. If we learn that we have inadvertently collected personal data from a child, we will delete it promptly upon notification.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The “Last updated” date at the top will reflect any change; material changes will be announced on the website or by email when appropriate.

For any question about this Policy or to exercise your rights, contact us at contact@martaoryl.com or +34 605 101 253.