Effivis Privacy Policy

1. Data controller

EFFIVIS TECHNOLOGIES S.L.
Tax ID (NIF): B23839962
Address: C/ Zurbano 49, Bajo – Oficina 4, 28010 Madrid, Spain
Contact: [email protected]

2. What data we process and why

We process personal data to:

• Manage and respond to information requests or enquiries.
• Deliver the services contracted through the Effivis platform.
• Manage your user account and the contractual relationship.
• Process payments and invoicing.
• Send commercial communications by email (only with your consent).
• Phone businesses and professionals to introduce Effivis (section 11).
• Comply with legal and tax obligations.
• Improve our services through anonymised statistical analysis.

3. Legal basis

• Your consent, for commercial communications by email and analytics cookies. You may withdraw it at any time, without affecting processing carried out before you withdraw it.
• The contract, to provide the service and manage your account. Without your account and invoicing data we cannot provide the service.
• A legal obligation, for invoicing and accounting.
• Our legitimate interest, in four specific cases: keeping the platform secure and detecting fraudulent access, keeping call recordings for the stated period to review the quality of the voice agent, receiving error reports from the web platform and the app to fix faults, and phoning businesses and professionals to introduce Effivis (section 11). You can object to any of them by writing to [email protected].

4. How long we keep data

5. Who we share data with

With these providers, which process the data on our behalf, under our instructions and with the same safeguards set out in this policy:

Inside the European Union: AWS (hosting, database, storage, OCR and, where used, Bedrock language models, in Ireland), Google Cloud Vertex AI (the voice model that answers calls in real time, and language models, in Madrid), DIDWW (telephony carrier) and Cloudflare (DNS, CDN and DDoS protection, global with EU nodes).

With a transfer outside the European Union: Stripe (payments), Anthropic (language models behind the WhatsApp and phone assistant), OpenAI (language models for classification, extraction and search), Google Cloud (Drive integration and sign-in), Microsoft (sign-in), Meta Platforms (WhatsApp, Instagram and Facebook), Zendesk (customer support), Sentry (error monitoring for the web and the app; storage in the EU) and Expo (notifications for the iOS app).

The language-model providers (Anthropic, OpenAI, AWS Bedrock and Google Vertex AI) do not use your data to train their models and keep requests for at most 30 days for security and abuse purposes. Depending on the module and your account configuration, the assistant may be served by Anthropic or by AWS Bedrock in Ireland. Each transfer outside the EU relies on the EU-U.S. Data Privacy Framework adequacy decision, where the provider is certified under it, or on the European Commission's Standard Contractual Clauses. The safeguard for each provider is listed in the list of subprocessors; you can ask us for a copy at [email protected].

6. Your rights

You can exercise the following rights at any time:

• Access — know what data we process.
• Rectification — correct inaccurate or outdated data.
• Erasure — where data is no longer necessary or you withdraw consent.
• Restriction of processing in specific circumstances.
• Objection to processing based on legitimate interest.
• Portability — receive your data in a structured, machine-readable format.

To exercise them, email [email protected] with a copy of an ID document. You may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

7. Cookies

This site uses first-party cookies necessary for it to function and, only if you accept them in the banner, Google Analytics 4 analytics cookies to see which pages are visited. Google may process that data outside the European Economic Area under Standard Contractual Clauses. You may withdraw consent at any time by clearing cookies in your browser settings.

8. If you call or message a business that uses Effivis

If you call or message a business that uses Effivis — by phone, WhatsApp, Instagram Direct or Facebook Messenger — that business is the controller of the conversation; Effivis processes it on the business's behalf and under its instructions.

To access your data, have it deleted or receive it in a readable format, contact the business or write to [email protected]. The procedure is in our Data Deletion Instructions.

AI agents and automated decisions

Businesses using Effivis may use an artificial intelligence agent to attend to their customers, over the phone or through messaging. That agent reads the calendar and can book, change or cancel an appointment on its own during the conversation, with no person involved at that moment.

It decides based on what you say in the conversation, the appointments already on record and the rules the business has configured (opening hours, how long each service takes, who can perform it). It does not build profiles.

The consequence for you is the resulting appointment. You can ask during the conversation to speak to a person, and contact the business to review or undo anything the agent did.

Call recording

If the business has it enabled, calls answered by the Effivis voice agent are recorded to review service quality and resolve issues, and the caller is told so at the start of the call. Recordings are accessible to the business that answered the call and to authorised Effivis staff. They are not used to train artificial intelligence models.

9. Zendesk integration (Marketplace apps)

If you install an Effivis app from the Zendesk Marketplace, the app reads your tickets — content, metadata and the users and groups appearing in them — from your browser, without storing them in Effivis.

Outside Zendesk we only store your subdomain and installation identifier, a hash of the integration token, technical records of each API call without any ticket content and, only if you enable AI-powered related-ticket search, numerical representations of the text without personal identifiers.

Those representations are deleted on request or 30 days after you uninstall the app, whichever comes first. The token hash is kept for 90 days and the installation data for 24 months; you can ask for them to be deleted sooner.

To disconnect: uninstall the app from Admin Center → Apps → Manage in Zendesk and we revoke access automatically, or use the app's own Disconnect button, which also lets you purge everything immediately. For full deletion, write to [email protected] quoting your subdomain.

10. Effivis mobile app (iOS)

The app is for the users of the organisations that subscribe to the platform. To sign you in we use your email address, your name, your organisation and your role within it. When the app encounters an error, and for a sample of sessions, it sends Sentry a technical report with an internal user identifier, your organisation and your role; it does not send your email address or the content of your conversations.

It asks for each permission the first time you use the feature that needs it, and you can withdraw any of them in iOS settings:

• Microphone, only during calls you place or answer in the app. Those calls are not recorded; the number, time, duration and outcome are logged.
• Notifications, to alert you to incoming calls, conversations that need a person, messages left for your team and changes to the calendar. The alert goes through Expo and Apple and may include the customer's name or number and a preview of what they wrote.
• Camera and photos, to scan codes and attach photos when your organisation uses those features.
• Face ID, if you turn it on in your profile, to unlock the app. The check happens on the phone; Effivis receives no biometric data.

You can request deletion of your account at any time; the procedure is in our Data Deletion Instructions.

11. Sales calls to businesses and professionals

We phone businesses and professionals to introduce Effivis. We use the name, phone number, email and address the business publishes on its Google Business Profile, its website or directories and, if you tell us during the call, your name and role. For each call we note the date, who we spoke to and what was agreed.

The legal basis is our legitimate interest in introducing a service related to your line of business. We keep the log for one year from the last call if you do not become a customer. It is held in our internal management tools, whose providers may process data outside the European Union under the safeguards described in section 5.

If you do not want us to call you, tell us during the call or write to [email protected]. We keep the number on a do-not-call list for as long as we keep making sales calls.