Your data is yours. Here's what we do with it.
This policy complies with the GDPR (General Data Protection Regulation) of the European Union.
If you have questions, email us at info@engrana.es
1. Who is responsible?
Data controller:
AUVE MEDIA GROUP SL
Tax ID: B19373067
Carrer Antoni Maura 13, 08225 Terrassa, Barcelona
Spain
Email: info@engrana.es
2. What data we collect
Data you give us directly:
- First and last name
- Phone
- Business name
- Business address
- Industry/activity
- Payment method (processed by Stripe, we don't store full bank details)
Data generated by the service:
- Your clients' messages (for the bot to respond)
- Appointment history
- System configuration
- Activity logs (for technical support)
Data we DON'T collect:
- Complete bank details (uses Stripe)
- Sensitive information without need (health, religion, ideology)
- Data from minors
3. Why we collect your data
To provide the service:
- Respond to messages automatically
- Confirm appointments
- Request reviews
- Technical support
For billing:
- Issue invoices
- Process payments
- Comply with tax obligations
To improve Engrana:
- Analyze how you use the service (aggregated, anonymous data)
- Detect errors
- Optimize features
For communication:
- Send service-related emails
- Important notices (downtime, changes)
- Newsletter (only if you agreed; you can unsubscribe anytime)
What we DON'T do:
- Sell your data to third parties
- Use your information for external advertising
- Train external AI models with your private data
4. Legal basis
Why can we legally process your data?
a) Contract execution:
We need your data to provide the service you contracted.
b) Explicit consent:
You accept this policy when you register.
You can withdraw consent anytime (by canceling the service).
c) Legal obligation:
Store invoices, tax data (required by Spanish law).
d) Legitimate interest:
Improve the service, prevent fraud.
6. How long we keep data
While you use the service:
All data necessary for it to work
After cancellation:
- 30 days: data in quarantine (in case you change your mind)
- After: complete deletion
Exceptions (legal obligations):
- Invoices: 10 years (Spanish law)
- Legal communications: as applicable
Backups:
- Automatic backups for 90 days
- After, permanent deletion
7. Your rights (GDPR)
Under GDPR you have the right to:
Access: Know what data of yours we have.
Rectification: Correct incorrect data.
Erasure ("right to be forgotten"): Have your data deleted (except legal obligations). You can exercise this right here: Request data deletion.
Portability: Receive your data in readable format (CSV, JSON).
Objection: Object to certain processing.
Restriction: Request that we limit the use of your data.
No automated decisions: Engrana doesn't make automated decisions that legally affect you (e.g., denying service by algorithm).
How to exercise these rights:
Email info@engrana.es with:
- Subject: "GDPR rights exercise"
- Your name and registered email
- Which right you want to exercise
We respond within 30 days.
Complain to authority:
If you believe we're breaching GDPR, you can complain to the Spanish Data Protection Agency (www.aepd.es) or your local data protection authority.
8. Security
Technical measures:
- SSL/TLS encryption in transit
- Encryption of sensitive data at rest
- Restricted access (only authorized personnel)
- Two-factor authentication (2FA) available
Organizational measures:
- Team training on data protection
- Periodic security audits
- Security breach response protocol
In case of security breach:
We'll notify you within 72 hours if your data is compromised.
We'll notify the relevant data protection authority as required.
10. Limited Use of Google user data
Engrana's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Engrana's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
The use and transfer of raw or derived user data received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In practice, the data we obtain from Google Calendar and Google Sheets:
- are used only to provide and improve the user-facing features of Engrana (calendar, availability, appointment reminders and confirmations);
- are not transferred to third parties except as necessary to provide those features, for security purposes, to comply with applicable law, or as part of a merger or acquisition with the user's consent;
- are never used for advertising purposes, our own or anyone else's, and are never sold;
- are not read by humans, except with the user's explicit consent, for security purposes, to comply with applicable law, or when the data is aggregated and anonymised.
Users can revoke Engrana’s access to their Google account at any time from myaccount.google.com/permissions. When they do, we stop syncing and delete the associated tokens.
11. Changes to this policy
If we change this policy:
- We publish the new version here (with date)
- We notify you by email if significant changes
- You're always protected by GDPR
12. Contact
Privacy questions:
info@engrana.es
Exercise GDPR rights:
info@engrana.es (subject: "GDPR rights exercise")
Data controller details:
AUVE MEDIA GROUP SL
Tax ID: B19373067
Carrer Antoni Maura 13, 08225 Terrassa, Barcelona
Spain
Final note:
Your data is yours. We only use it to provide the service.
No fine print. No selling to third parties. No nonsense.