Privacy policy

Data controller

Yaqbot S.L. ("we"), with its registered office at Calle del Arroyo de la Media Legua, 49, 6.º O, 28030 Madrid, Spain. For any question about your data or to exercise your rights, email hola@yaqbot.com. This policy covers the data we process on our own account, and also explains what we do when we process data on behalf of a client business (section 4).

What data we process

When we process data on our own account, it is only the data you give us:

• —Assessment form: name, company (optional), email, phone (optional) and your message.
• —Video call booking, on the website or on WhatsApp: the date and time you choose and the contact details you give us for it (name, email and, if you like, phone and a note).
• —Website chat: the content of the messages you type to the assistant.
• —WhatsApp, if you write to our number: your profile name, your phone number or WhatsApp account identifier, and what you send us, including photos, documents and voice notes (voice notes are turned into text); the ad you tapped to open the chat, if you came from an ad; and whether you asked us not to write to you again.
• —Basic technical data: your browser's user-agent, to prevent form abuse.

What we use it for

We use your data only to respond to your request, handle your queries via the chat, email or WhatsApp, manage the video call you book and, if you decide to engage us, deliver the service. On our WhatsApp an AI assistant answers you, and says so when the conversation starts: it can answer your questions, book the video call and hand the conversation to our team, who read it and reply. If you choose to continue on WhatsApp from the website chat, we carry that chat history over to our assistant so you can pick up where you left off without repeating yourself; that transfer happens between our own systems, hosted in the European Union. We make no automated decisions with legal effects on you.

When a business uses our agents

Some businesses hire us to answer their own WhatsApp number with an AI assistant, through Meta's WhatsApp Business Platform. In those conversations the business is the data controller and we are its data processor (Article 28 GDPR): we process the data only to provide the service to that business, on its documented instructions.

• —What data: your WhatsApp profile name; your phone number or WhatsApp account identifier; the content of your messages, including photos, documents and voice notes (voice notes are turned into text); the ad you tapped to open the chat, if you came from one of the business's ads; the appointment details, if the assistant books one for you; and whether you asked not to be contacted again.
• —What for: replying to you on the business's behalf, collecting the details the business needs to help you, booking an appointment where the business offers it, and handing the conversation to the business's staff, who can read it and reply to you from our dashboard.
• —The assistant tells you it is an AI assistant when the conversation starts: in its first message if the business opens the conversation, or in its first reply if you write first (Article 50 of the EU AI Act).
• —To exercise your rights, contact the business or email us at hola@yaqbot.com: we pass your request on to the business and act on its instructions.

How to ask us to delete your data →

Legal basis

Processing is based on your consent when you submit the form, book a video call or start a conversation, and on performance of the contract when you engage our services. You can withdraw your consent at any time. If you ask us not to write to you again, we keep that request on the basis of our legitimate interest in honouring it. When we act on behalf of a business, that business determines the legal basis.

Who we share it with

We do not sell your data. We rely on these providers, each under a written data processing agreement that allows them to use it only to provide their service to us:

• —Meta (WhatsApp Business Platform): carries WhatsApp messages, both on our own number and for the businesses we serve.
• —Mistral AI (France, EU): writes the assistants' replies, turns voice notes into text and reads the photos and documents you send.
• —Scaleway (France, EU): hosts the website and our platform, with their databases and the files you send, and sends the notification emails.
• —Google (Calendar and Meet): only when you book a video call with us, on the website or on WhatsApp; it manages the appointment and the meeting.

Data we receive through WhatsApp

What we receive through WhatsApp we use only for the conversation it arrives in: to help you if you write to us, or to provide the service to the business that conversation belongs to. Beyond that:

• —We don't sell it, license it or share it with anyone outside the providers in this policy.
• —We don't use it for advertising or to show you ads again, on or off WhatsApp.
• —We don't combine it with other data sources or use it to track you or build profiles of you: the only things we note down are the details needed to help you, taken from the conversation itself.
• —We don't use it to train or improve AI models, ours or anyone else's.
• —Each business's data is kept apart from every other business's, in its own database.

Where your data is processed

Our website, our platform (both on Scaleway) and the AI we use (Mistral) run within the European Union. Meta, which carries WhatsApp messages, and Google, if you book a video call, may process data outside the EEA, always under appropriate safeguards: the EU-US Data Privacy Framework or standard contractual clauses.

Cookies and analytics

This website sets no cookies. To understand usage in aggregate we run our own cookieless analytics (Umami), self-hosted on our own server in the European Union: it records anonymous data such as page views, country and referring site — no cookies, no cross-site tracking, and nothing that identifies you. It isn't shared with anyone. To make the site work, your browser also stores a little technical data locally — your language preference and a couple of session flags — which likewise doesn't identify you.

How long we keep it

It depends on who is responsible for the data:

• —When we process your data on our own account, we keep it for as long as the relationship lasts and afterwards for the legally required periods. You can ask us to delete it at any time.
• —Conversations we handle on behalf of a business are kept for as long as its contract with us runs, unless the business asks us to delete them sooner. Each business has its own database: when the contract ends, we delete it together with its files within 30 days.
• —If you ask us not to write to you again, we keep your number with that marker even after deleting everything else, so we never write to you again.

Your rights

You can exercise your rights at any time by emailing hola@yaqbot.com, and we reply within one month (Article 12.3 GDPR). If you consider it necessary, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es). Specifically, you have the right to:

• —Access your data and know how we process it.
• —Rectify any inaccurate data.
• —Erase it ("right to be forgotten").
• —Object to or restrict the processing.
• —Port your data to another controller.

How to ask us to delete your data →

Changes to this policy

We may update this policy to reflect legal changes or changes to our services. We will always publish the current version on this page, with its update date.