Skip to content
aicroo

Privacy Policy

AICROO SOFTWARE S.L.

Last updated: October 1, 2026

This Privacy Policy explains how AICROO SOFTWARE S.L. ("Aicroo", "we") processes personal data in connection with the Aicroo platform and website. It is drafted in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights ("LOPDGDD").

1. Data controller

For any privacy question or to exercise your rights, contact us at info@aicroo.com.

The controller is AICROO SOFTWARE S.L., with tax ID (CIF) B26616417 and registered address at Avenida Gregorio Peces Barba, 1. 1.1.C05, 28919 Leganés, Madrid, Spain.

2. Two different roles: controller and processor

Please note the distinction:

  • When we act as controller. For data about our website visitors, prospects, account holders and direct contacts, Aicroo decides why and how the data is processed. This Policy describes that processing.
  • When we act as processor. When a Customer organization uses the Software to manage data about its own employees, candidates, clients or suppliers, that Customer is the controller of such data and Aicroo acts only as a processor, handling the data under the Customer's instructions and a data processing agreement (DPA). In that case, the Customer's own privacy notice — not this one — governs how and why that data is used, and data subjects should contact the Customer to exercise their rights.

Messaging channels (WhatsApp and Instagram). When a Customer connects its own WhatsApp Business or Instagram account to the Software, we receive through Meta's platforms the messages its contacts send to that account, their phone number or username and profile name, and the delivery and read status of the messages the Customer sends. We process this data only as the Customer's processor: to show the conversations to the Customer's authorised users, to send the replies they write and to keep the conversation history. We do not use it for advertising, and we do not sell it or share it with anyone other than the service providers listed in section 5. The Customer decides how long conversations are kept and can delete them from the Software; disconnecting the channel stops any new data from being received.

When a Customer connects WhatsApp through Facebook Login, we receive an access token for the Customer's WhatsApp Business Account. We store it encrypted and use it only to operate that connection.

3. What data we collect and why

As controller, we may process:

  • Account and contact data (name, business email, company, role, credentials) — to create and manage your account and provide the Software. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
  • Usage and technical data (log data, IP address, device and API usage) — to operate, secure and improve the Software. Legal basis: our legitimate interest in a secure, functioning service (Art. 6(1)(f) GDPR).
  • Billing data (billing details, transactions) — to manage payments and meet accounting/tax obligations. Legal basis: contract and legal obligation (Art. 6(1)(b) and (c) GDPR).
  • Communications and support data — to answer enquiries and provide support. Legal basis: legitimate interest and/or contract.
  • Marketing data — to send commercial communications where permitted. Legal basis: consent or legitimate interest, with the right to object at any time (Art. 6(1)(a)/(f) GDPR).

We only collect the data we need for these purposes.

Product usage statistics. To decide which parts of the Software to improve, we count which screens and features are used and which tools are called through our MCP server: the generic screen (never the content or the identifier of a document), the type of device or client, and the organization. To count distinct users we use a pseudonym that changes every month; it and the individual records are deleted when each month closes, after which we keep only totals per organization (our backups hold them only for their usual retention period). These statistics are not used to evaluate individuals and are not shared with your employer or with third parties. Legal basis: our legitimate interest in improving the Software (Art. 6(1)(f) GDPR); you can object at any time by writing to info@aicroo.com.

4. Cookies

Our website may use technical cookies necessary for operation and, subject to your consent, analytics or similar cookies. You can manage your preferences through the cookie banner or your browser settings.

5. Who we share data with

We may share personal data with:

  • Service providers (processors) who help us run the Software (for example, hosting, infrastructure, analytics and payment providers), under written contracts and only on our instructions.
  • Public authorities where required by law.

We do not sell your personal data.

Our main service providers are:

  • DigitalOcean, LLC — hosting of our application servers, located in Frankfurt (Germany).
  • Supabase, Inc. — hosting of our database, located in the United Kingdom.
  • Meta Platforms Ireland Limited — the WhatsApp Business Platform and Instagram messaging, when a Customer connects those channels.

Our processors' access to personal data in order to provide their services to us is not a communication of data to third parties (art. 33 LOPDGDD). Some of them only host the data; others receive it in order to perform their function, such as sending WhatsApp messages or emails, or processing payments.

6. International transfers

Where personal data is transferred outside the European Economic Area, we ensure appropriate safeguards are in place, such as an adequacy decision or the European Commission's Standard Contractual Clauses.

Our database is hosted in the United Kingdom, which benefits from a European Commission adequacy decision, and our application servers in Frankfurt (Germany). DigitalOcean and Supabase are United States companies whose staff may access data remotely to provide support; those transfers rely on the European Commission's Standard Contractual Clauses or, where the provider is certified, the EU–US Data Privacy Framework.

7. Retention

We keep personal data only for as long as necessary for the purposes described, and thereafter for the periods required to comply with legal obligations (for example, tax and accounting rules) or to defend against claims. When no longer needed, data is deleted or anonymized.

8. Security

We apply appropriate technical and organizational measures to protect personal data against unauthorized access, loss or alteration. No system can be guaranteed to be completely secure, and users are responsible for keeping their credentials safe.

9. Your rights

Under the GDPR and LOPDGDD you have the right to: access your data; request rectification or erasure; restrict or object to processing; data portability; and, where processing is based on consent, withdraw that consent at any time without affecting prior processing.

To exercise these rights, contact info@aicroo.com. You may be asked to verify your identity. If your data is processed by a Customer using the Software (see section 2), please direct your request to that Customer.

Instructions for requesting the deletion of your data, including data received through WhatsApp, Instagram or Facebook Login, are available at aicroo.com/en/data-deletion.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD — www.aepd.es) if you believe your data has been processed unlawfully.

10. Changes to this Policy

We may update this Policy from time to time. The current version is always available on our website, with the "last updated" date shown above.

11. Contact

For any question about this Privacy Policy or your personal data, contact info@aicroo.com.

© 2026 AICROO SOFTWARE S.L. All rights reserved.

This is the published policy, reproduced in full.