Privacy and legal notice
Last updated:
This page explains how we process personal data on the coralia.io website and in the Coralia service, a WhatsApp booking assistant for small businesses: which data, why, for how long, and how you can exercise your rights.
Who runs Coralia
The coralia.io website and the Coralia service are run by Isidro Barroso Trujillo, a self-employed professional (autónomo) in Spain.
- Owner
- Isidro Barroso Trujillo
- Tax ID (NIF)
- 79030159C
- Address
- Badalona (Barcelona)
- hola@coralia.io
This information is provided under Spain’s Law 34/2002 on information society services (LSSI).
The website
What data we collect
Only what you send us through the contact form: your name, your email and, if you add them, your business and your message. With it we receive the page language and your device’s time zone, so we know roughly where you’re writing from.
We don’t use analytics, advertising or tracking tools.
Why we use it and on what basis
To reply to your request for information and tell you how to get early access to Coralia. The legal basis is your own request: steps taken at your request before a possible contract (GDPR art. 6.1.b).
We don’t make automated decisions or build profiles with the form data.
Who else sees it
We don’t sell your data or share it with third parties for their own purposes. The website and our email are hosted by Hostinger International Ltd. (Cyprus, EU), which only processes data on our behalf. The form data stays in the European Union.
How long we keep it
Until we’ve replied and for as long as you’re interested in Coralia. We delete it at the latest 12 months after our last contact, unless you become a customer.
Cookies
This site uses a single cookie, lang, and only if you pick a language with the EN/ES switch. It remembers your choice for one year. It’s a functional cookie you ask for, so it needs no consent. Fonts and images are served from our own server.
To show the site in your language, the page checks your device’s time zone. That check happens in your browser; we only receive it if you send the form.
The Coralia service
Two different roles
- As controller, we process the data of the businesses that use Coralia and of the people who run them (“the business”).
- As processor, on behalf of each business, we process the data of its customers who write to it on WhatsApp (“customers”). The business is the controller of that data. If you are a customer of a business that uses Coralia, you can contact the business or us; if you write to us, we will pass your request on to the business.
What data we process
From businesses: business name, owner’s name and contact details, the connected WhatsApp Business number, time zone and language, services, opening hours, booking rules and other settings, and billing data where applicable.
From customers, on behalf of the business:
- phone number and WhatsApp profile name;
- content of the messages exchanged with the business (text; for other content types we only keep a record that they were sent, not the file);
- appointments: service, date and time, state and change history;
- consent to receive reminders and change notices, and its history.
Data we receive from WhatsApp (Meta): the messages customers send to the business, the sender’s phone number and profile name, and message delivery statuses. We use them only to provide the service described here. We don’t use them for advertising, don’t build profiles for commercial purposes, and don’t sell or share them with third parties.
Purposes and legal bases
- Providing the service to the business (account, settings, chat inbox, owner replies): performance of the contract with the business (GDPR art. 6.1.b).
- Serving customers on WhatsApp on the business’s behalf (replying, booking, rescheduling and cancelling appointments): on behalf of the business, which relies on its relationship with its customer and the customer’s requests (GDPR art. 6.1.b).
- Sending reminders before an appointment and notices when the business moves or cancels it: the customer’s consent (GDPR art. 6.1.a), which can be withdrawn at any time.
- Service security and abuse prevention: legitimate interest (GDPR art. 6.1.f).
- Legal obligations (e.g. tax): legal obligation (GDPR art. 6.1.c).
Use of artificial intelligence
The assistant’s replies are generated by an artificial intelligence model from the conversation and the information the business configures. The assistant always says that it is an AI and hands the conversation to the business when the customer asks or when it cannot help. Messages the owner writes in Coralia may be translated automatically into the customer’s language.
Providers
We don’t share data with third parties unless the law requires it. These providers process data on our behalf under a processing contract:
- Microsoft Ireland Operations Ltd. (Azure): the service’s servers and database, and the artificial intelligence model. It stores and processes the data in European Union data centres.
- Telnyx LLC (United States), WhatsApp Business Solution Provider: sends and receives the messages. It stores the data in Germany (EU) and processes it in the United States.
Messages travel over the WhatsApp Business Platform, a Meta service. The business accepts the WhatsApp Business terms when it connects its number, and WhatsApp Ireland Limited processes the messages on the business’s behalf under those terms. Meta processes them in its data centres, including in the United States.
International transfers
Telnyx and Meta process message data in the United States. Telnyx participates in the EU-U.S. Data Privacy Framework and, where it doesn’t apply, uses the European Commission’s standard contractual clauses. Transfers from WhatsApp Ireland Limited to WhatsApp LLC (United States) are governed by the data transfer addendum of the WhatsApp Business terms.
How long we keep data
- Business data: for the duration of the contract and afterwards for the legal limitation periods.
- Customer data: while the business uses Coralia, unless the business or the customer asks for earlier deletion. It is deleted when the contract with the business ends.
- Consent history: as long as needed to prove consent.
Security
We apply appropriate technical and organisational measures: encryption in transit, per-business access control so each business sees only its own data, and restricted access to our systems.
Children
Coralia is not directed at children under 14.
Your rights
You can ask to access, correct or delete your data, to object to or restrict its use, and to take it to another service (portability). You can also withdraw your consent at any time. Write to hola@coralia.io; we reply within one month. If you are a customer of a business, you can also contact the business directly.
If you think we haven’t handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es) or the authority in your country.
How to request deletion of your data
- If you wrote to us through the website form: write to hola@coralia.io from the same email address.
- If you are a customer of a business that uses Coralia: write to hola@coralia.io from any email address, giving the phone number you used to write to the business and the business’s name. To stop receiving reminders and notices, just say so in the WhatsApp chat.
- If you are a business: write to hola@coralia.io from the email address linked to your account.
We confirm the deletion within one month, except for data we must keep by law, which is blocked.
Content
Coralia is a product in development and its features may change before launch. The Coralia name and logo belong to Isidro Barroso Trujillo.
Changes
If we change this policy, we’ll update the date at the top.