Privacy Policy

Ulises Vera Ramos Contact email: hola@hablaconsofia.com

We collect only the data necessary to provide the service: — Name and email address, when you register. — Password (stored in encrypted form; we never see it in plain text). — Voice recordings during conversations with the assistant, processed in real time by our transcription provider (Deepgram) and not stored once the transcript is obtained. — Conversation transcripts, kept in session to maintain dialogue context and deleted when the session ends. — Plan usage data: minutes consumed and monthly reset date. — Preferred language and selected avatar.

Data is processed for: — Performance of the contracted service (Art. 6.1.b GDPR): authentication, plan management and usage limits. — Legitimate interest (Art. 6.1.f GDPR): service security, abuse and fraud prevention. — Consent (Art. 6.1.a GDPR): aggregate usage analytics via Google Analytics, only if you accept them in the cookie banner.

We work with the following providers, all of whom have data processing agreements compliant with the GDPR: — Supabase (database and authentication) — servers in the EU. — Anthropic (Claude language model) — processes conversation text. — Deepgram (voice transcription) — audio is processed and discarded; not stored. — ElevenLabs (speech synthesis) — response text is converted to audio in real time. — Stripe (payments) — handles secure billing; we do not store card data. — Cloudflare Turnstile (bot protection) — analyses anonymous behavioural signals to verify that the visitor is human, without storing personally identifiable data. See the Turnstile Privacy Addendum at https://www.cloudflare.com/turnstile-privacy-addendum/ — Google Analytics 4 (analytics) — only if you accept analytics cookies; aggregate data with anonymised IP. — Google Fonts (typefaces) — static resource request when loading the site.

Some providers (Anthropic, Deepgram, ElevenLabs, Stripe) process data in the United States under appropriate safeguards established by the European Commission's Standard Contractual Clauses.

— Account data: while the account is active and, after deletion, the minimum period required by applicable tax and commercial law (generally 5 years). — Conversation transcripts: deleted at the end of the session; not persisted. — Voice recordings: not stored; discarded after transcription.

You may exercise the following rights at any time by writing to hola@hablaconsofia.com: — Access: find out what data we hold about you. — Rectification: correct inaccurate data. — Erasure ("right to be forgotten"): request deletion of your data. — Portability: receive your data in a structured format. — Objection and restriction of processing. You may also lodge a complaint with your local data protection authority.

We apply appropriate technical and organisational measures to protect your data: encryption in transit (HTTPS/TLS), hashed passwords, restricted access to production data, and periodic provider reviews.

If we make substantial changes we will notify you by email or via a prominent notice in the service before they take effect.

For any privacy-related enquiry: hola@hablaconsofia.com