Privacy policy
Last updated: 25 October 2026
Data controller
Una Persona S.L., Spanish tax ID B93781169, at Calle Padre Pandelo, 48, 3º C, 11300 La Línea de la Concepción, Cádiz, España, is the controller. For privacy questions or to exercise your rights, email jm@unapersona.es.
Information we process and why
When you email us: we process your email address and information in your message to respond and manage the relationship you request. Please avoid unnecessary sensitive information. The contact link opens your email application.
When you browse: the hosting provider may process technical information needed to serve and protect the website, such as IP address, access time, requested resource and browser details. The website also loads Google Tag Manager from Google to manage tags and integrations. The language selector stores your requested language as described in our cookie policy.
Waitlist
When you sign up, we process your email and optional name to manage the waitlist and send access information and next steps for Una Persona. The legal basis is your consent (GDPR Article 6(1)(a)), given through the form checkbox. Withdraw consent and leave the list by emailing jm@unapersona.es. We retain the signup while the list is active and you have not withdrawn consent, subject to minimal records needed to demonstrate its management and meet legal obligations.
We use Resend to store signups and email us a notification of each registration. We do not send unrelated campaigns. See Resend’s privacy policy. Joining involves no payment or contract.
To protect the signup form against abuse, Supabase stores global counters and a pseudonymous email identifier, without storing your IP address in these counters. The window is 10 minutes; expired counters are deleted during daily cleanup. The purpose is to protect service availability (legitimate interest, GDPR Article 6(1)(f)).
Client portal and WhatsApp
We process verified email addresses, company membership, user roles and action records to manage access. Supabase provides authentication and the database; the project is located in Ireland. Resend sends access codes. Session cookies are necessary for authentication. The client portal does not load Google Tag Manager or public website analytics.
We process account and phone identifiers, encrypted Meta authorisation, contacts and request and delivery statuses. Phone numbers and tokens are encrypted before storage.
Sign in with Google
If you choose Google, Google and Supabase verify your identity using openid, email and profile permissions: identifier, email and basic profile data such as a name or picture when available. These authenticate you; they do not request Gmail, Drive or contacts access. Your account needs prepared access or a business invitation; signing in does not itself grant administration permissions. See Google privacy information.
Messages and incoming archive
The inbox retains encrypted new incoming messages, panel replies and new mobile app messages reported by Meta for 30 days. Earlier chat history is not imported. The incoming archive may download photos, documents and audio from Meta and store encrypted content in Google Cloud Storage, with names, types, sizes, dates and other necessary metadata. Access is restricted to authorised business members for 365 days from the message and does not depend on retaining the conversation. An incoming WhatsApp message enables service within its window but does not establish marketing consent.
Attachments you prepare to send
Photos, PDFs and audio prepared in the panel are validated and analysed on the server to show a preview. Files and metadata are stored encrypted; only the user who prepared an attachment within the corresponding business can access that preparation. Access expires after 24 hours. Sending is a separate action requiring permissions and an open service window, and transmits the attachment to Meta and the recipient. Copies held by Meta and the recipient follow their own terms and controls.
CRM and independent retention
The CRM processes contact records, tags, notes, deals and tasks to follow up the business relationship. The owner can export, archive and delete records. Automatic cleanup is disabled by default; if enabled, the owner sets between 30 and 3650 days of inactivity, with 365 as the initial value. Only eligible archived records are deleted; recent activity and pending work are protected. This period does not replace chat or file retention.
Expiry, deletion and recovery
When the 365-day incoming archive period or 24-hour outgoing attachment period expires, the panel blocks access. The configured Cloud Storage lifecycle rule schedules deletion from the following day; execution is not immediate. After deletion, storage retains a 7-day recovery window. The worker cleans expired incoming file index entries after 7 days. An expired link or deletion of a CRM record does not remove external copies or demonstrate immediate erasure of every infrastructure copy.
The client company determines the purpose and legal basis for its communications; Una Persona processes recipient data under its instructions. Processing terms must be agreed before enabling client data. Client account onboarding remains disabled while Meta approval and testing are completed.
Invitations expire after seven days. Events and operations are retained for thirty days, action records for one hundred eighty days, and contacts with withdrawn authorisation for thirty days. Cleanup is scheduled daily. Access records and active contacts remain while necessary to manage the account and service. To close an account or request erasure, contact jm@unapersona.es. Disconnecting WhatsApp disables the local connection and removes its token; it does not delete the Meta account or replace revoking permission in Meta.
See Supabase privacy information and WhatsApp Business processing information. Operational notices to Una Persona’s owner contain general statuses without client messages, phone numbers or tokens.
Legal basis for other processing
Enquiries about a potential contract are handled to take steps at your request before entering into a contract (GDPR Article 6(1)(b)). Other enquiries rely on our legitimate interest in responding to communications (Article 6(1)(f)). Site operation and security rely on our legitimate interest in providing a secure service. Where a legal obligation applies, the basis is Article 6(1)(c).
Enquiries and technical data
Messages you send us with an enquiry are retained to resolve it and manage the resulting relationship. Where information must be retained to meet obligations or address liabilities, it will be kept only for the legally required periods, subject to appropriate restrictions. Technical browsing information is retained according to the hosting service’s operational and security needs.
Providers and recipients
The site is hosted on Google Cloud in the Madrid region. Hosting and email providers supporting our communications may process information to provide those services. Data may also be disclosed when legally required. We do not sell personal data.
International providers may process data outside the European Economic Area. In that case GDPR safeguards, such as adequacy decisions or standard contractual clauses, must apply. Contact us for information about providers and applicable safeguards. See also Google Cloud’s privacy information and data processing agreement.
Your rights
You may request access, correction, erasure, objection, restriction and, where applicable, portability of your data. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing.
Email jm@unapersona.es stating the right you wish to exercise. We will only request additional identification where necessary. You may also complain to the Spanish Data Protection Agency (AEPD).
Automation and agents
Where supported, WebMCP tools let you read public company information, search activities and consult guides. They can also prepare a contact draft using text you provide; that draft is generated in your browser and is not stored or sent by these tools. Avoid personal or confidential information in drafts. Sending the contact form is a separate action.
Policy changes
We will update this information when features or processing change. The date above indicates the latest revision. See also our cookie policy.