Privacy Policy

1. Introduction and Data Controller Identity

Respondo (“we”, “us”, or “our”) operates the platform available at respondo.es and provides communication automation infrastructure to service businesses, including salons, spas, and clinics, primarily across Spain and the European Union.

We are committed to protecting the personal data of all individuals who interact with our platform. This Privacy Policy explains what data we collect, why we collect it, the legal basis for processing, how long we retain it, and the rights you have under the General Data Protection Regulation (GDPR) (EU) 2016/679.

Data Controller: Héctor Moyano Vélez (autónomo), NIF 52006446L, with address at Calle Carlos Sole, 8, 4º B, 28038 Madrid, Spain (VAT ES52006446L). Trading as “Respondo”. For all data protection enquiries, please contact us at privacidad@respondo.es.

Dual Role as Controller and Processor

Respondo operates in two distinct capacities depending on the nature of the data:

• Data Controller — for data we collect directly from our business customers (the service businesses that subscribe to Respondo), including account information, billing data, and platform usage data.
• Data Processor — for data that our business customers input about their own end-clients (such as appointment history, contact details, and clinical notes). In this capacity, our customers are the Data Controllers and Respondo processes data strictly on their documented instructions via our Data Processing Agreement (DPA).

2. Data We Collect

We collect personal data in the following categories, depending on your relationship with Respondo:

2.1 Account Data (Business Customers)

When a service business registers for Respondo, we collect the information necessary to create and manage their account:

• Full name and professional role
• Business name and address
• Business email address and phone number
• Subscription plan and billing preferences
• Account credentials (managed securely via Clerk; we do not store passwords)

2.2 Client Data (End-Clients of Our Customers)

Our business customers input data about their own clients into the Respondo platform. As a processor, we store and process this data on their behalf. This may include:

• Full name, email address, and phone number
• Appointment history and booking preferences
• Communication history (SMS and voice interactions)
• Internal notes and tags added by the business customer

The business customer is solely responsible for ensuring they have a lawful basis to collect and process their end-clients' personal data and for providing appropriate privacy notices to those individuals.

2.3 Clinical Notes and Health Data

Respondo offers an optional clinical notes feature for use by health and wellness businesses (e.g., clinics, physiotherapy practices, spas offering therapeutic services). When this feature is enabled by a business customer, the platform may store data that constitutes special category data under GDPR Article 9, including health-related information.

This feature is disabled by default and must be explicitly activated by the business customer. Business customers who enable this feature must obtain explicit consent from their end-clients before recording any health-related data in Respondo. See Section 4 for further details.

2.4 Communication Data

When our platform sends or receives communications on behalf of business customers, we process:

• SMS message content and metadata (timestamps, delivery status) via Twilio
• WhatsApp message content and metadata via Meta's WhatsApp Business Platform (Cloud API)
• Voice call logs and recordings (where applicable and permitted)
• Emails sent on behalf of business customers (consent requests, signed consent copies, invoices and payment reminders) via Resend
• AI-generated summaries of communications (when AI features are enabled)

Through Meta's WhatsApp Business Platform (Cloud API), Respondo processes, on behalf of connected businesses: customer phone numbers, message content and media, customer display names, message timestamps and delivery/read statuses, and WhatsApp account identifiers (WhatsApp Business Account ID and phone number ID). Meta Platforms Ireland Ltd. acts as a sub-processor. This data is stored in the European Union. Purpose: to deliver the messaging, AI auto-reply, and appointment-booking service that the business has configured.

Coexistence with the WhatsApp Business app:if the business keeps using the WhatsApp Business app on the same number it connects to Respondo, Respondo will see the conversations of the business's WhatsApp so it can reply on its behalf, including the messages the business writes from the app, which are stored in that customer's conversation. Respondo does not import chat history from before the connection.

2.5 Payment Data

All payment processing is handled by Stripe, a PCI-DSS Level 1 certified payment processor. Respondo does not store full card numbers, CVV codes, or other sensitive cardholder data. We retain only:

• Stripe Customer ID and Subscription ID (for account management)
• Subscription plan, billing cycle, and payment status
• Invoice references (required for tax compliance under Spanish law)

2.6 Usage and Technical Data

We automatically collect certain technical data when you use the Respondo platform to ensure its security and improve its functionality:

• IP addresses and approximate geolocation (country/region level)
• Browser type, operating system, and device identifiers
• Pages visited, features used, and actions taken within the platform
• Session duration and access timestamps
• Error logs and performance metrics

2.7 Cookies and Similar Technologies

We use cookies and similar technologies for authentication and analytics purposes. See Section 10 for full details on our cookie use.

2.8 Google Calendar Data

If you connect your Google Calendar account from Settings › Integrations, Respondo accesses only this Google user data:

• The intervals when you are busy in your primary calendar (only the start and end time; never the title, description, location or attendees of your events).
• A secondary calendar named «Respondo» that the application itself creates in your account, where it creates, updates and deletes one event per appointment of your business with minimal content (service, the client's first name, room and professional). Respondo does not read or modify any other calendar.
• The email address of the connected Google account, to show you which one is connected.

We store only the start and end of each busy interval, the identifier of the «Respondo» calendar, the account email address and the refresh token Google grants us to renew our access, stored encrypted (the short-lived access tokens are kept in memory only, never stored). We use this data solely to avoid offering or accepting appointments at times you are busy and to mirror your appointments in the «Respondo» calendar. We do not share it with third parties, do not sell it and do not use it for advertising or to train models. Respondo's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect it at any time from Settings › Integrations › «Disconnect»: Respondo revokes the access Google granted, deletes the «Respondo» calendar from your account and removes the token and the busy intervals from our systems. You can also remove the access from your Google account's security settings. If you delete your Respondo account, when the account is purged, once 30 days have passed since the deletion, Respondo revokes the access Google granted, deletes the «Respondo» calendar from your account and removes the token and the busy intervals from our systems.

2.9 Microsoft Outlook Data

If you connect your Outlook calendar (a personal Outlook.com or Hotmail account, or a Microsoft 365 work or school account) from Settings › Integrations, Respondo accesses only this data of your Microsoft account:

• The start and end time, and the availability status («free», «busy», etc.), of the events in your default calendar, to know when you are busy; never the subject, body, location or attendees of your events.
• A secondary calendar named «Respondo» that the application itself creates in your Outlook, where it creates, updates and deletes one event per appointment of your business with minimal content (service, the client's first name, room and professional), without attendees. Respondo does not read or modify any other calendar.
• The name of the connected Microsoft account, to show you which one is connected.

We store only the start and end of each busy interval, the identifier of the «Respondo» calendar, the account name, the identifier of your organization at Microsoft and the refresh token Microsoft grants us to renew our access, stored encrypted and replaced by the new one Microsoft issues on every renewal (the short-lived access tokens are kept in memory only, never stored). We use this data solely to avoid offering or accepting appointments at times you are busy and to mirror your appointments in the «Respondo» calendar. We do not share it with third parties, do not sell it and do not use it for advertising or to train models.

You can disconnect it at any time from Settings › Integrations › «Disconnect»: Respondo deletes the «Respondo» calendar from your Outlook and removes the token and the busy intervals from our systems. Microsoft does not offer applications a way to withdraw the permission themselves: to remove it completely, go to the page of apps with access to your Microsoft account (or ask whoever administers your Microsoft 365 to remove Respondo). If you delete your Respondo account, the token and the busy intervals are deleted with it; the «Respondo» calendar stays in your Outlook unless you disconnect first or remove it yourself in Outlook.

3. Legal Basis for Processing (GDPR Article 6)

We rely on the following legal bases to process personal data:

• Contract performance (Art. 6(1)(b)) — Processing account data, billing data, and platform configuration is necessary to provide the Respondo service to our business customers under our Terms of Service.
• Legitimate interests (Art. 6(1)(f)) — We process usage data, technical logs, and analytics data to maintain platform security, detect fraud, improve our service, and send relevant product communications. We have assessed that our legitimate interests do not override the rights and freedoms of the data subjects concerned.
• Legal obligation (Art. 6(1)(c)) — We retain payment records and invoices for seven years to comply with Spanish tax and accounting obligations.
• Consent (Art. 6(1)(a)) — Where we deploy non-essential cookies or analytics tools, we rely on freely given, specific, informed, and unambiguous consent obtained through our cookie consent mechanism. Consent can be withdrawn at any time without detriment.

For data processed as a processor on behalf of our business customers (end-client data), the relevant legal basis is determined by the business customer as the Data Controller.

Is providing data mandatory? The account data described in Section 2.1 is a contractual requirement: it is needed to register and to provide the Service, and without it we cannot open or maintain your account. Payment data is needed to subscribe to a paid plan.

4. Special Category Data (GDPR Article 9)

Clinical notes and other health-related information recorded in our platform constitute special category data under GDPR Article 9. Processing this category of data requires an explicit legal basis beyond those listed in Article 6.

Respondo's position as processor: We process health data strictly on documented instructions from the business customer (the Data Controller). We do not use this data for any purpose other than providing the requested service.

Business customer obligations: Any business customer that enables the clinical notes feature must:

• Obtain explicit, documented consent from each end-client before recording health data (Art. 9(2)(a)), or identify another applicable Art. 9(2) basis (e.g., provision of healthcare under Art. 9(2)(h));
• Provide a clear privacy notice to end-clients explaining how their health data will be used, stored, and for how long;
• Ensure an appropriate Data Processing Agreement (DPA) is in place with Respondo before enabling this feature.

Business customers who fail to comply with these requirements do so in breach of our Terms of Service and applicable GDPR obligations.

5. How We Use Data

We use the personal data we collect for the following purposes:

• Service provision: Creating and managing accounts, processing subscriptions, enabling communication automation features, and delivering the core functionality of the Respondo platform.
• Communication automation: Sending SMS messages, handling call forwarding, and managing appointment reminders and follow-ups on behalf of our business customers.
• AI-powered features:Answering end-clients' WhatsApp and SMS messages on behalf of the business customer (conversation assistant), generating appointment summaries, suggesting follow-up actions, transcribing voice interactions, extracting data from supplier invoices and answering the business customer's questions about its own clients, appointments, invoices and messages (owner assistant, which sends end-clients' names and contact details, appointments, invoiced amounts and message excerpts to Anthropic when the business customer uses it) using integrated AI services (Anthropic and OpenAI). AI outputs are generated on behalf of the business customer and are not used to train AI models without explicit agreement.
• Voice agent for missed calls: Only for businesses that switch it on, an artificial intelligence voice assistant (ElevenLabs) answers the calls the business customer could not pick up, says at the start that it is an artificial intelligence and helps the caller book an appointment. The call audio is not recorded; its transcript is kept.
• Billing and subscription management: Processing payments, issuing invoices, managing subscription upgrades and downgrades, and enforcing usage limits.
• Customer support: Responding to queries, troubleshooting issues, and improving the onboarding experience.
• Security and fraud prevention: Monitoring for unauthorized access, detecting abuse, and maintaining audit logs.
• Product improvement: Analysing aggregated and anonymised usage patterns to improve platform performance, reliability, and features.
• Legal and compliance: Meeting our obligations under applicable law, including tax reporting, responding to lawful requests from competent authorities, and enforcing our Terms of Service.

6. Data Sharing and Sub-processors

We do not sell personal data. We share data only with trusted sub-processors that are necessary to deliver our service, and only to the extent required. All sub-processors are bound by contractual obligations consistent with GDPR requirements, except ElevenLabs, whose data processing agreement is pending signature (see below).

Our current sub-processors are:

• Clerk — User authentication and session management. Located in the United Kingdom. Certified SOC 2 Type II. Processes account credentials and user session data.
• Supabase — Database hosting and storage. Infrastructure located in the EU (Dublin, Ireland). Certified SOC 2 Type II and GDPR compliant. Processes all platform data stored in our database.
• Stripe — Payment processing and subscription management. Located in the United States (with EU operations). PCI-DSS Level 1 certified and SOC 2 Type II. Processes payment card data and billing information.
• Twilio — SMS and voice communications infrastructure. Located in the United States (with EU data residency options). Certified SOC 2 Type II and ISO 27001. Processes SMS content and call metadata.
• Meta Platforms Ireland Ltd. — WhatsApp Business Platform (Cloud API) for WhatsApp messaging on behalf of connected businesses. Located in Ireland (EU). Processes customer phone numbers, WhatsApp message content and media, message timestamps and delivery/read statuses, and WhatsApp account identifiers.
• Resend (Plus Five Five, Inc.) — Transactional email: consent requests and signed consent copies sent to end-clients, invoices and payment reminders sent by business customers, and booking-request summaries sent to business customers. Data stored in the United States. Certified SOC 2 Type II. Its Data Processing Addendum forms part of its terms of service; transfers rely on Standard Contractual Clauses and the EU-U.S. Data Privacy Framework.
• Anthropic— AI language model processing (Claude) for appointment summaries, follow-up suggestions and clinical assistant chat, and for the owner assistant: when the business customer uses the assistant, end-clients' names and contact details, appointments, invoiced amounts and message excerpts are sent. Located in the United States. Certified SOC 2 Type II. A Data Processing Addendum was accepted on 22 April 2026 (DPA effective 24 February 2025). Anthropic does not use customer data to train its AI models. Only processes content when AI features are enabled for your profile — you can turn them off any time in Settings → Privacy & Data.
• OpenAI— Conversation assistant that reads and answers the WhatsApp and SMS messages end-clients send to business customers; this runs for every business with messaging connected. When AI features are enabled, also data extraction from supplier invoices and audio transcription for clinical voice notes (Whisper API). Located in the United States. Certified SOC 2 Type II. A Data Processing Addendum was signed on 22 April 2026 (DPA v.010126). OpenAI does not train on API customer data. Conversation requests are sent with OpenAI's response storage turned off; OpenAI keeps abuse-monitoring logs for up to 30 days. Audio submitted to the API is retained for up to 30 days under OpenAI's default retention policy before deletion.
• TypeSafe AI, Inc. — Classifies the text of inbound messages to detect requests to stop receiving messages (opt-out), only for businesses where Respondo has switched this check on. Receives the message text only, without name, phone number or conversation history. Hosted in the United States. TypeSafe states that it does not train its models on the data it receives. The data processing agreement with TypeSafe is accepted through its platform terms and includes the Standard Contractual Clauses.
• Sentry — Error tracking and performance monitoring. Data region: EU (de.sentry.io). Certified SOC 2 Type II and ISO 27001. Error reports are always sent; session replays only run after the user accepts analytics in the cookie banner. Personal data in session replays is masked by default (all text and inputs are masked; media is blocked).
• PostHog — Product analytics. Data region: EU (eu.i.posthog.com). Certified SOC 2 Type II. Only receives anonymised usage events after the user opts in via the cookie banner; no clinical data is sent.
• Vercel — Application hosting and edge network. Headquartered in the United States with EU edge nodes. Certified SOC 2 Type II. Processes HTTP request data necessary to serve the application.
• Verifacti (Bilbabit, S.L.)— Verifactu e-invoicing: sends the records of the invoices business customers issue to the Spanish Tax Agency (AEAT). Receives each invoice's number, date, concept, tax lines and totals, the business customer's tax ID and, when the invoice names one, the recipient's name and tax ID. Hosts the data in the European Economic Area; under its terms, any access by its own providers from outside the EEA is subject to the safeguards of Chapter V of the GDPR. Publishes no certification. The data processing agreement with Verifacti was signed by both parties on 29 October 2026.
• ElevenLabs— Voice agent for missed calls, only for businesses that switch it on: answers the calls the business customer could not pick up, says that it is an artificial intelligence and helps the caller book an appointment. Processes the caller's voice during the call, their phone number, the call transcript and the appointment details. The call audio is not recorded; ElevenLabs keeps the transcript for 30 days. Located in the United States; transfers rely on Standard Contractual Clauses. ElevenLabs may use models from Google, OpenAI or Anthropic as a backup. Respondo has not yet verified any ElevenLabs certification. The data processing agreement with ElevenLabs, including those clauses, is pending signature.

A full and up-to-date list of sub-processors is maintained at /legal/sub-processors. We will notify business customers of any material changes to our sub-processor list with at least 30 days' notice, providing the opportunity to object.

We may also disclose personal data to competent public authorities (such as law enforcement or tax authorities) when required to do so by law, court order, or other legally binding obligation. We will notify affected customers of such disclosures where legally permitted to do so.

7. International Data Transfers

Some of our sub-processors — specifically Stripe, Twilio, Resend, Anthropic, OpenAI, TypeSafe, Vercel, and ElevenLabs — are based in the United States. Transfers of personal data from the European Economic Area (EEA) to the United States are subject to the requirements of GDPR Chapter V.

We ensure that all such transfers are governed by appropriate safeguards, specifically Standard Contractual Clauses (SCCs) as adopted by the European Commission under GDPR Article 46(2)(c). These clauses impose binding data protection obligations on the recipients of the data and grant enforceable rights to data subjects. The exception today is ElevenLabs, whose data processing agreement, including those clauses, is pending signature (see Section 6).

Where applicable, transfers are additionally covered by the EU-U.S. Data Privacy Framework (DPF), where sub-processors have obtained DPF certification.

You may request a copy of the applicable transfer mechanisms by contacting us at privacidad@respondo.es.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our retention periods are as follows:

• Account data: Retained for the duration of the active subscription and deleted within 30 days of account closure, unless a longer retention period is required by law.
• Communication logs (SMS and WhatsApp messages, call metadata): Retained for 12 months from the date of the communication, then automatically and permanently deleted on a rolling basis.
• Clinical notes and health data: Retained for the period configured by the business customer (Data Controller), subject to a default maximum of 5 years unless otherwise specified. Upon account closure, this data is deleted within 30 days unless the business customer requests earlier deletion or a legally required longer retention applies.
• Payment records and invoices: Retained for 7 years from the date of the transaction to comply with Spanish tax law (Ley 58/2003, General Tributaria) and accounting obligations.
• Usage and technical logs: Retained for 90 days for security and debugging purposes, then permanently deleted.
• Anonymised and aggregated analytics data: May be retained indefinitely as it cannot reasonably be used to identify individuals.

When retention periods expire, data is securely deleted or anonymised in accordance with our internal data retention policy.

9. Your Rights Under GDPR (Articles 15–22)

If you are an individual whose personal data we process as a Data Controller (including business customers and their authorised users), you have the following rights under GDPR:

• Right of access (Art. 15): You have the right to obtain confirmation of whether we process your personal data and to receive a copy of that data, along with information about how it is processed.
• Right to rectification (Art. 16): You have the right to request correction of inaccurate or incomplete personal data without undue delay.
• Right to erasure (Art. 17): You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where consent is withdrawn, or where processing is unlawful.
• Right to restriction of processing (Art. 18): You have the right to request that we restrict processing of your data in certain circumstances, for example while the accuracy of data is contested.
• Right to data portability (Art. 20): Where processing is based on consent or contract and is carried out by automated means, you have the right to receive your data in a structured, commonly used, machine-readable format and to transmit it to another controller.
• Right to object (Art. 21): You have the right to object to processing based on our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to withdraw consent (Art. 7(3)): Where processing is based on consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right to lodge a complaint: You have the right to lodge a complaint with the competent supervisory authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan, 6, 28001 Madrid. Website: www.aepd.es.

To exercise any of these rights, please contact us at privacidad@respondo.es. We will respond to all verified requests within 30 days, which may be extended by a further two months in cases of complexity or high volume. We will not charge a fee for exercising your rights unless requests are manifestly unfounded or excessive.

Note for end-clients of Respondo customers: If your personal data was entered into Respondo by a business (e.g., your salon, clinic, or spa), that business is the Data Controller for your data. Please direct your rights requests to them directly. Respondo will assist our business customers in responding to such requests in accordance with our DPA.

Automated Decision-Making (Art. 22)

Respondo does not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (GDPR Article 22).

The only automated check runs when a business saves its company details in its account settings: if the country given is the United States or one of its territories (Puerto Rico, Guam, the US Virgin Islands, American Samoa or the Northern Mariana Islands) and its business type matches a list of healthcare terms, the account is blocked automatically and the artificial intelligence features are switched off, because Respondo does not currently offer the Service to United States healthcare practices subject to HIPAA. The business may ask for a person to review the block by writing to privacidad@respondo.es: a person at Respondo reviews each request.

Data Deletion Requests

You can request the deletion of your personal data at any time:

• Business customers: email privacidad@respondo.es from your registered address requesting account deletion. Your account and all associated personal data are deleted within 30 days, except where a longer retention period is required by law (see Section 8).
• End-clients of a business using Respondo(including customers who message a business over WhatsApp via Meta's WhatsApp Business Platform): contact the business you interacted with — they are the Data Controller for your data — or email us at privacidad@respondo.es and we will forward your request to the relevant business and assist with its fulfilment.

9b. Your rights under the California Consumer Privacy Act (CCPA/CPRA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"):

• Right to know what categories of personal information we collect, the sources of that information, the purposes for which it is collected and with whom it is shared.
• Right to delete personal information we hold about you, subject to limited statutory exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing of personal information for cross-context behavioural advertising.
• Right to limit the use and disclosure of sensitive personal information.
• Right to non-discrimination for exercising any of these rights.

We do not sell personal information. We do not share personal information for cross-context behavioural advertising. We do not knowingly collect or sell personal information of minors under 16.

Notice at collection. We collect the personal information described in Section 2 for the business purposes set out in Section 5. We retain personal information for the periods described in Section 8. California residents may exercise their CCPA rights by emailing privacidad@respondo.es. You may also designate an authorised agent to submit requests on your behalf.

HIPAA and U.S. healthcare practices.Respondo is not currently offered to healthcare practices subject to the U.S. Health Insurance Portability and Accountability Act ("HIPAA"). We do not hold Business Associate Agreements with the sub-processors listed above. Registrations from U.S. healthcare practices that identify themselves as such at signup are blocked automatically. See our Terms of Service for the related customer representation.

10. Cookies and Similar Technologies

We use cookies and similar technologies to operate the Respondo platform. Cookies are small text files stored on your device by your browser.

Essential Cookies

These cookies are strictly necessary for the platform to function and cannot be disabled. They include:

• Authentication cookies (provided by Clerk): maintain your login session and protect your account against unauthorized access.
• Security cookies: CSRF protection tokens and session integrity markers.

Essential cookies do not require your consent as they are technically necessary for the service to function.

Analytics Cookies

With your consent, we may use analytics cookies to understand how the platform is used in aggregate, identify areas for improvement, and measure the effectiveness of new features. These cookies do not track you across other websites. You can change or withdraw consent at any time by selecting “Cookies” in the footer of the respondo.es website. When you withdraw consent, PostHog stops collecting new analytics events immediately; a batch collected before withdrawal may still finish sending. Vercel Web Analytics and Speed Insights stop collecting data from the next page load.

11. Children's Privacy

The Respondo platform is designed for use by adult service businesses and their professional staff. Our service is not intended for individuals under the age of 16, and we do not knowingly collect personal data from children.

If you are a business customer who becomes aware that an individual under the age of 16 has provided personal data through your use of Respondo, please contact us at privacidad@respondo.es and we will take steps to delete such data promptly.

12. Security Measures

We implement appropriate technical and organisational measures to protect personal data against unauthorized access, accidental loss, alteration, or disclosure. Our key security controls include:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.3 or higher.
• Encryption at rest: All data stored in our database is encrypted at rest using AES-256.
• Multi-tenant isolation:Our database enforces Row Level Security (RLS) policies that cryptographically prevent any business customer from accessing another customer's data.
• Access controls: Access to production systems is restricted to authorised personnel on a need-to-know basis, and protected by multi-factor authentication.
• SOC 2 compliant infrastructure: Clerk, Supabase, Stripe, Twilio, Resend, Anthropic, OpenAI, Sentry, PostHog and Vercel maintain SOC 2 Type II certification (see Section 6), ensuring the data they process is held to industry-recognized security standards. This statement does not extend to Meta, TypeSafe, Verifacti or ElevenLabs; TypeSafe and Verifacti publish no certification, and Respondo has not yet verified those of ElevenLabs.
• Regular security reviews: We conduct periodic internal security audits and address identified vulnerabilities in accordance with our vulnerability management policy.
• Incident response: In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the AEPD within 72 hours of becoming aware of the breach, and will notify affected individuals without undue delay where required by GDPR Article 34.

Despite these measures, no system is completely immune from security threats. We encourage business customers to use strong, unique passwords, enable multi-factor authentication, and report any suspicious activity to privacidad@respondo.es.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our services, or applicable legal requirements.

For material changes — those that significantly affect your rights or how we process your data — we will provide at least 30 days' advance notice via email to the registered contact address of our business customers, or via a prominent notice within the Respondo platform. The updated date at the top of this page will always reflect when the policy was last revised.

For non-material changes (such as clarifications, corrections of typographical errors, or updates to contact details), we will update this page without prior notice. We encourage you to review this policy periodically.

Your continued use of the Respondo platform after the effective date of a revised policy constitutes your acceptance of the updated terms, to the extent permitted by applicable law.

14. Contact and Data Protection

If you have any questions, concerns, or requests regarding this Privacy Policy or the way we handle your personal data, please contact us:

• Email: privacidad@respondo.es
• Platform: respondo.es
• Jurisdiction: Spain, European Union

We aim to respond to all privacy-related enquiries within 5 business days.

Respondo has not appointed a data protection officer because it is not required to (GDPR Article 37 and Article 34 of the LOPDGDD). Please send any data protection request to privacidad@respondo.es.

Supervisory Authority

Our lead supervisory authority under GDPR is the Agencia Española de Protección de Datos (AEPD):

• Address: C/ Jorge Juan, 6, 28001 Madrid, Spain
• Website: www.aepd.es
• Telephone: +34 912 663 517

You have the right to lodge a complaint with the AEPD at any time if you believe we have not handled your personal data in accordance with GDPR. We would, however, appreciate the opportunity to address your concerns directly before you approach the supervisory authority.