Privacy policy

This policy explains what personal data we process, why, for how long and what rights you have. It applies to the xerra.es website, the demo waiting list and the app.xerra.es platform.

Controller

• Controller: Oriol Testart i Riumalló (Xerra), self-employed professional
• NIF (Tax ID): 41590266X
• Address: C/ La Farga, 5, 17401 Arbúcies (Girona)
• Email for any privacy matter: hola@xerra.es

What data we process and why

If you sign up for the demo

• Data: name, company or organisation, email, website, website platform, whether you are a business or an agency, how many websites you manage, language, date and time, and your acceptance.
• Purpose: to manage the waiting list, prepare your demo and write to you when it is your group’s turn.
• Legal basis: your consent (article 6.1.a GDPR), which you can withdraw at any time.
• Retention: for as long as the waiting list and the demo last. If you do not become a customer, we delete the data no later than 2 years after the last contact, or sooner if you ask us to.

If you sign up with the email field in the footer, we only keep your email address, until you complete the form or ask us to delete it.

If you write to us

• Data: whatever you send us by email.
• Purpose: to reply to you.
• Legal basis: your consent when you write to us and, if you are already a customer, the contract.
• Retention: for as long as needed to deal with your enquiry and, at most, 1 year afterwards.

Website analytics

Only if you accept it in the cookie banner, we use Google Analytics to find out, in aggregate, how many visits the website receives and which pages are viewed. If you reject it or do not respond, it is not loaded and nothing is sent to Google. The legal basis is your consent. We explain this in the cookie policy.

If you are a platform customer

• Data: account data (name, email, encrypted password, organisation and role), billing and payment data, usage and the account’s activity logs.
• Purpose: to provide the service, give you support, invoice you and keep the platform secure.
• Legal basis: the contract (article 6.1.b GDPR) and, for invoices, a legal obligation (article 6.1.c).
• Retention: while the account is active. Afterwards, for as long as the law requires: invoices and accounting records, 6 years (article 30 of the Spanish Commercial Code).

Security

The servers log technical data such as the IP address, the browser and the time of requests in order to protect the website and the platform from abuse and attacks. The legal basis is our legitimate interest in keeping the service secure. Logs are kept for no longer than strictly necessary.

Conversations of visitors to customers’ websites

When a customer adds the Xerra chat to their website, we process their visitors’ conversations on the customer’s behalf. The customer is the controller of this data and Xerra is the processor (article 28 GDPR):

• We use them only to provide the service to the customer: to answer, to show the customer the conversations, ratings and results, and to hand the conversation over to a member of their team when needed.
• We do not use them for our own purposes and we do not sell them.
• The chat stores a random identifier and the conversation’s identifier in the visitor’s browser so that they can continue the conversation. These are not tracking cookies.
• If you are a visitor to a customer’s website and want to exercise your rights, contact the owner of that website. If you write to us, we will forward your request to them.

Artificial intelligence

To answer, the platform sends the question and the relevant excerpts of the customer’s content to an AI model provider. Under the commercial terms of the providers we use, this data is not used to train their models. We do not make automated decisions with legal effects on anyone.

Who we entrust data to

We do not disclose data to third parties, except where required by law. To provide the service we work with these providers, which process data on our behalf and under contract:

Provider	Purpose	Location
Dinahosting, S.L.	Hosting of the xerra.es website and email	Spain
Laravel Holdings Inc. (Laravel Cloud)	Hosting of the platform, the database and files	European Union
Anthropic, PBC	AI model that generates the answers	United States
Google LLC	Content index for search (Gemini) and, with consent, Google Analytics	United States
OpenAI, L.L.C.	Alternative AI model, only if the customer chooses it	United States
Stripe Payments Europe, Ltd.	Payments	Ireland
Meta Platforms Ireland Ltd.	WhatsApp channel, only if the customer connects it	Ireland

Transfers to the United States are made with the safeguards required by the GDPR: the provider’s certification under the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

Your rights

You can ask to access your data, rectify it, erase it, object to its processing, restrict it or port it to another service, and withdraw your consent at any time. Write to hola@xerra.es stating what you are requesting. We will reply within one month at most.

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD, aepd.es).

Security

We apply technical and organisational measures to protect data: encrypted connections, encrypted passwords, restricted access and separation of the data of each organisation and each assistant.

Minors

Xerra is not aimed at children under 14 and we do not knowingly collect their data.

Changes

If we change this policy, we will indicate it on this page with the date of the last update. If the change is significant, we will notify customers and the people on the waiting list.

Last updated: 19 October 2026.