Privacy policy

We have not appointed a data protection officer. For any question about this policy or to exercise your rights, write to info@corebrain.es.

CoreBrain handles personal data in two situations that the law keeps apart, and which carry different responsibilities:

• As controller, regarding the data of our own clients and business contacts: whoever writes to us, whoever requests a demonstration and the people who access the management portal.
• As processor, regarding the data of the people who interact with the assistants we build for our clients. There the controller is the business that contracts the service —the shop, the clinic, the retailer—, which decides what the assistant is used for and what information it is given. We handle that data following its instructions and under a data processing agreement in accordance with Article 28 of the GDPR.

From whoever contacts us or uses the portal: name, email address, company and the content of the communication; and, for the people with access to the portal, their account details and the log of their activity on the platform.

From whoever talks to an assistant: the content of the conversation; the contact details the person provides themselves (name, phone, email); the identifier supplied by the channel they write through —phone number on messaging, social network identifier, email address—; and a temporary session identifier that keeps the thread of the conversation.

We do not collect data we do not need. We do not store IP addresses in our databases: they are used only, and in memory, to limit the rate of requests and prevent abuse. We do not use analytics, advertising or tracking cookies. We do not build profiles or make automated decisions with legal effects on people.

When a client decides to connect their Google account so the assistant can manage their calendar, the connection is made through Google’s authorisation procedure (OAuth). At that moment Google shows exactly what access is being granted, and the authorisation can be revoked at any time from the Google account or by asking us to disconnect it.

What we access. Only the calendar of the account that is connected, with the minimum scope needed for the contracted functions: checking availability and creating, changing or cancelling the appointments the assistant manages.

The app: CoreConversa. The application that requests and uses this access is CoreConversa, and it appears under that name on Google’s permissions screen. It requests the https://www.googleapis.com/auth/calendar.events scope and uses it only to:

• read the events on the primary calendar of the connected account, and receive Google’s notifications when they change, in order to know which times are busy and avoid booking an appointment on top of another commitment;
• create the appointments that are booked on that calendar;
• move an appointment to another date or time when it is changed;
• cancel an appointment by deleting its event from the calendar.

CoreConversa does not create, delete or modify calendars, and it does not access any other calendar on the account.

It also requests the openid and https://www.googleapis.com/auth/userinfo.email scopes, solely to read the email address of the connected Google account and show it in the panel as “Conectado como …” (“Connected as …”); it does not use them for anything else.

What we use it for. Exclusively to provide those calendar functions to the very client who granted the access. To be able to answer about availability or arrange an appointment, the strictly necessary information —free and busy slots, and the details of the appointment being handled— is processed through the provider of the language model that generates the reply, which acts as our processor and does not use it to train its models.

In particular, and without exception:

• we do not sell the data obtained from Google, nor transfer it to third parties for advertising, marketing or profiling purposes;
• we do not use it for advertising of any kind, neither our own nor anyone else’s;
• we do not use it to train or fine-tune generalised artificial intelligence models;
• we do not allow any person to read it, unless it is essential for security reasons, to comply with the law, or when the account holder expressly asks us to in order to resolve an incident;
• it is only transferred to the providers strictly necessary to deliver the functionality described, which act as our processors and under contract.

When access is revoked, we stop syncing and delete the connection credentials. The credentials are stored encrypted.

We do not sell personal data or transfer it to third parties for their own purposes. To provide the service we rely on the following providers, which act as processors on our behalf and under contract:

In addition, when the client controller has configured it, the assistant may send the contact details a person provides to that same client’s systems —its CRM, its notification manager or its automation platform—. In that case the data goes back to whoever is already its controller, and its further processing is governed by that business’s privacy policy.

We may also disclose data to public authorities, judges and courts where there is a legal obligation.

The database and the hosting of the service are in the European Union. Some of the providers in the table above —in particular those of language models, transcription and voice synthesis— process the information outside the European Economic Area, mainly in the United States.

Those transfers rely on the standard contractual clauses approved by the European Commission or, where applicable, on adequacy decisions, together with the corresponding supplementary measures. You can ask us for information about the safeguards applied by writing to info@corebrain.es.

• Requests for information: for as long as the relationship lasts and, afterwards, for the limitation periods of any possible liability.
• Client and billing data: for the term of the contract and the statutory tax and commercial retention periods.
• Conversations with the assistants: the period is set by the client controller. The platform allows a retention period to be configured per client: once it elapses, the messages are deleted and the contact details and channel identifiers linked to the conversation are erased.
• Kiosk usage records: the query made and its category are kept linked to the device, not to an identified person, while the service is active, to produce usage statistics.
• Error logs: kept for a limited period, without contact details or conversation content.

Voice. When someone talks to a kiosk, the audio of that turn is sent to the transcription provider to convert it into text and is then discarded: no recording is stored. What is kept is text, under the terms of the previous section.

Presence detection. Some kiosks have a function, off by default and which each business decides to switch on, that detects that there is a person in front of it in order to start the greeting. That detection happens entirely inside the device itself: it does not record, does not keep images, does not transmit them to any server and does not identify or recognise anyone. The system only determines whether or not there is someone in front of the screen; it generates no biometric data and cannot tell one person from another. Businesses that switch this function on must inform of it with the appropriate signage.

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw consent where the processing is based on it, by writing to info@corebrain.es. We may ask you to prove your identity.

If your request concerns a conversation held with the assistant of a particular business, the controller is that business: we will tell you whom to contact or pass your request on to them.

If you believe we have not handled your rights properly, you can lodge a complaint with the supervisory authority. The Portuguese one, the country where the controller is registered, is the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt). The GDPR also lets you complain to the authority of your country of residence: if you live in Spain, the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).

We apply appropriate technical and organisational measures: encryption in transit, isolation of each client’s data through access controls in the database itself, encryption of third-party system credentials, access restricted to the necessary staff and logging of relevant activity. No system is infallible; if a security breach occurred that posed a risk to your rights, we would act in accordance with Articles 33 and 34 of the GDPR.

This site does not use analytics, advertising or tracking cookies, nor does it share browsing data for those purposes. The management portal uses strictly necessary cookies to keep the session of the person who has signed in.

The chat and voice assistants keep a session identifier and the last messages in the browser’s temporary storage, so the conversation is not lost when the page is reloaded. That information is deleted when the tab is closed and is not used to identify anyone or to follow their browsing on other sites.

The service is aimed at companies and professionals; it is not intended for minors and we do not knowingly collect data from minors. If we find we have received data from a minor without the corresponding authorisation, we will delete it.

We may update this policy to reflect changes in the service or in the regulations. The version in force is always the one published on this page, with its update date. If a change substantially affects the processing, we will communicate it by an appropriate means.

This policy is written in Spanish and translated into English for convenience. In the event of any discrepancy between the two versions, the Spanish version prevails.