Privacy policy
Last updated: 26 September 2026
In short
papaia is a service of AI customer assistants for businesses. This policy explains what we do with the personal data we are the controller of: that of people who visit our website or write to us, sign up, use the panel, talk to our own assistants (Nai on the website and Ayuda in the panel) or connect their business’s WhatsApp.
Controller: Gustavo Jimenez Gamo (papaia). Purposes: answering you, signing you up and giving you access to the panel, assisting you with our assistants and providing the service. Legal basis: the contract or the steps you ask us to take before it, your consent, our legitimate interest or a legal obligation, depending on the case; each section says which. Recipients: the providers on the list, which process the data on our behalf, and those in the section «Other recipients»; we do not sell data or use it for advertising. Rights: access, rectification, erasure, objection, restriction and portability, by writing to hello@papaia.to.
If you talked to the assistant of another business that uses papaia, the controller is that business and its own policy informs you (section «If you talked to a business’s assistant»). To ask us to delete your data, go to the section «How to ask us to delete your data».
Who the controller is
Gustavo Jimenez Gamo, tax ID 48999122Z, with registered address at Villamiel de Cáceres 2, 28042 Madrid, who provides the service under the papaia brand. For any privacy matter: hello@papaia.to.
We have not appointed a data protection officer.
What this policy covers
It covers the processing papaia is the controller of: the website and the contact form, sign-up from the website, the panel, our assistants Nai and Ayuda, the tests of businesses not yet activated whose assistant links this policy (demos and sign-ups from the website start that way), businesses’ WhatsApp connection, and our relationship with the businesses and agencies that hire us.
It does not cover the data of the customers of each business that uses papaia: we process it on behalf of that business, which is the controller, under a data processing agreement (article 28 of the GDPR). The section «If you talked to a business’s assistant» explains it.
The website and the contact form
When you visit the website, like any web server, our hosting provider receives your IP address, your browser details and the address of the page you request, and keeps them in its request logs for the period its service sets. We use them only to serve the website and protect it from abuse, on our legitimate interest in it working and being secure (article 6.1.f of the GDPR). We use no analytics or advertising tools, and fonts are served from our own domain.
From the contact form we receive your name, your email, your message and, if you give them, your business’s name or website; we add the page language and the date. The form stores nothing in our database: it reaches our mailbox as an email and we reply from there. Name, email and message are required, because without them we cannot answer you.
We use them to answer your enquiry and, if you give us your business’s website, to prepare a demo with it (section «Demos and sign-ups not yet activated»). The legal basis is your consent, given by ticking the form’s box or by writing to us (article 6.1.a of the GDPR); you can withdraw it at any time by writing to hello@papaia.to. To limit submissions per person we use your IP address only in the server’s memory, without storing it.
We delete your messages from our mailbox at most twelve months after the last contact, unless you hire the service: then they are kept for as long as the contract lasts and, afterwards, for the limitation periods of any claims that may arise from it.
Signing up from the website
Data: your email, your business’s website address, the package, the sector and the language and, if you came from a campaign or referral link, its parameters. The form’s box only confirms that you have read this policy and the terms.
When you send the form we email you a link that expires in 1 hour. Until you open it we store nothing in our database: the data travels inside the link itself, signed so that nobody can change it but not encrypted, so it may also end up in our hosting provider’s request logs and in our email provider’s log of sent emails.
When you open the link we create your panel account and a draft of your business with that data, make you its owner and open your session, and an internal notice reaches us by email with the business’s identifier, its website, the package and the sector, without your email. To prepare the assistant we read the public pages of your website, which may include names of people on your team.
Legal basis: the pre-contractual steps you ask us to take by signing up (article 6.1.b of the GDPR). Email and website are required: without them we cannot create the draft.
Retention: if it is not activated, the draft expires 30 days after it was created, or later if we extend that period, and on expiry it is deleted with its data. What remains is your panel account (section «The panel: accounts, access and acceptances») and the technical traces of the tests (section «How long we keep data»).
The panel: accounts, access and acceptances
Data of the people who use the panel (owners and staff of businesses and agency administrators): your email; your name, if whoever invited you gave it; which businesses or agencies you have access to and in which role; the sign-in links you request, of which we keep only a fingerprint, their expiry and when they were used; the log of what you do in the panel under your internal identifier, for example who changed the configuration, took over a conversation, resolved a handoff or invited the owner; and, when we give you support, an internal note of the time spent.
Acceptances: when you accept the terms or the data processing agreement on behalf of a business we record the document, its version, the date and time, how it was accepted, in which role, your IP address and your browser, and we email you the receipt.
Access: you sign in with a link we email you, which expires in 15 minutes (72 hours for an invitation). We reply the same whether or not the account exists. Your session lasts 30 days or until you sign out (section «Cookies and storage in your browser»). We also email you receipts and service notices, for example the business’s activation to its owner or usage notices to its agency’s administrators.
Purpose and legal basis: managing your account and your access and providing the service your business or agency hired (article 6.1.b of the GDPR if you are the one who contracts; if someone else invited you, our legitimate interest and that of the business or agency in giving access to the people they designate, article 6.1.f); protecting the panel with usage limits per email and per IP address, applied in memory without being stored, and logging who changes what, on our legitimate interest in security and in being able to evidence each business’s instructions (article 6.1.f); and being able to prove the acceptances, on our legitimate interest in evidencing the contract (article 6.1.f).
Who sees it: the other people with access to the same business see your name or your email, for example when a conversation is assigned to you; if the business is assigned to an agency, its administrators see the business’s team; and we do, to provide the service.
Retention: your account and the fingerprints of your links are kept until you ask for it to be deleted; they are not deleted with a business, because they may give access to others. The log of configuration changes, invitations and acceptances is kept for as long as the business exists; what you do in a conversation (taking it over, assigning it, resolving a handoff) is deleted with it, within the assistant’s retention period. When a cancelled business is deleted, 30 days after it cancels, we keep a closing record with the accepted contracts (document, version, date, how it was accepted and the role of whoever accepted), without your IP address, your browser or your identity; today that record has no deletion date.
If you hire the service
If your business or agency hires the service, we process its billing data (name or company name, tax ID, address and billing email) and its payment data to invoice and collect, under the contract (article 6.1.b of the GDPR), and to meet our tax and accounting obligations (article 6.1.c). We keep them for the periods required by tax and commercial law. Today payments do not go through the panel.
Nai, our website’s assistant
On our website you are assisted by Nai, an artificial intelligence assistant. It stores nothing until you write to it.
Data: your messages and its answers; the page you open the chat from, the page you came from and, if any, the campaign or referral parameters; the language; your name, if you tell us (Nai asks for it at the start to address you and keeps it with the conversation); and, only if you give them so that we contact you, a phone number or an email, with the date you gave them, after the assistant shows you the link to this policy. From the conversation, the assistant writes a card (summary, intent, urgency and next step) so that a person can answer you sooner.
Purpose and legal basis: answering your questions about the service, on our legitimate interest in assisting whoever opens the chat on our website (article 6.1.f of the GDPR); and contacting you, with your consent, given when you leave your details (article 6.1.a), which you can withdraw at any time. Your contact details, the card and requests to talk to a person reach us by email; a handoff notice carries the last messages of the conversation.
Retention: the period set for the assistant, shown on its data page, linked in the chat’s footer; by default, 12 months from the start of the conversation. The clean-up runs monthly, so data may stay up to one month longer. We delete the notices that reach us by email from our mailbox within the same period. Separately, the technical traces remain (section «How long we keep data») and, for as long as we keep the assistant, so do the questions it could not answer and its monthly reports, stored after hiding the contact details detected.
Ayuda, the panel’s assistant
In the panel of the businesses that hire us directly, the owner and their team have Ayuda, an artificial intelligence assistant that explains the panel and the sign-up.
Data: your messages and its answers, the language, the address of the panel page you open it from, which includes your business’s identifier, and that of the page you came from. The conversation is not linked to your account, but that address shows which business it belongs to. If you report an issue or ask for a person to answer you, we keep your name and a phone number or an email, with the date you gave them, and an issue card (summary, urgency and next step) that the assistant writes, and a notice reaches us by email with the last messages of the conversation.
Legal basis: providing the service your business hired (article 6.1.b of the GDPR) or, if you are not the one who hired it, our legitimate interest in helping whoever uses the panel (article 6.1.f). The contact details of an issue, with your consent, given when you leave them (article 6.1.a), which you can withdraw at any time.
Retention: as with Nai, the period shown on its data page; by default, 12 months, with the same monthly clean-up and the same exceptions.
Demos and sign-ups not yet activated
A demo is a test assistant that we or a partner agency prepare with a business’s website, to show it to that business. A sign-up not yet activated is the draft created when you sign up on the website. Both start by linking this policy and, while the assistant of a business not yet activated links it, papaia is the controller of what is said in its tests.
Data: the business’s name, website, sector and language, and the content of the public pages of its website; the test conversations, from the demo link or from the panel’s test chat, which is linked to the account of whoever tests; any contact details someone writes in a test, stored only with the message in a demo and, in a sign-up not yet activated, also as a contact record (summary, intent, urgency and next step) that is sent to no one; if a partner agency prepares the demo, its administrators see the test conversations in the panel, including those from the demo link, and whatever is written in them; and the ratings of the answers in the panel, stored as test cases of the assistant.
Legal basis: for a sign-up, the pre-contractual steps the business asks for (article 6.1.b of the GDPR); for a demo, our legitimate interest in showing the service to a business that may hire it (article 6.1.f).
Retention: a demo expires 7 days after it was created and a sign-up not yet activated 30 days after, or later if we extend a sign-up’s period; on expiry they are deleted with all their data, except the technical traces and the panel accounts. A demo that becomes a business of the service stops expiring, and from then on its conversations follow the period that business sets.
WhatsApp and Meta
A business can connect its WhatsApp Business account so that its assistant answers on WhatsApp. We or its agency make the connection from the panel, with the details the business provides.
Connection data: the identifier of the WhatsApp Business account and of the number, the number customers see, the message templates created from the panel in that account for notices, for reopening conversations and for reminders, with their status, and the access token the business provides. The token is stored encrypted, with a key that is not in the database, and is never shown again. Meta also returns the business’s verified name, which we only show in the panel when connecting, without storing it.
Purpose and legal basis: providing the WhatsApp channel the business hires (article 6.1.b of the GDPR). We use this data only to serve that business, kept apart from any other business’s data.
Retention: when WhatsApp is disconnected we delete the token at once and remove the connection from the current configuration. The history of configuration changes, which records the business’s instructions, keeps the identifiers and the number until the business is deleted, 30 days after it cancels.
Messages: the messages, voice notes and images customers send to the business on WhatsApp, and their number, are processed on behalf of the business, which is the controller (section «If you talked to a business’s assistant»). Voice notes and images are not stored: they are transcribed or described once and only that text is kept. We do not store the WhatsApp profile name.
Data we receive through Meta is not sold or used for advertising, and is only disclosed to that business and, if it has one, its agency; to the providers on the list that need it to provide the service to it; to the destinations the business itself sets up (for example, its email, its spreadsheet or its webhook); and to authorities in the cases of the section «Requests from public authorities». The card the assistant writes from a conversation only helps the business attend to that person. Nor is it used, even anonymised or aggregated, to create, train or improve artificial intelligence models. Meta also processes data under its own terms and its own privacy policy.
Data you do not give us yourself
If you are invited to the panel (by an agency or by us), whoever invites you gives us your email and, if they give it, your name. If an agency signs up your business, it gives us your email and the business’s details.
When WhatsApp is connected, Meta returns the number customers see and the business’s verified name. When we prepare an assistant we read the public pages of the business’s website, which may contain people’s names.
If you talked to a business’s assistant
When you talk to the assistant of a business that uses papaia, on its website or on WhatsApp, the controller of your data is that business, even if the assistant carries an agency’s brand. We process the data on its behalf, as a processor, and only to provide the service to it.
Its privacy policy is linked in the assistant’s first message and, on the web, its data page is linked in the chat’s footer: it says what is kept, for how long, with which providers and how to ask for a copy or for deletion.
To exercise your rights, contact the business. From its panel it can delete, in a single operation, your conversations, messages, contact cards, handoffs, appointments and deliveries. If you write to us, we do not decide on your request: we forward it to the business without undue delay and tell you so.
The exception is demos and sign-ups not yet activated that still use this policy (section «Demos and sign-ups not yet activated»): we are responsible for those tests.
Artificial intelligence assistants
Nai, Ayuda and the businesses’ assistants are artificial intelligence systems. They say so in their first message, as article 50 of Regulation (EU) 2024/1689 on artificial intelligence requires, and that notice cannot be turned off.
Each assistant answers with its business’s content (Nai with our website’s, Ayuda with the panel’s) using language models from the providers on the list. They are not general-purpose assistants.
No assistant takes decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you (article 22 of the GDPR). The card the assistant writes (summary, intent and urgency) only helps a person answer you sooner. If you would rather talk to a person, tell the assistant.
What we do not do
We do not sell personal data or share it for advertising, we do not show advertising and we do not buy data from third parties.
We do not use conversations, whether with our assistants or with the businesses’ ones, to create, train or improve artificial intelligence models, not even anonymised or aggregated. Model providers receive the messages to process each one (answer it, search the assistant’s content and classify it), as processors. Unanswered questions and the ratings in the test chat are only used to complete the content and the tests of that same assistant.
We do not combine one business’s data with another’s. The cards the assistants write only help answer the person in the conversation.
Providers
These providers process data on our behalf or on behalf of the businesses, as processors. Each one receives only the data it needs for its function:
- Hosting of the website, the panel, the assistants and the reception of WhatsApp messages: Vercel (functions in Frankfurt, Germany; global content delivery network)
- Database: Supabase (European Union)
- Language models of the assistants, voice note transcription and image description: Scaleway (European Union)
- Search in each assistant’s content, message classification and backup model: Mistral AI (as set in its processing contract)
- Technical traces of the answers, after hiding the contact details detected: Langfuse (European Union)
- Email delivery: sign-in links, receipts, contact form and notices: Resend (as set in its processing contract)
- Scheduled jobs of the service: GitHub Actions (United States, as set in its processing contract)
- WhatsApp messaging: Meta (WhatsApp) (as set in its processing contract). Only for businesses that connect WhatsApp.
- Appointments in the businesses’ Google calendars: Google Calendar (as set in its processing contract). Only for businesses that use a Google calendar.
Other recipients
Email you write to hello@papaia.to also goes through our email providers: it reaches us through Cloudflare’s email forwarding into the mailbox where we read it, hosted by our email provider.
Apart from the providers, we only disclose data to the business or agency you work for or give access to, inside the panel; to the agency that prepared the demo you are testing (section «Demos and sign-ups not yet activated»); and to authorities, in the cases of the section «Requests from public authorities».
Transfers outside the European Economic Area
The database and the application’s functions are in Frankfurt (Germany), and the main language models run in Paris (France).
Some providers are outside the European Economic Area or may process data outside it: scheduled jobs run in the United States, the hosting’s content delivery network is global and, for the providers without a location on the list and the email providers in the section «Other recipients», the one that results from their contract.
We only transfer data outside the European Economic Area with one of the safeguards of Chapter V of the GDPR: an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for the entities that have joined it, or the standard contractual clauses approved by the Commission, with any supplementary measures required. You can ask us at hello@papaia.to which safeguard applies to each provider and for a copy.
How long we keep data
Each section of this policy states its period. In addition:
The technical traces of the assistants’ answers (the message and the answer after hiding the contact details detected, which does not hide names or all free text) are kept for as long as our account’s settings at the traces provider set. They are not deleted by the retention clean-up or when a business is deleted; we do try to delete them when we delete a person’s data.
The hosting provider’s request logs, those of the scheduled jobs and the email provider’s log of sent emails are kept for as long as each service sets. If the database provider keeps backups, deleted data may remain in them until they are renewed.
If a law requires us to keep some data, we block it and use it only to comply with that law.
Security
The website, the panel and the assistants run encrypted in transit (HTTPS). Integration credentials, such as the WhatsApp token, are stored encrypted with a key kept outside the database. Each business’s data is kept apart from the rest in the database. Before writing a technical log or a trace we hide the contact details detected. And access to the data is limited to the people at papaia who need it.
Your rights
You can ask us for access to your data, to rectify or erase it, to restrict its processing or to receive it in a structured format (portability), and you can object to its processing. If we process data on our legitimate interest (for example, the conversation with Nai or the security logs), you can object at any time on grounds relating to your particular situation. If we process it with your consent, you can withdraw it at any time, without affecting what was processed before.
Write to hello@papaia.to from your account’s email, or stating the email or phone number you wrote to us or talked to the assistant with, and say which right you exercise. It is free. If we have reasonable doubts about your identity, we may ask you for what is needed to confirm it. We reply within one month, which we may extend by two further months for complex cases, telling you within the first month.
If you talked to a business’s assistant, that business handles your rights (section «If you talked to a business’s assistant»).
If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
How to ask us to delete your data
Write to hello@papaia.to with the subject «Data deletion», from your account’s email or stating the email or phone number you wrote to us or talked to the assistant with. We confirm we have received it, delete the data without undue delay and within one month at most, and tell you in writing what we have deleted, what we keep and why.
Panel account: we delete your account, with your email and your name, the fingerprints of your sign-in links and your access to businesses and agencies. The logs of what you did in the panel stop pointing to your account; some keep an internal identifier that no longer belongs to anyone. If you accepted the terms or the data processing agreement on behalf of a business, we keep the record of that acceptance, with its date, the IP address and the browser, for as long as the business exists, as proof of the contract, even though it is no longer linked to your account. If you are the owner, deleting your account does not cancel the business: cancellation is requested separately.
Contact messages: we delete them from our mailbox.
Conversations with Nai or Ayuda: give us the email or phone number you gave or, if you gave none, when you talked and from which page. In a single operation we delete your conversations, messages, contact cards, handoffs, appointments and deliveries, and we try to delete their technical traces; we also delete from our mailbox the notices we received. If a stored unanswered question contains your data, tell us and we delete it.
Your business and its WhatsApp connection: the owner can ask us, or their agency, to disconnect WhatsApp, and the agency can do it from the panel; the access token is deleted at once and the connection leaves the configuration. To delete all the business’s data, ask for cancellation: 30 days later we automatically delete its configuration and its history, its conversations, its credentials and the access to it, as the terms and the data processing agreement detail; in our database only the closing record remains, and the panel accounts of its team are kept until each person asks for theirs to be deleted (section «The panel: accounts, access and acceptances»); the technical traces follow their own period (section «How long we keep data»).
If you talked to a business’s assistant, on its website or on WhatsApp, ask that business for the deletion: its policy, linked in the assistant’s first message, and on the web its data page, say how. The business does it from its panel. If you ask us, we forward it to the business without undue delay and tell you so.
What we cannot delete immediately: the database provider’s backups are renewed on their own cycle, and the providers’ traces and technical logs follow their own periods (section «How long we keep data»). Data a law requires us to keep, such as billing data, stays blocked and is used only to comply with that law.
Changes to this policy
Each version of this policy shows its date at the top of the page, and we publish any change here. Contact details left with Nai or Ayuda keep the version in force when they were left.