Service privacy

Last updated: 10 October 2026

This policy explains how we process personal data when a business uses Vural, the assistant that answers on WhatsApp, manages appointments and sends reminders on its behalf. The privacy of the vural.io website is covered by the website privacy policy.

1. Who we are

Aura Tech, S.L. (single-member limited company), CIF B67702654, registered office at Avenida Luis Vilaclara, 2, 08274 Sant Feliu Sasserra (Barcelona), Spain. Contact: hola@vural.io.

2. Two different roles

• We are the controller of the account data of each business that subscribes to Vural: login email and password, the business’s name and tax details, the subscription.
• We are a processor, on behalf of each business, of its customers’ data. The business is the controller: it decides what the data is used for, and it is who its customers should contact to exercise their rights. We process it only to provide the service and following the business’s instructions.

3. What data we process

About each business’s customers:

• Phone number and, if they give it, their name.
• The WhatsApp messages they exchange with the business. For files (photos, audio, documents) we keep the reference WhatsApp provides, not the content.
• Their appointments, their place on the waitlist and, if the business asks for a deposit, the Stripe payment reference. We never store card data.
• What the business adds to their record: email, address and postcode, birthday (day and month), tags and notes.
• Short facts the assistant remembers to serve them better (for example, a preferred time). The assistant is instructed not to save health information.

About businesses: email and password (stored irreversibly), name and tax details, service configuration and, if they connect external accounts (Stripe, Google Calendar, WhatsApp), the credentials needed, encrypted.

4. What for

So the assistant can answer the business’s customers, check availability, manage and remind appointments and alert the business’s team when a person is needed; to take deposits when the business sets them up; and, for businesses, to give them access, bill the subscription and send them service notices.

Legal basis: for businesses’ data, performance of the contract; for their customers’ data, the one each business determines as controller.

5. Who else is involved (sub-processors)

• WhatsApp Ireland Limited (Meta). Receiving and sending the WhatsApp messages. Ireland (EU); transfers data to the US under the EU-US Data Privacy Framework and, failing that, standard contractual clauses.
• Anthropic Ireland Limited. The AI model that reads the conversation and drafts the assistant’s reply. It acts as a processor and may use the data only to provide the service, under its data processing agreement. Ireland (EU); processing takes place in the US, under the European Commission’s standard contractual clauses.
• Hetzner Online GmbH. The servers Vural runs on and where the data is stored. Helsinki data centre (Finland), EU.
• Sendinblue SAS (Brevo). Service emails: account verification, alerts to the business’s team (which may include the customer’s latest messages) and the weekly summary. EU.
• Stripe Payments Europe Ltd. Deposits and subscription. EU (Ireland).
• Google Ireland Ltd. Only if the business connects Google Calendar: the appointment is created in its calendar with the customer’s name or phone. EU / per Google.

We do not sell data or pass it to third parties for their own purposes.

6. How long

• Message text and file references are deleted once the business’s retention period has passed (12 months, unless the business sets another).
• The assistant’s internal technical records are deleted after 90 days.
• Notes and what the assistant remembers about a customer are deleted after that period without activity.
• Everything else (customer record, appointments, waitlist) is kept while the business keeps its account or until it asks for deletion.
• When a business leaves, we delete its data and its customers’ data within 30 days, except what the law requires us to keep (the subscription billing).

7. Rights

If you are a customer of a business that uses Vural, contact that business: it is the controller, and we help it handle your request. When a business asks us to delete a customer’s data, we delete their conversations and messages, appointments, place on the waitlist, record and phone numbers.

If you are a business, you can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to hola@vural.io. You can also complain to the Spanish Data Protection Agency (aepd.es).

8. App cookies

The businesses’ app uses a technical session cookie (vural_app_session, 7 days) to keep you signed in, and stores in your browser the language, theme and setup mode you choose. It uses no analytics or advertising cookies.

9. Security

Encrypted connections (HTTPS), passwords stored with an irreversible key-derivation function and encrypted credentials for external services.

10. Changes

If we change this policy we will update the date above and email businesses when the change affects them.