Privacy Policy

1. Data Controller

• Owner: Anthony Jair Torres Rosas
• Trade name: NeoWeb agencIA
• NIF: 61731889G
• Address: Isabelita Usera Street, 13, Ground Floor Right, 28026 Madrid (Spain)
• Phone: +34 633 37 52 62
• Email: 1913torres@gmail.com

No Data Protection Officer (DPO) has been appointed because none of the circumstances under Article 37 of the GDPR apply. For any privacy-related questions, you can contact us directly at the email provided.

2. Data we process and how we obtain it

We only process the data you provide us or that is generated by your interaction with the website:

• Contact and identification data: name, email, phone number, and any data you voluntarily include when filling out contact forms, using the savings calculator, requesting the free resource (checklist), or booking an appointment.
• Your business data: sector, size, processes to automate, and needs you describe to us so we can prepare a proposal.
• Conversations with the "Neo" assistant: the content of text and voice messages you exchange with our chatbot, which are stored to provide continuity and improve service. If you provide us with your email or phone number in a conversation, we may recognize you on future visits —even from another device— to greet you by name and pick up where we left off, avoiding asking you for the same information again. You can object to this recognition or request that we forget your data at any time (see section 10).
• Navigation data: IP address, device identifiers, pages visited, and interactions, collected through cookies and similar technologies (see Cookie Policy).
• Technical security and contracting data: to protect the chat, forms and payments against abuse, we compute a fingerprint (hash) of your IP address that does not store the address in clear and is automatically deleted after 48 hours. If you accept a quote online or pay through the website, we store the IP address and browser you use, together with the date and time, as a record of the acceptance (see section 4 of the Terms of Service).

We do not collect special categories of data (health, ideology, etc.). We kindly ask that you do not include this type of information in free text fields.

3. Purposes and legal bases for processing

4. Retention periods

• Data of interested parties (leads) who do not become clients: up to 2 years from the last contact, unless you request their deletion sooner.
• Client data: during the contractual relationship and, thereafter, during the legal tax and commercial limitation periods (generally, up to 6 years). The record of acceptance of a quote (date and time, IP address and browser) is kept for the same period.
• IP address fingerprint used for usage limits: 48 hours, deleted automatically.
• Chatbot conversations: up to 12 months, unless they result in a contractual relationship.
• Responses to the pre-session questionnaire (when the professional uses it to identify contraindications): the content is automatically deleted 90 days after the session. Only a record that the questionnaire existed and was reviewed is retained, without any responses.
• Cookie and analytics data: according to the duration indicated in the Cookie Policy.
• Automatic replies on Instagram and Facebook: activity log 30 days; delivery mark 12 months; connection data until the business disconnects its account (see section 11).

5. Recipients and data processors

We don't sell or transfer your data. To provide the service, we rely on technology providers who act as data processors, with a contract in accordance with Art. 28 GDPR:

Public administrations and bodies may also access the data when there is a legal obligation.

6. International Transfers

Some of the above providers are located in or process data in the US or other countries outside the European Economic Area. Such transfers are made with the appropriate safeguards provided for in the GDPR, mainly adherence to the EU-US Data Privacy Framework and/or the Standard Contractual Clauses approved by the European Commission. You can ask us for information about the safeguards applied.

7. Automated Decisions and Profiling

We use artificial intelligence tools to analyze and internally prioritize the requests we receive (for example, estimating the sector and potential interest) and so that the "Neo" assistant can better assist you. This involves profiling of a commercial nature.

These analyses do not produce legal effects or significantly affect you similarly: they are an internal aid to management, and the final decision is always made by a person. In any case, you have the right to object to this processing and to request human intervention by writing to us at the indicated email address.

You can learn about the systems we use, their purposes, human oversight and our content identification policy on the AI Transparency page.

8. Data Security

We implement appropriate technical and organizational measures to protect your data from unauthorized access, loss, or alteration (encryption in transit, access control, and providers that comply with recognized security standards).

9. Minors

This site and its services are aimed at professionals and businesses. They are not intended for minors under 14 years of age, and we do not knowingly collect their data. If we detect that a minor's data has been provided without authorization, we will proceed with its deletion.

10. Your Rights

You can exercise the following rights at any time:

• Access to your personal data.
• Rectification of inaccurate data.
• Erasure ("right to be forgotten").
• Restriction of processing.
• Objection to processing, including profiling.
• Data portability.
• Withdraw your consent, without affecting the lawfulness of prior processing.

To exercise them, write to 1913torres@gmail.com indicating the right you wish to exercise and attaching a document proving your identity. We will respond within a maximum period of one month.

If you believe that the processing does not comply with regulations, you have the right to file a complaint with the Spanish Data Protection Agency (AEPD), www.aepd.es.

11. Automatic Replies on Instagram and Facebook

NeoWeb agencIA offers businesses that contract its services —and uses on its own accounts— a system that automatically replies to Instagram and Facebook comments and direct messages containing a keyword chosen by the business (for example, «CHECKLIST»), through Meta's official API.

Who is responsible

For NeoWeb agencIA's accounts, NeoWeb agencIA is responsible. For a client business's accounts, the data controller is that business, the account holder; NeoWeb agencIA acts as the data processor (Art. 28 GDPR) and only processes data following its instructions and to provide this service.

What data is processed

• From the business connecting its account: the identifiers and name of its Facebook page and professional Instagram account, and the access token that Meta issues upon connection. The token is stored on our servers (Google Cloud, encrypted at rest) and is never sent to the browser.
• From those who comment or write: the identifier Meta assigns to their account for our application, their username, the text of the comment or message, the post they commented on, and the date.
• From message buttons: only the number of clicks on each button, without identifying who clicked.

For what purpose and on what basis

To detect the keyword, publish the reply to the comment, send the resource the person requested (e.g., a PDF or a link) via private message, avoid sending it more than once, and show the business an activity log. The legal basis is to fulfill the request the person makes by writing the keyword (Art. 6.1.b GDPR) and the legitimate interest of the business in responding to those who address it (Art. 6.1.f GDPR).

If the business activates it, comments that do not match any keyword can be replied to by its artificial intelligence assistant (Google Gemini). These replies are always identified as AI-generated. Before replying, the comment text goes through a security filter that detects attempts to manipulate the assistant (including Google Cloud's Model Armor service, in the European Union); if it detects such attempts, or if the reply contains links unrelated to the business, nothing is published.

This data is not used for advertising, not sold, nor transferred, and private messages are only sent in response to an interaction initiated by the person.

How long is it kept

• Activity log (comment, user, date, and reply sent): 30 days.
• Mark of «this person already received this reply», to avoid repeat sends: 12 months.
• Business token and connection data: until the business disconnects its account; upon disconnection, they are immediately deleted.
• Files uploaded by the business for delivery: until the business replaces them or the service ends.

How to request deletion

We explain how to delete this data, whether you are the business or if you commented or wrote to one of them, on the page Data Deletion.

12. Publishing on TikTok from the business dashboard

Businesses that contract the "Publish to social media" feature can connect their own TikTok account to their NeoWeb agencIA dashboard and publish the videos they upload themselves, using TikTok's official API (Login Kit and Content Posting API).

Who is responsible

The party responsible for the content and its publication is the business that owns the TikTok account. NeoWeb agencIA acts as data processor (Art. 28 GDPR) and only uses access to publish what the business decides to publish.

What TikTok data we process

• Basic account data (permission user.info.basic): account identifier for our application, display name, username, and profile picture, solely to show the business which account it will publish to.
• Account publishing options: the available privacy levels and whether comments, duets, or stitch are disabled, to offer only valid options.
• Access token that TikTok issues upon connection (permission video.publish). It is stored on our servers (Google Cloud, encrypted at rest), never sent to the browser, and only used to publish the videos the business sends from its dashboard.
• The video, text, and options that the business chooses for each publication (who can see it, interactions, commercial content, and AI-generated content tag), and the identifier and status that TikTok returns.

We do not read account videos, followers, messages, or statistics, we do not publish anything without the business clicking "Publish," and we do not use this data for advertising or sell or transfer it. The legal basis is the performance of the contract with the business (Art. 6.1.b GDPR).

How long they are kept and how they are deleted

• Token and account data: until the business clicks "Disconnect" in its dashboard (access is revoked in TikTok and deleted immediately) or the service ends. The business can also withdraw access from the TikTok app itself, in the security settings and authorized applications.
• Record of each publication (text, networks, and result): 180 days.
• Videos uploaded for publishing: until the business replaces them or the service ends.

To request deletion sooner, follow page Data Deletion.

13. Changes to this policy

We may update this Privacy Policy to adapt it to regulatory changes or changes in our services. The current version will always be the one published on this page, with its last update date.