This Privacy Policy explains how Acastia ("we", "us") collects, uses and protects personal data: on our website acastia.com, in our platform, in our live demos and on our booking page, and when our AI agents answer calls and chats for the businesses that use them (together, the "Service").
We comply with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the Spanish Data Protection Act (Ley Orgánica 3/2018, LOPDGDD) and the ePrivacy rules as implemented in Spain. Where we receive data from Google APIs, we also comply with the Google API Services User Data Policy, including its Limited Use requirements (section 8).
1. Who we are
For the personal data described in section 3, Acastia is the data controller.
- Company: Acastia
- NIE: Y4337691C
- Address: Calle Aulaga 2, 29639 Benalmadena, Spain
- Privacy contact: privacy@acastia.com
Note: Acastia is currently registered in Spain. We plan to move the company to Denmark. When we do, this policy will name the Danish company, its address and its supervisory authority. Your protection under the GDPR does not change with the move.
Our supervisory authority is the Spanish Data Protection Agency, AEPD (aepd.es). You may lodge a complaint with the AEPD or with the supervisory authority of the country where you live or work.
2. Our two roles
- We are the controller of personal data about our customers and the people who use their accounts, visitors to our website, people who try our live demos, book a call with us or write to us (section 3).
- We are a processor when our customers' AI agents answer and make calls, chat with visitors to the customer's website, book appointments and send messages. The customer decides what its agents do and is the controller of the personal data of the people they deal with. We process that data only on the customer's instructions (section 4).
If you spoke or chatted with an AI agent on behalf of a business, please contact that business about your data. If you can't reach it, write to us at privacy@acastia.com and we will pass your request on.
3. Data we collect as controller
3.1 When you visit our website
- Our servers log your IP address, browser and device details, the pages you request and when, to deliver the website and keep it secure.
- We use the cookies that are necessary for the website to work. Statistics and marketing cookies are used only with your consent (section 11).
3.2 When you write to us
The contact form sends your name, email address, company, phone number (if you give it), topic and message to our mailbox as an email. The website does not store them. Emails you send us are kept in our mailbox. We use them to answer you.
3.3 When you book a call
On our booking page you give us your name, company, email address, phone number, website and, if you like, a message, and you choose a time and whether to meet by video or phone. We keep the booking with your time zone and language, put the meeting in our Google Calendar (with a Google Meet link for a video call), and send you a confirmation by email and SMS and a reminder by SMS before the call. You can cancel through the link in the confirmation.
3.4 When you try a live demo
- The call demo: you give us your name, phone number and company website. We read the public pages of the website to build a demo agent for your business, and the agent calls you. We keep the transcript of the call, its length and outcome, and your email address if you give it to us after the call. We never use an email address we find on your website.
- The chat demo: you give us your name, company website and email address. We read the website to build a preview of a chat assistant and email you the link. We keep the messages exchanged with the preview.
We use these details to give you the demo and to follow up about it, by phone or email (section 5): you become one of the businesses we are in touch with. Every email we send you about the demo has a link to say no to more. What the demo itself made (the website we read, the calls and their transcripts, the chat preview and its messages) is deleted automatically 60 days after you last used the demo (section 9). To protect the demos from abuse, we check which country a request comes from (section 6) and limit how often they can be used.
3.5 When you are a customer
- Account details: name, email address, phone number, password (stored only as a one-way hash), company details, role and language.
- Billing: billing address, VAT number and invoices. Payments are handled by Stripe; we never see or store card numbers.
- Security: sign-ins, two-factor authentication and trusted devices, and the country a sign-in comes from, to protect your account.
- Agreements: when you accepted our terms and policies.
- Support: your messages to us, and what you tell us when we set up and manage your agents.
- Connections you set up: access to your Google Calendar, the login details of a mailbox you connect, and your phone provider's details, all stored encrypted.
3.6 Where the data comes from, and what you have to give us
Most of the data comes from you. We also receive the public pages of your company's website, which we read when you try a demo or when we set up your agents; the status of your payments, from Stripe; and, if you sign in with Google, your name, email address and profile picture, from Google.
You don't have to give us personal data. Without it, though, we can't create your account, hold the call you booked or give you the demo you asked for.
4. Data we process for our customers
When a customer's AI agents handle calls, chats and bookings, we process on the customer's behalf:
- the names, phone numbers and other contact details of the people the agents speak or chat with, including people in contact lists the customer provides;
- the audio of calls while the call takes place: we do not record calls;
- transcripts and summaries of calls, chat messages, and the details the agent notes, such as the reason for a call;
- appointments, and the SMS messages and emails the agents send;
- emails in a mailbox the customer connects, and the customer's knowledge base.
We process this data only on the customer's documented instructions and only to provide the Service to that customer. We do not use it for our own purposes, we never sell it, and we do not use it to train AI models; we have also opted out of our providers using it to train theirs. The customer is responsible for the lawfulness of the processing, including telling people about it and obtaining any consent needed. Our Data Processing Agreement, which meets Article 28 GDPR, applies to every customer.
5. Why we use personal data, and our legal basis
| Purpose | Legal basis |
|---|---|
| Providing the Service to our customers and managing their accounts. | Contract (Art. 6(1)(b) GDPR). |
| Billing, accounting and tax. | Contract and legal obligation (Art. 6(1)(b) and (c)). |
| Answering your messages, holding the call you booked (including its confirmation and reminder) and giving you the demo you asked for. | Steps you asked us to take (Art. 6(1)(b)). |
| Following up about the demo you tried. | The chat demo: your consent, given in its form (Art. 6(1)(a)). The call demo: our legitimate interest in following up a demo you asked for, as its form says (Art. 6(1)(f)). Either way you can say no at any time, with the link in our emails about the demo (section 10). |
| Keeping in touch after a call with us about working together. | Our legitimate interest in following up with businesses that contacted us (Art. 6(1)(f)). You can object at any time. |
| Keeping the website, demos and platform secure, and preventing abuse. | Our legitimate interest in a secure service (Art. 6(1)(f)). |
| Improving the Service with statistics that identify no one. | Our legitimate interest (Art. 6(1)(f)). |
| Statistics and marketing cookies, and measuring our ads. | Your consent (Art. 6(1)(a) GDPR and the ePrivacy rules). |
| Processing personal data for our customers (section 4). | The customer's legal basis, as controller. |
6. Who receives personal data
We do not sell personal data. We use the service providers below to run the Service. They process personal data only on our instructions, under data processing terms. The same providers, apart from Stripe, Google, Meta and ip-api.com, process the data of section 4 for our customers: they are the sub-processors in Annex IV of our Data Processing Agreement.
| Provider | What it does for us | Where the data is processed |
|---|---|---|
| Hetzner Online GmbH, Germany | Servers for the website, the platform, the database and the agents' voice processing. | Germany |
| The Constant Company, LLC (Vultr), USA | Storage of our backups. | Netherlands |
| LiveKit Incorporated, USA | Real-time audio for calls, and detecting when a caller has finished speaking. | Its global network, including the USA |
| Telnyx LLC, USA | Phone numbers and the connection to the phone network. | USA and EU |
| Deepgram, Inc., USA | Speech-to-text. | USA |
| Groq UK Limited, United Kingdom | Language models for the agents' conversations, call summaries, and reading websites for the demos. | USA |
| OpenAI Ireland Ltd, Ireland | Language models for chat, search in knowledge bases, and a back-up voice. | USA |
| Eleven Labs Inc., USA; Cartesia AI, Inc., USA; Theai, Inc. (Inworld AI), USA | The agents' voices (text-to-speech). | USA |
| One.com Group AB, Sweden | Our email. | Denmark |
| Xtreme Internet Solutions B.V. (Smstools), Belgium | SMS messages. | EU |
| Stripe Payments Europe, Limited, Ireland | Payments and invoices. | EU and USA |
| Google Ireland Limited, Ireland | Sign in with Google, our booking calendar and Google Meet, the Google Calendar connection customers choose, and, with your consent, Google Analytics and Google Tag Manager. | EU and USA |
| Meta Platforms Ireland Limited, Ireland | With your consent, measuring our ads. | EU and USA |
| Artia International S.R.L. (ip-api.com), Romania | Finding the country of an IP address, to protect the demos and sign-ins from abuse. | EU |
We may also share personal data with our professional advisers under a duty of confidentiality, and with public authorities where the law requires it.
7. Transfers outside the EEA
Some of our providers process personal data outside the European Economic Area, mainly in the United States. Each transfer is protected by one of the following:
- an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for certified recipients, such as LiveKit, Telnyx, ElevenLabs and Vultr, and the decision for the United Kingdom;
- the European Commission's standard contractual clauses, for example with Deepgram, Groq, OpenAI, Cartesia and Inworld.
You can ask for a copy of the safeguards at privacy@acastia.com.
8. Google user data
Connecting a Google account is optional; you can use Acastia without it. When you connect one, our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
8.1 What we access
- Sign in with Google: your name, email address and profile picture (the
emailandprofilescopes), used only to create your Acastia account and sign you in. - Google Calendar, only if you connect it: the
calendarscope. Your agents use it to find free times and book appointments, and we show your events in your Acastia calendar. Events you or your agents create, change or delete in Acastia are updated in your Google Calendar.
8.2 How we use Google user data
- We copy the events of the calendar you connect (title, description, times and attendees' email addresses) to Acastia, so your agents can check your availability and you can see your bookings in the dashboard. We use them for nothing else.
- We never use Google user data to develop, improve or train generalised or non-personalised artificial intelligence or machine learning models.
- We never sell Google user data, or transfer or share it with third parties for advertising or any other purpose than providing the features above.
- We never let people read your Google user data, except with your permission, to investigate abuse or a security incident, to comply with the law, or when the data has been aggregated and anonymised.
8.3 Storage and deletion
Google access tokens are stored encrypted. Copies of calendar events are kept while your calendar is connected. You can disconnect it at any time in the dashboard, which ends our access. To have the copies already stored deleted, email privacy@acastia.com. You can also revoke Acastia's access in your Google Account at myaccount.google.com/permissions.
9. How long we keep personal data
| Data | How long |
|---|---|
| Customer accounts | While you are a customer. After the agreement ends, deleted or anonymised within 60 days, except what the law requires us to keep. |
| Invoices and accounting records | 6 years (Spanish Commercial Code, Código de Comercio, Art. 30). |
| What a demo made: the website we read, the demo calls and their transcripts, the chat preview and its messages | Deleted automatically 60 days after you last used the demo. |
| Messages to us, bookings, and your name and contact details as someone we are in touch with | As long as we are in touch about working together. You can ask us to delete them at any time. |
| Data we process for customers | As the customer instructs; deleted when the agreement ends. Call audio is never stored. |
| Server logs | Deleted automatically, normally after 14 days. |
| Sign-in and security records | As long as the account exists. |
| Backups | Up to 30 days. |
| Your cookie choice | 12 months, in your browser. |
| Requests not to be contacted | Kept on a suppression list for as long as needed to respect them. |
10. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- rectification of inaccurate or incomplete data;
- erasure, unless the law requires us to keep the data;
- restriction of processing while a disagreement is resolved;
- data portability: your data in a structured, machine-readable format;
- object to processing based on our legitimate interest, and to direct marketing at any time;
- withdraw your consent at any time, without affecting earlier processing;
- lodge a complaint with the AEPD or your local supervisory authority.
To use your rights, email privacy@acastia.com. We answer within one month, which can be extended by two further months for complex requests. We may need to confirm your identity first.
Not to be contacted again: use the unsubscribe link in our emails about a demo, reply to any email from us, or email privacy@acastia.com with the email address or phone number you used. We stop and put you on our suppression list, so we don't email or call you about our services again.
If an AI agent called you or answered your call on behalf of a business, that business is the controller of your data: please contact it first. Our Call Recording Disclosure explains what is kept.
11. Cookies
Necessary cookies are used without consent, as the ePrivacy rules allow: your session, security against forged requests, your language, two-factor trusted devices and the record of your cookie choice. Statistics and marketing tools are used only after you consent in our cookie banner, and stop when you withdraw consent in the banner's settings:
| Tool | Purpose | Provider |
|---|---|---|
| Google Tag Manager | Loads the tools below, according to your choice. | Google Ireland Limited |
| Google Analytics 4 | Statistics on how the website is used (statistics consent). | Google Ireland Limited |
| Meta Pixel and Conversions API | Measuring our ads (marketing consent). On our demo pages, your visit is also reported to Meta from our server, and when you start the call demo, the name and phone number you entered, in hashed form. Both happen only when you have given marketing consent. | Meta Platforms Ireland Limited |
12. Security
We protect personal data with technical and organisational measures, including:
- servers in Germany and backups in the Netherlands;
- encrypted connections (TLS);
- passwords stored only as one-way hashes, and access tokens and login details stored encrypted;
- a firewall, and server access only from approved addresses with key-based login;
- each customer's data kept separate, with access limited to the people who need it;
- two-factor authentication, available for every account;
- hourly backups.
If a personal data breach is likely to put people at risk, we notify the AEPD within 72 hours and, where the risk is high, the people affected, as Articles 33 and 34 GDPR require. If a breach affects data we process for a customer, we notify the customer without undue delay.
13. AI and automated decisions
Our AI agents are AI systems, not people. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects (Article 22 GDPR). When a business uses our agents, decisions about its relationship with you, such as whether to offer you a service, are made by that business.
14. Children
The Service is not directed at children under 18, and we do not knowingly collect their personal data. If you believe we have, please contact privacy@acastia.com and we will delete it.
15. Changes to this policy
We update this policy when the law, our Service or our providers change. We announce material changes at least 30 days in advance by email or in the dashboard. The date at the top shows the latest version.
16. Contact
Questions about privacy? Email privacy@acastia.com.