Legal
Privacy policy
Last updated: October 9, 2026
This is an informative translation. In case of any discrepancy, the Spanish version of this document is the one that applies.
This explains what we do with your data, in compliance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR).
Who processes your data
- Controller: Hortalezaclub2024, S.L. (trading name: Zunox).
- Tax ID (NIF): B55379317.
- Registered office: calle Agustín Calvo 47, 28043 Madrid (Spain).
- Data protection contact: hola@zunox.es.
What we collect, what for, and on what legal basis
We only process what you give us yourself, through the demo request form or by writing to us by email.
| Data | What for | Legal basis (art. 6 GDPR) |
|---|---|---|
| Name and email | Replying to your request | Pre-contractual steps, art. 6(1)(b) |
| Box name, city, number of members | Preparing the demo with your context | Pre-contractual steps, art. 6(1)(b) |
| Phone, if you give it | Contacting you the way you prefer | Consent, art. 6(1)(a) |
| Your message | Understanding what you need | Pre-contractual steps, art. 6(1)(b) |
We do not profile you and we take no automated decisions with legal effects on you. We do not send you marketing you have not asked for. We do not share or sell your data to anyone.
How long we keep it
For as long as the commercial relationship lasts and, afterwards, for as long as needed to deal with any legal liabilities. If you ask us to delete it and no legal obligation prevents it, we delete it.
Where it is stored and who touches it
We use these providers. All of them act as processors under the contract required by article 28 GDPR, and only process the data to provide their service to us.
| Provider | What for | Where |
|---|---|---|
| Supabase | Database | Germany (EU) |
| n8n | Automations | Germany (EU) |
| Vercel | Hosting the website and onboarding files | United States |
| Resend | Sending emails | United States |
| Google (Gmail) | Email with clients and with whoever writes to us | United States |
| Meta Platforms (WhatsApp) | Sending and receiving WhatsApp messages | EU and United States |
| Anthropic | The assistant's artificial intelligence model | United States |
| OpenAI | The assistant's artificial intelligence model | United States |
US providers receive data under the EU-US Data Privacy Framework where they are certified under it and, in any case, under the standard contractual clauses approved by the European Commission, which form part of their contract. Anthropic and OpenAI do not use the data they receive through their API to train their models.
If we change providers, we update this list before doing so.
If you connect your WhatsApp to Zunox
When a box connects its WhatsApp number to Zunox through Meta, we receive from Meta what is needed to serve that number: the WhatsApp Business account ID, the phone number and its display name, the business name and an access credential. From then on, the messages the number sends and receives go through Zunox, including, if the box keeps using the WhatsApp Business app on its phone, the history Meta syncs when it connects.
We use it only so that the box's assistant can reply and to show the box its conversations in its dashboard. We do not use it for advertising, we do not sell it and we give it to no one other than the providers in the table above.
The box can disconnect Zunox at any time from its business portfolio settings in Meta, or by asking us by email.
How to delete your data
Write to hola@zunox.es from the email address, or stating the phone number, that the data relates to, with the subject «Delete my data».
- If you are a Zunox client or asked us for a demo, we delete your data, your account data and, if you connected WhatsApp, the access credential and the data received from Meta. We confirm the deletion within one month at the latest.
- If you are a member of a box or wrote to it on WhatsApp, the box is the controller of your data. We pass your request on to the box the same working day and delete whatever it instructs. You can also ask the box directly.
We only keep, blocked, what a law obliges us to retain (for example, invoices) and for the period that law sets.
Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw any consent you have given, by writing to hola@zunox.es. We will reply within one month.
If you believe we have not handled your request properly, you may complain to the Agencia Española de Protección de Datos (aepd.es), the Spanish supervisory authority.
The data of our clients' members
When a box hires Zunox, the controller of its members' data is still the box; we act as a processor. The contract every box signs includes the article 28 GDPR terms.
Whoever writes to the box on WhatsApp talks to an artificial intelligence assistant, which introduces itself as such and hands the conversation to a person at the box when needed.
That data is used to serve their members and to fine-tune their own assistant. It does not feed general artificial intelligence models and is not shared with other clients.