Privacy policy

Version 2026-10-21.1 · Courtesy translation: the Spanish text (Política de privacidad) prevails in case of discrepancy.

1. Data controller

WAKANDA MARKETING SL (tax ID B55286579), Calle Santiago Ramón y Cajal, nº 32, L4, 17190 Salt (Girona), Spain — info@sirioreplai.com.

2. Browsing the website does not collect data by itself

Browsing sirioreplai.com does not require registering or filling in any form. The website only stores in your browser what you allow in the cookie notice, as explained in the cookie policy (the cookies that remember your choice and, if you accept them, for 60 days the channel through which you arrived, to measure results). Those cookies contain no personal data. If you later message us on WhatsApp or subscribe, we keep that channel information together with your contact or subscription, for the same purpose of measuring which channels work, on the basis of our legitimate interest (Art. 6(1)(f) GDPR). We only process personal data when you write to us or subscribe to the service. When you go to the payment page of our payment provider, that is a different site, with its own policy.

3. What data we process and why

a) If you write to us on WhatsApp

The buttons on this website open a WhatsApp conversation with us. If you start it, we process your phone number, the name on your WhatsApp profile and the content of the messages you send, including attachments. If you send us a voice note, it is transcribed to text by an artificial intelligence service so the assistant can answer you.

Purpose: to answer your inquiry, inform you about the service and, if you are interested, prepare a quote.
Legal basis: performance of a contract or pre-contractual steps you request by writing to us (Article 6.1.b GDPR).
An automated assistant answers you. Conversations are read and answered by an artificial intelligence system, which identifies itself as such at the start of the conversation. When a question gets complicated, or if you ask, the conversation passes to a person on our team. The assistant does not make automated decisions with legal effects on you and does not profile you: it answers questions and, when you show interest in subscribing, collects your name and what you need so we can contact you.
Please do not send us sensitive data through this channel. No health data, no detailed legal situation, no ID numbers, no bank or card details. The assistant is configured not to ask for them and not to repeat them if it receives them.

b) If you write to us by email

We process your email address and the content of your message, with the same purpose and legal basis as above.

c) If you subscribe to the service on the website

We process the data you give when subscribing and in the onboarding form that follows: email address, business name, legal name, tax ID, address, contact person and phone, hours, services, frequently asked questions and the people to notify; the billing country and the card country reported by the payment provider; and, as proof that you accepted the documents before paying, the date and time, your IP address, your browser and the version of each document accepted. We do not receive or store your card details: the payment provider handles them.

Purpose: to perform the contract (onboarding, billing, support and cancellation), to check the correct tax region for the price, and to keep proof of acceptance.
Legal basis: performance of the contract (Article 6.1.b GDPR), compliance with tax and commercial obligations (6.1.c) and our legitimate interest in being able to prove the subscription and prevent fraud (6.1.f).
Retention: for the duration of the contract and, afterwards, the legal retention periods (invoices) and limitation periods for possible claims.

d) Commercial communications to businesses

If you are a professional or a business that may be interested in the service, we may email you to introduce Sirio Replai. We process your name, your business email and your business name.

Purpose: to inform you about the service and handle your replies.
Legal basis: our legitimate interest in promoting the service among businesses (Article 6.1.f GDPR) or, where appropriate, your consent (6.1.a). These messages are clearly identifiable as commercial, identify us as the sender (Art. 20 LSSI-CE) and carry a clear unsubscribe link: if you unsubscribe or object, we keep only the minimum needed to avoid writing to you again.

e) Server technical logs

Our server keeps access logs (IP address, date and time, page requested, browser) for a short period, to keep the site secure and diagnose faults. Legal basis: legitimate interest in the security of the service (Article 6.1.f GDPR).

4. Who we share your data with

We do not sell or transfer your data to third parties. To provide the service, providers act as processors on our behalf:

Artificial intelligence providers (United States), which process message content to generate the reply and, where applicable, transcribe voice notes. The international transfer relies on Chapter V GDPR safeguards (standard contractual clauses).
Conversation management provider, to organise service and hand-over to a team member, hosted on our own systems.
Hosting provider for the website and the service's systems, within the European Union or with equivalent safeguards.
Email provider, to manage the contact mailbox and send you the service emails (welcome, onboarding and portal links).
Payment provider (a regulated entity, based in the EU and the United States), which charges the subscription, issues receipts and gives you access to the customer portal. It is responsible for your card details and for the payment and anti-fraud checks it carries out on its own account, under its own privacy policy.

In addition, the WhatsApp channel is operated by Meta Platforms Ireland Limited. When you write to us on WhatsApp, message transport is also governed by WhatsApp's terms and privacy policy, which you accepted with that application and over which we have no control. If you prefer not to use that channel, you can email us.

5. International transfers

We only transfer data to a country outside the European Economic Area when the conditions of Chapter V GDPR (Arts. 44 to 49) are met: an adequacy decision or appropriate safeguards such as standard contractual clauses. Today, the only transfers are those to artificial intelligence providers and, where applicable, payment providers in the United States.

6. How long we keep your data

Conversations and contact details are kept for the duration of the business relationship or interest in the service and, afterwards, for the limitation periods required by applicable law to handle possible claims. Server technical logs are kept for a short period. If you have become a customer, invoices are kept for the period required by commercial and tax law: a legal obligation that Article 17.3.b GDPR places above the right to erasure.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability (Arts. 15 to 22 GDPR) by writing to info@sirioreplai.com. You can also withdraw at any time any consent you have given, without affecting the lawfulness of earlier processing, and lodge a complaint with the Spanish Data Protection Agency (aepd.es) or your local supervisory authority if you think we have not handled your request properly.

8. If you are in the United States

If you live in California, we also recognise the following rights, although it is not certain that the law grants them against us (it depends on revenue and data-volume thresholds):

To know which categories and specific pieces of personal information we have collected, their sources, the purpose and the categories of third parties they are shared with (Cal. Civ. Code § 1798.100).
To ask us to delete your personal information, subject to legal exceptions (§ 1798.105).
To direct us not to sell or share your personal information (§ 1798.120). We do not sell personal information.

You can exercise them by writing to info@sirioreplai.com. To recipients in the United States we only send service emails or business-to-business commercial messages, without false or misleading header information and with a clear unsubscribe link (CAN-SPAM Act, 15 U.S.C. § 7704). We describe accurately how we process data (Section 5 of the Federal Trade Commission Act).

9. Conversations of Sirio Replai's customers

The above refers to the data of people who contact us. It should be distinguished from another situation: when a business subscribes to the service, the people who write to its WhatsApp are giving their data to that business, which is the controller. WAKANDA MARKETING SL then acts as processor, processing that data only on the business's instructions and under the processing agreement signed with it, with each customer's data segregated from the rest. If you wrote to a business's WhatsApp and want to exercise your rights, you should contact that business, which decides on your data; if you write to us, we will pass it on.

The data processed in that role are the phone number, profile name, messages and files, voice notes (and their transcription to text) and the contact details the person provides. They are kept for the duration of the business's contract; at the end, the business can export them in a structured, machine-readable format and we then delete them within the periods set in the processing agreement. The sub-processors are, by category: artificial intelligence provider (United States), hosting (EU or with equivalent safeguards), email, encrypted backups and voice-note transcription. The WhatsApp channel is operated by Meta Platforms Ireland Limited, which is not our sub-processor.

10. Minors

This service is aimed at businesses and professionals, not minors. We do not knowingly collect data from minors.

11. Changes to this policy

If we change how we process data, we will update this policy and its date.

12. More information

See also our legal notice and the terms of use.