Privacy Policy

1. Who We Are

The data controller responsible for your personal data is:

Andera RE S.L.
Madrid, Spain
Email: contact@andera.io
Website: www.andera.io

If you have any questions about this policy or how we handle your data, please contact us at the email address above.

2. What Data We Collect

Data you provide directly

When you complete the contact form on our website, we collect:

• First and last name
• Email address
• Company name (if provided)
• Your message and area of interest

Data collected automatically

When you visit our website, we and our third-party service providers may automatically collect:

• IP address and approximate location (country/city level)
• Browser type, operating system, and device information
• Pages visited, time on site, and navigation behaviour
• Referring website or traffic source
• Professional data inferred from your LinkedIn profile (if you are logged into LinkedIn during your visit)

3. How We Use Your Data

We use your personal data for the following purposes:

• To respond to your enquiry — when you submit our contact form, we use your details to get back to you. Legal basis: legitimate interests / performance of a pre-contractual relationship.
• To manage our business relationships — we store contact and company information in our CRM (HubSpot) to track our professional interactions. Legal basis: legitimate interests.
• To keep a record of our business meetings — we may transcribe Microsoft Teams meetings we organise, and record short voice notes after meetings others organise, to prepare internal summaries. Legal basis: legitimate interests. See section 11.
• To analyse website traffic — we use Google Analytics 4 to understand how visitors use our site, helping us improve content and user experience. Legal basis: consent (via our cookie banner).
• To understand our professional audience — we use the LinkedIn Insight Tag to receive anonymised demographic data about visitors (job title, industry, seniority). Legal basis: consent (via our cookie banner).

4. Third-Party Services

We use the following third-party services that may process your data:

HubSpot (CRM & Form Processing)

Form submissions are stored in HubSpot, a customer relationship management platform. HubSpot is headquartered in the United States and processes data under Standard Contractual Clauses. See HubSpot's Privacy Policy.

Google Analytics 4

We use Google Analytics 4 to collect anonymised usage data about visits to our website. Google may process data in the United States under Standard Contractual Clauses. IP anonymisation is enabled. See Google's Privacy Policy.

LinkedIn Insight Tag

We use LinkedIn's Insight Tag to receive aggregate, anonymised demographic data about our website visitors via LinkedIn's Campaign Manager platform. LinkedIn may process data in the United States. See LinkedIn's Privacy Policy.

CookieYes

We use CookieYes to manage cookie consent on our website. CookieYes records your consent preferences. See CookieYes's Privacy Policy.

Services used for meetings and voice notes

Microsoft (Teams, SharePoint and Azure AI Speech), Anthropic, Supabase, Vercel and GitHub process data for the meeting records described in section 11, where each is listed with what it does and where.

5. How Long We Keep Your Data

• Contact form submissions — retained in our CRM for up to 3 years from last contact, or until you request deletion.
• Analytics data — Google Analytics data is retained for 14 months by default.
• Cookie consent records — retained for 1 year.
• Meeting transcripts and voice-note recordings — deleted 120 days after we receive them. The text of a voice note our team makes after a meeting is kept with the summary.
• Meeting summaries, decisions and agreed follow-ups — up to 3 years from our last contact with you, or until you ask us to delete them.

6. Your Rights

Under GDPR, you have the following rights regarding your personal data:

• Right of access — you can request a copy of the data we hold about you.
• Right to rectification — you can ask us to correct inaccurate data.
• Right to erasure — you can ask us to delete your data ("right to be forgotten").
• Right to restrict processing — you can ask us to limit how we use your data.
• Right to object — you can object to processing based on legitimate interests.
• Right to data portability — you can request your data in a structured, machine-readable format.
• Right to withdraw consent — where processing is based on consent (e.g. cookies), you can withdraw at any time via our cookie settings.

To exercise any of these rights, please contact us at contact@andera.io or privacy@andera.io. We will respond within 30 days. You also have the right to lodge a complaint with the Spanish Data Protection Authority (AEPD) at www.aepd.es.

7. International Transfers

Some of our third-party service providers (HubSpot, Google, LinkedIn, Anthropic and GitHub) are based outside the European Economic Area, primarily in the United States. Where data is transferred outside the EEA, we rely on Standard Contractual Clauses approved by the European Commission to ensure your data is protected to the same standard as within the EU.

8. Cookies

We use cookies and similar tracking technologies on our website. For full details of the cookies we use and how to manage your preferences, please see our Cookie Policy.

9. Changes to This Policy

We may update this Privacy Policy from time to time. The date at the top of this page indicates when it was last revised. We encourage you to review this policy periodically.

10. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at:

Andera RE S.L.
Madrid, Spain
contact@andera.io

11. Meetings and voice notes

What we do. When Andera organises a meeting in Microsoft Teams, we may transcribe it. Our invitations say so in advance, and Teams shows a notice when transcription starts. After a meeting someone else organised, a member of our team may record a short voice note about it. From the transcript or voice note we prepare an internal summary: what was decided, what each side agreed to do, and the next step. We note who attended and link the meeting to them and their company in our internal relationship system.

What we collect.

• Your name and email address as they appear in the meeting invitation.
• What you said in the meeting, as a written transcript, with each speaker's name where Teams provides it.
• For a voice note: our team member's own account of the meeting, which may mention you, your company and what was discussed. We mark it as one person's recollection, not a record.

We do not keep audio or video of Teams meetings.

Why, and on what basis. To keep an accurate record of business conversations and to follow up on what was agreed. Legal basis: our legitimate interests. We have weighed these against your interests: the record is internal, limited to business conversations, announced in advance, kept for a limited time, and you can object at any time.

Who processes it for us.

• Microsoft (Teams and SharePoint), in the European Union, where meetings and voice notes are held.
• Microsoft Azure AI Speech, in the European Union (Sweden), which turns voice notes into text.
• Anthropic, in the United States, which writes the summary. It receives the transcript text and attendees' names, never email addresses, under its data processing addendum with Standard Contractual Clauses, and deletes what it receives within 30 days.
• Supabase (database) and Vercel (application), both in the European Union (Frankfurt).
• GitHub, in the United States, which runs the scheduled job that processes meetings, under Microsoft's data protection addendum with Standard Contractual Clauses.

How long we keep it.

• Meeting transcripts and voice-note recordings: deleted 120 days after we receive them. Teams deletes its own copy of a transcript after 120 days.
• The text of a voice note, which is our team member's own account of a meeting, is kept with the summary.
• Summary, decisions and agreed follow-ups: up to 3 years from our last contact with you, or until you ask us to delete them.
• If you ask us to erase your data, we delete at once the transcripts of meetings you attended.

Your choices. You can object before or during a meeting: tell us and we will stop transcription and delete the transcript. Afterwards, write to privacy@andera.io to object, to see what we hold, or to have it deleted. Your other rights are in section 6.

Reuniones y notas de voz

Qué hacemos. Cuando Andera organiza una reunión en Microsoft Teams, podemos transcribirla. Nuestras convocatorias lo indican de antemano y Teams muestra un aviso cuando empieza la transcripción. Después de una reunión organizada por otra persona, alguien de nuestro equipo puede grabar una breve nota de voz sobre ella. Con la transcripción o la nota de voz preparamos un resumen interno: qué se decidió, qué se comprometió a hacer cada parte y cuál es el siguiente paso. Anotamos quién asistió y vinculamos la reunión a esas personas y a su empresa en nuestro sistema interno de relaciones.

Qué datos tratamos.

• Su nombre y dirección de correo tal como aparecen en la convocatoria.
• Lo que dijo en la reunión, como transcripción escrita, con el nombre de cada interlocutor cuando Teams lo facilita.
• En una nota de voz: el relato de la reunión hecho por alguien de nuestro equipo, que puede mencionarle a usted, a su empresa y lo que se habló. Lo marcamos como el recuerdo de una persona, no como un acta.

No conservamos audio ni vídeo de las reuniones de Teams.

Para qué y con qué base. Para llevar un registro fiel de las conversaciones de negocio y dar seguimiento a lo acordado. Base jurídica: nuestro interés legítimo. Lo hemos ponderado frente a sus intereses: el registro es interno, se limita a conversaciones de negocio, se anuncia de antemano, se conserva por un tiempo limitado y puede oponerse en cualquier momento.

Quién los trata por cuenta nuestra.

• Microsoft (Teams y SharePoint), en la Unión Europea, donde se guardan las reuniones y las notas de voz.
• Microsoft Azure AI Speech, en la Unión Europea (Suecia), que convierte las notas de voz en texto.
• Anthropic, en Estados Unidos, que redacta el resumen. Recibe el texto de la transcripción y los nombres de los asistentes, nunca direcciones de correo, con un acuerdo de tratamiento de datos que incluye cláusulas contractuales tipo, y borra lo que recibe en un plazo de 30 días.
• Supabase (base de datos) y Vercel (aplicación), ambos en la Unión Europea (Fráncfort).
• GitHub, en Estados Unidos, que ejecuta la tarea programada que procesa las reuniones, con el acuerdo de protección de datos de Microsoft, que incluye cláusulas contractuales tipo.

Cuánto tiempo los conservamos.

• Transcripciones de reuniones y grabaciones de notas de voz: se borran 120 días después de recibirlas. Teams borra su propia copia de la transcripción a los 120 días.
• El texto de una nota de voz, que es el relato de la reunión hecho por alguien de nuestro equipo, se conserva junto con el resumen.
• Resumen, decisiones y compromisos de seguimiento: hasta 3 años desde nuestro último contacto con usted, o hasta que nos pida borrarlos.
• Si nos pide suprimir sus datos, borramos de inmediato las transcripciones de las reuniones a las que asistió.

Sus opciones. Puede oponerse antes o durante una reunión: díganoslo y detendremos la transcripción y borraremos el texto. Después, escriba a privacy@andera.io para oponerse, saber qué datos tenemos o pedir que se borren. Sus demás derechos figuran en el apartado 6, y puede presentar una reclamación ante la Agencia Española de Protección de Datos (www.aepd.es).