Privacy policy.

Last updated: 11 October 2026.

1. Who is responsible for your data?

meiika is responsible for the processing described here. For enquiries, write to hola@meiika.es. For privacy matters and data protection rights, write to privacidad@meiika.es. The contact address appears in the legal notice.

2. What data do we process?

When you contact us, we process the name and optional organisation, email address and message you provide. Required fields are necessary to reply. Please do not include health information, identity documents, passwords or unnecessary personal information about other people.

Our infrastructure may record IP addresses, dates, requested URLs and browser information for operation and security. The form uses a counter based on a derived IP identifier, which expires after ten minutes. Server logs are separate from that counter.

3. Purposes and legal bases

We use project enquiries to respond and take steps at your request before entering into a contract (Article 6(1)(b) GDPR). Other professional enquiries may be processed on the basis of our legitimate interest in answering them (Article 6(1)(f)); you may object. Security and abuse prevention are based on legitimate interest. Requests to exercise rights are processed to meet legal obligations (Article 6(1)(c)). Optional analytics requires your consent (Article 6(1)(a)).

We do not add contact enquiries to an advertising mailing list. We do not make automated decisions with legal or similarly significant effects or create advertising profiles from your enquiry.

4. Optional analytics

Google Analytics is loaded only after you accept analytics. It measures visits, traffic sources, service pages and successful form submissions. Names, email addresses and messages are never sent to Analytics; URL query strings and fragments are excluded. Google states that Google Analytics 4 does not log or store individual IP addresses. Google Signals and advertising personalisation are disabled. Rejecting analytics does not prevent use of the site.

Google Ireland Limited and, where applicable, Google LLC process analytics data. See how Google uses information from partner sites.

5. Recipients and international transfers

Form enquiries are sent to hola@meiika.es through the hosting email service and are not stored in the WordPress database as contact submissions. Mail may be forwarded to Gmail and retained in mailboxes and backups. Raiola Networks and Google provide hosting and email services. Information may be disclosed to authorities when legally required; it is not sold.

Google services may process information outside the European Economic Area. Applicable safeguards may include the EU–US Data Privacy Framework and other contractual safeguards, depending on the service and recipient. See Google’s international transfer frameworks. Contact privacidad@meiika.es for information about the applicable safeguards.

6. Retention

Enquiries are kept while they are being handled and followed up. After that, only information needed to meet legal obligations or establish, exercise or defend claims is retained, with access restricted where required. A contracted project may require further privacy information. Form counters expire after ten minutes; security logs are retained as needed for their purpose and backups follow the provider’s rotation.

Analytics event retention is set to two months without resetting on new activity. Aggregated reports may follow different retention rules. Analytics cookies and the consent choice have a 180-day duration. You can withdraw consent through the cookie preferences in the footer; we will stop new submissions and delete the analytics cookies accessible on this domain. Withdrawal does not affect the lawfulness of processing carried out before it.

7. Your rights

You may request access, rectification, erasure, restriction or portability, where applicable, and object to processing by emailing privacidad@meiika.es or writing to the address in the legal notice. We ask only for the information needed to handle your request; additional identity verification may be requested if there are reasonable doubts. We normally respond within one month, with any lawful extension explained to you. You may complain to the Spanish Data Protection Agency (AEPD).

8. Optional AI assistant

The assistant provides initial guidance and may make mistakes. The AI does not send emails or confirm appointments: the booking button opens a separate flow that checks and books in the real calendar, and it does not make decisions with legal effects. You can use the contact form instead. When you send a chat message, Cloudflare Workers AI processes the text and relevant conversation context. Do not include names, email addresses, confidential information or sensitive data in the chat. Processing supports your enquiry or our legitimate interest in providing guidance, as appropriate. Cloudflare may process information outside the EEA under its data processing agreement and applicable transfer safeguards. According to its Workers AI information, Cloudflare does not use the content to train models without explicit consent. See Cloudflare Workers AI data usage.

The conversation is not saved as a WordPress conversation record or sent to Analytics. It is kept in this browser tab’s session storage to continue across pages and languages and expires after two hours without activity. It is cleared after booking, when you choose to start again or when the tab’s session ends. An idea transferred to the form is stored temporarily in the same tab and is not emailed automatically. The assistant may prepare a short summary from the conversation context; booking names and email addresses are collected separately and are not sent to the AI.

Abuse prevention uses derived IP identifiers that expire after 48 hours and are removed on a subsequent request. Infrastructure providers may maintain their own operational logs.

9. Online meeting reservations

Booking a 30-minute meeting requires your name, email address, meeting date and time, and an available summary of your enquiry. These are used to organise and confirm the meeting, send reminders and handle changes or cancellations on the basis of steps requested before a contract (Article 6(1)(b)); they are not used for advertising.

Cal.com and Google Calendar/Meet provide booking, calendar and video meeting services. Booking data is retained in their calendar and email systems for as long as needed for these purposes. WordPress retains derived identifiers to avoid duplicates and abuse; they expire after 24 hours. To email the booking notice to meiika and retry it if the mail system rejects it, WordPress temporarily stores an encrypted copy of the minimum notice data: name, email, summary, date and meeting link, if available. This copy is removed once the mail system accepts the message. Otherwise it expires after 24 hours and is deleted by the scheduled task or on the next visit. The full conversation is not stored in this queue.

Booking identity information is not sent to AI or Analytics. Cal.com may process information in the United States under applicable contractual safeguards; see Cal.com’s privacy policy. Google’s transfer safeguards are described above. We do not enable meeting recording, AI transcription or lead enrichment through this booking flow.

You may request access, rectification or erasure of your booking data and exercise the rights described in this policy. The confirmation email lets you reschedule or cancel. The integrated booking flow does not embed a Cal.com widget or load its cookies. If you choose to open Cal.com directly, its own privacy and cookie information applies.

10. S.A.R.A. demonstration (voice assistant)

The S.A.R.A. demonstration (agente-voz-citas.vercel.app/sara) is a page that plays back a test call. The recording contains the voice of a member of the meiika team and invented data; no real call from clients or visitors is published.

Listening to the demonstration does not ask for any data, does not use cookies or trackers and is not measured with Google Analytics. The page is served by Vercel Inc., which may process technical connection data (such as the IP address and browser details) to deliver and protect it, including processing outside the European Economic Area. The legal basis is our legitimate interest in serving and protecting the page (Article 6.1.f GDPR). See Vercel’s privacy policy.

The demonstration does not take calls from the public: it has no telephone number and does not use your microphone.

If S.A.R.A. is deployed for a business, that business is the data controller and meiika acts as a processor, under its own contract and with its own privacy information for callers. Those processing activities are not covered by this policy, which describes only those of https://meiika.es and the demonstration.

11. Cookies and updates

See our cookie policy for browser storage and consent controls. We update this policy when processing changes and indicate the revision date.