Privacy

Last updated October 23, 2026

Who we are

Aira is an AI agent that businesses add to their website to answer visitors, capture leads and book meetings. Aira is a trade name of Daniel Alexandru Savin Butucaru, a sole trader (autónomo) registered in Spain, tax ID (NIF) 79248725V, with address at Avenida de Ronda 10B, 29380 Cortes de la Frontera, Málaga, Spain ("Aira", "we", "us").

This policy covers our website itsaira.com, the Aira chat that runs on itsaira.com and on our clients' websites, and the client portal at app.itsaira.com. For any privacy question, write to [email protected].

Our role for each kind of data

When you chat with Aira on a client's website, that business decides why and how the conversation is used. It is the controller of that data and we process it on its behalf, as its service provider. Its own privacy policy applies, and requests about that data are best sent to the business. If you write to us instead, we will pass your request on and help them answer it.

When you visit itsaira.com, chat with Aira on itsaira.com, or use the client portal, we decide how the data is used, and we are the controller.

What we collect

Chat conversations

The messages you write and Aira's replies.
The page where the chat was opened (address and title), the page you came from, your browser type and your language.
A random identifier stored in your browser so Aira can recognize you if you come back. It is not linked to your identity unless you share your details.
Contact details you choose to give, such as your name, email, phone number or website.
Meetings you book, in the chat or on a business's booking page: the time you chose, the appointment type, your time zone and the details you gave for the booking.

Your IP address is used only in a one-way hashed form to prevent abuse and rate-limit requests. We do not store it with your conversation.

Client and portal users

Name and email address of the business owner and the teammates they invite.
Sign-in activity: single-use sign-in links sent by email and the session that keeps you signed in.
What the business gives Aira to learn from: the pages of its website, documents it uploads and notes it writes.
Settings: alert contacts, opening hours, brand color, tone of voice and calendar preferences.

Website visitors

Our network provider processes standard technical data, such as IP addresses, to deliver the site and protect it from attacks. If you accept analytics in the cookie banner, we also collect how you use itsaira.com: pages viewed, clicks, scrolling, approximate location and device type, through Google Analytics and Microsoft Clarity. Clarity can make anonymous recordings of how the page is used; text you type in forms is masked, and the Aira chat window is not recorded. With the same consent, the Meta Pixel tells Meta that a visit came from one of our ads and whether you started a conversation with Aira, left your details or booked a call, so we can measure and improve those ads. It does not send what you write in the chat. If you decline, none of this is loaded.

Businesses we contact by email

Aira writes to businesses that could use it. When we write to yours, we are the controller of the data below.

What we use: the business's name, the email address and phone number published on its website or its Google Maps listing, the public text of its website, public reviews of the business, and the emails you exchange with us.
What for: to tell you about Aira, to prepare a demo of Aira that knows your website if you ask for one, and to answer your replies.
How the emails are written: our AI model provider drafts them from that public information, and a person approves each email before it is sent.
Legal basis in the European Economic Area and the United Kingdom: our legitimate interest in offering our service to businesses. We write only to business addresses, send a short sequence of emails and stop as soon as you ask.
How long: while we are in contact. If you tell us "not now", we may write once more after about three months. If you ask us to stop or to delete your data, we delete it and keep only your address on a do-not-contact list, so that we never write to you again.
Demos: a demo stops working after its offer ends, and we then delete the website content it learned from.

To stop the emails, reply "no". For anything else, write to [email protected].

Google user data

A business can connect its Google Calendar from the client portal so Aira can offer real free times, in the chat and on the business's booking page, and book meetings. When it does, we request only these permissions:

Email address: To show which Google account is connected.
Free/busy: To see when the business is busy, so Aira only offers times that are really free. We do not read the titles, descriptions or attendees of existing events.
Events it owns: To create the meeting a visitor books, add the visitor as a guest and, if the business chooses, add a Google Meet link; and to reschedule or cancel only the meetings Aira itself created, when the visitor or the business asks. We never read, modify or delete any other event.
Calendar list: So the business can choose which of its calendars receives bookings.

Aira's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

In particular:

We use Google data only to provide the booking features the business turned on.
We do not sell it, use it for advertising, or use it to train AI models.
We do not transfer it to anyone except as needed to provide the service, for security, or to comply with the law.
No person at Aira reads it unless the business asks us to for support, it is needed for security, or the law requires it.
The Google access token is stored encrypted.

The business can disconnect Google Calendar at any time from the portal. We then revoke our access and delete the token. Access can also be removed from the Google Account's security settings at myaccount.google.com/permissions.

How we use it

To answer visitors in the chat, in their language, from the business's own content.
To recognize returning visitors and continue the conversation where they left it.
To send the business an alert when someone leaves their details, books a meeting or asks for a person, including through WhatsApp if the business turned that on.
To book meetings and email the visitor a confirmation with the time, the meeting link and private links to reschedule or cancel.
To let the business read its conversations and leads in the portal, and to prepare its monthly report, which contains totals and common topics.
To sign users in, keep the service secure, prevent abuse and fix problems.
If you accept analytics, to understand how people use itsaira.com and improve it.
To comply with the law.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we never use one business's data for another business.

If you are in the European Economic Area or the United Kingdom, the legal bases are:

Performance of a contract, for clients and portal users.
Our legitimate interest in running a secure and useful service.
Your choice to share your details or book a meeting in the chat.
Your consent, for analytics cookies on itsaira.com.

How the AI works with your data

To write each reply, the relevant part of the conversation and of the business's content is sent to our AI provider, which generates the answer and returns it. Aira answers only from the business's content, and when it cannot find the answer it says so.

To find the right part of the business's content, the text of that content and of each question is turned into numerical representations by a second provider.

We do not use conversations to train AI models. Under its commercial terms, our AI model provider does not train its models on data sent through its API.

Service providers

We share data only with the providers we need to run Aira, under contracts that limit them to providing their service:

Anthropic: AI model that writes the replies.
Voyage AI: Search representations of the business's content and of each question.
IONOS: The mailbox we use to write to businesses we contact.
Resend: Sending emails: sign-in links, alerts, booking confirmations and reports.
Cloudflare: Network, secure connection to our servers and protection from attacks.
Our hosting provider: The servers where Aira and its databases run, in the European Union.
Google: Calendar and Google Meet, only if the business connects Google Calendar.
Cal.com: Booking, only if the business uses Cal.com instead of Google Calendar.
WhatsApp: Alerts and live replies from the business, only if the business turns them on.
Google Analytics: Website usage statistics for itsaira.com, only if you accept analytics.
Microsoft Clarity: Heatmaps and anonymous session recordings of itsaira.com, only if you accept analytics.
Meta Platforms: The Meta Pixel, to measure our ads on Facebook and Instagram, only if you accept analytics.

We may also disclose data if the law requires it, or to a buyer or successor if the business of Aira is transferred, under this same policy.

Where data is stored

Aira's servers and databases are located in the European Union. Each business has its own separate database. Some of our providers process data in the United States and other countries. When data leaves the European Economic Area or the United Kingdom, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

How long we keep it

Conversations, and the contact details and bookings linked to them, are deleted automatically after the period the business chooses: between 7 and 365 days, 90 days by default.
Monthly reports keep only totals and common topics, never the text of conversations.
Sign-in links work once and expire after 15 minutes. Portal sessions expire after 30 days.
Client account data is kept while the business uses Aira and deleted after the service ends, except what we must keep by law, such as billing records.

You can also ask us, or the business, to delete your conversation at any time. We delete it together with the details linked to it.

Cookies and local storage

Needed for the service to work (no consent required):

Chat identifier in your browser's local storage, to keep your conversation and recognize you when you come back.
Portal session cookie on app.itsaira.com, to keep you signed in.
Theme and cookie choice on itsaira.com, to remember day or night mode and your answer to the cookie banner.

Only if you accept analytics on itsaira.com:

Google Analytics cookies (such as _ga), to count visits and see which pages and buttons are used. Kept up to 14 months.
Microsoft Clarity cookies (such as _clck and _clsk), for heatmaps and anonymous session recordings. Kept up to 12 months.
Meta Pixel cookies (such as _fbp, and _fbc when you arrive from an ad), to measure our ads. Kept up to 90 days.

We do not use advertising cookies. You can change your mind at any time with Cookie settings at the bottom of every page, or by clearing your browser's site data.

Security

Data travels encrypted.
Each business runs on its own instance with its own database.
Access keys and third-party tokens are stored encrypted.
Portal sign-in uses single-use links, and only a hash of each link is stored.
Access by our team is limited to what is needed to run and support the service.

No system is perfectly secure. If a breach affects your data, we will notify the business, and you or the authorities where the law requires it.

Your rights

Depending on where you live, you may have the right to:

Access your personal data, correct it, delete it or receive a copy.
Object to or restrict how we use it.
Withdraw consent you gave.

Residents of California and other U.S. states have the right to know what we collect and to request deletion or correction. We do not sell or share personal information, and we will not treat you differently for using your rights.

To use any of these rights, write to [email protected]. For conversations on a client's website, we will work with that business to answer. You can also complain to the Spanish Data Protection Agency (aepd.es) or to the data protection authority where you live.

Children

Aira is a service for businesses and is not directed to children under 16. We do not knowingly collect their personal data. If you believe a child has shared data with Aira, contact us and we will delete it.

Changes and contact

If we change this policy, we will publish the new version here with a new date. If the changes are significant, we will also tell our clients by email.

Questions or requests: [email protected]. Daniel Alexandru Savin Butucaru.