Legal
Privacy Policy
What data we process, why, on what legal basis, how long we keep it, and how to exercise your rights.
1. Controller
- Controller: MFDT S.L.
- Tax ID (NIF): B93982668
- Address: C/ Arturo Soria 316, 28033, Madrid, Madrid
- Email: [email protected]
- Data protection officer: [email protected]
2. Two different roles, and it is worth not confusing them
Booklift processes personal data in two different capacities, and which rights you can exercise — and against whom — depends on which one applies:
- As controller, for the data of its own customers and of those who visit the website, register or purchase the service. That is what this policy governs.
- As processor, for the data of the end customers of the business that hires Booklift: the people who write to or call the business and whose appointments are managed. In that case the controller is the contracting business, and the relationship is governed by the Data Processing Agreement.
If you have spoken to a Booklift agent when contacting a business, the controller of your data is that business, not Booklift. You may still send your request to Booklift and we will pass it on to the controller without delay.
3. Data we process and why
| Purpose | Data processed | Legal basis | Retention |
|---|---|---|---|
| Managing sign-up and the customer account | Name, email, hashed password, business details | Performance of the contract (art. 6(1)(b) GDPR) | For the duration of the relationship and 6 years thereafter for accounting obligations |
| Providing the contracted service | Agent configuration, the business’s services and prices, credentials for the channels and calendar | Performance of the contract (art. 6(1)(b) GDPR) | For the duration of the relationship |
| Invoicing and tax compliance | Tax details, VAT number, address, amounts, payment method | Legal obligation (art. 6(1)(c) GDPR) | 6 years (art. 30 Spanish Commercial Code) and the applicable tax periods |
| Guided free trial | Email address and verification code | Consent and pre-contractual steps (art. 6(1)(a) and 6(1)(b) GDPR) | Up to 3 months from the trial |
| Handling enquiries and support | Contact details and content of the enquiry | Legitimate interest in answering those who ask (art. 6(1)(f) GDPR) | 2 years from the last communication |
| Commercial communications about the service | Email address | Legitimate interest for existing customers (art. 21(2) LSSI) or consent otherwise (art. 6(1)(a) GDPR) | Until unsubscribe is requested |
| Security, access logging and fraud prevention | IP addresses, timestamps, session identifiers | Legitimate interest in the security of the service (art. 6(1)(f) GDPR) | 12 months |
| Website usage analytics | Cookie identifiers, pages visited | Consent (art. 6(1)(a) GDPR) | As set out in the Cookie Policy |
No automated decisions are taken that produce legal effects on individuals or similarly significantly affect them. The agent drafts replies and proposes calendar slots, but does not automatically decide on rights, contracts or financial terms.
3a. Data we obtain from Meta (WhatsApp, Instagram and Messenger)
When a business connects its channels from the dashboard, Booklift accesses its Meta accounts only with the permissions the business itself grants in Meta's official dialog, and only to reply to the messages its customers send and to manage their appointments.
| Channel | Data we obtain | Purpose |
|---|---|---|
| WhatsApp Business | WhatsApp Business account and phone number identifiers, phone number, display name, number quality, message templates and access token | Receive and reply to the business's messages, register its number on the platform, complete its business profile and manage its templates |
| Professional account identifier, username, profile picture and access token | Show in the dashboard which account is connected, and read and reply to its direct messages | |
| Messenger | List of Facebook Pages managed by the person connecting (only so they can pick one), identifier, name and picture of the chosen Page, identifier of the person who connected it and Page token | Connect the chosen Page, subscribe it to messages and reply to those it receives on Messenger |
- We do not publish content, read comments or insights, or access any Page or account other than the one the business chooses.
- Access tokens are stored encrypted (AES-256-GCM), separated per business, and are never displayed or written to activity logs.
- We do not sell this data or use it for advertising, commercial profiling or model training.
- It is kept while the channel is connected. Disconnecting it from the dashboard deletes it immediately.
To have the data from your Meta accounts deleted you can: disconnect the channel from the dashboard (Channels), remove Booklift in Facebook (Settings › Apps and websites) or in Instagram (Settings › App permissions), or write to [email protected]. When you remove the app, Meta notifies us and we automatically delete the permissions, identifiers, username and picture of those accounts. You can check the status of your request at https://bookliftagent.com/privacidad/eliminar-datos.
4. Source of the data
The data comes from the individual concerned, when registering, purchasing, writing or calling. For data processed on behalf of a controller, it comes from the contracting business and from the conversations its customers hold with the agent.
5. Recipients
Data is not disclosed to third parties except where legally required. It is accessed by the providers that render services to Booklift, acting as processors or sub-processors under a contract signed in accordance with article 28 GDPR:
| Provider | Service provided | Location | Safeguard for international transfers |
|---|---|---|---|
| Oracle Cloud Infrastructure | Hosting and server infrastructure | European Union | Standard contractual clauses for support outside the EEA |
| Google Ireland Ltd. | Google Calendar and OAuth authentication of the calendar owner | European Union / USA | EU-US Data Privacy Framework and standard contractual clauses |
| Meta Platforms Ireland Ltd. | WhatsApp Business, Instagram Direct and Messenger channels | European Union / USA | EU-US Data Privacy Framework and standard contractual clauses |
| Retell AI, Inc. | Conversational telephony: speech transcription and synthesis | USA | Standard contractual clauses |
| OpenAI Ireland Ltd. | Language models that draft the agent’s replies | European Union / USA | EU-US Data Privacy Framework and standard contractual clauses |
| Stripe Payments Europe, Ltd. | Payment gateway for subscriptions: card and SEPA Direct Debit | Ireland / USA | EU-US Data Privacy Framework and standard contractual clauses |
| European Commission (VIES) | Verification of the intra-EU VAT number to determine the applicable VAT | European Union | Not applicable: processing within the EEA |
In addition, data may be disclosed to public authorities, law enforcement bodies and courts where there is a legal obligation, and to financial institutions in order to collect payment for the service.
6. International transfers
Some providers are established outside the European Economic Area or may access the data from there. In those cases the transfer relies on an adequacy decision of the European Commission, on the EU-US Data Privacy Framework or on standard contractual clauses, together with any supplementary measures required. You may request a copy of the safeguards by writing to [email protected].
7. Artificial intelligence, transcripts and automated decisions
The agent’s replies are drafted by language models from the providers listed in the recipients section. In accordance with article 50 of Regulation (EU) 2024/1689, the agent identifies itself as an artificial intelligence system at the start of every text conversation and at the beginning of every voice call. That notice cannot be switched off.
Voice calls are transcribed to text in order to manage the appointment and keep a record of what was agreed. Unless the business expressly enables voicemail, the call audio is not retained: only the transcript.
Booklift does not use conversations or end-customer data to train its own models or those of third parties. Model providers are engaged under their enterprise terms, which exclude the use of submitted data for training their models.
The agent does not take automated decisions producing legal effects on individuals or similarly significantly affecting them within the meaning of article 22 GDPR. It handles appointments and commercial enquiries, and the business can step into the conversation, correct the agent or take over personally at any time.
Anyone conversing with the agent may ask to be attended by a person from the business, and may exercise their rights as set out in the following section.
8. Your rights
You may at any time exercise the rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent given, without affecting the lawfulness of processing carried out beforehand.
To exercise them, write to [email protected] stating the right you wish to exercise and attaching a copy of a document proving your identity. We will reply within one month, extendable by a further two months if the request is complex.
If you believe the processing does not comply with the applicable rules, you may lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid; www.aepd.es), without prejudice to contacting us first.
9. Security
Booklift applies technical and organisational measures appropriate to the risk, including: encryption in transit using TLS, encryption at rest of channel credentials (AES-256-GCM), per-business data isolation in the database, password hashing using key derivation functions, role-based access control, access logging, regular backups, separation of environments and periodic review of providers.
In the event of a personal data breach posing a risk to the rights and freedoms of individuals, the supervisory authority will be notified within 72 hours and, where the risk is high, the affected data subjects will be informed.
10. Minors
The service is aimed at businesses and professionals. It is not directed at children under fourteen and their data is not knowingly collected. If you become aware that a minor has provided data, please tell us at [email protected] and it will be deleted.
11. Changes to this policy
This policy may be updated to reflect changes in legislation or in the service. Material changes will be notified to customers by email with reasonable notice.
Last updated: 23 de septiembre de 2026.
This is a translation provided for convenience. The Spanish version of this document is the binding one; in the event of any discrepancy, the Spanish text prevails.