1. Controller
Jorge Luis Hernandez Vera, an individual (natural person) acting in his own name under the trade name “XIRAN”.
NIE: Z3477917T
Address: Calle Algeciras 3, 2ºC, 28005 Madrid, Spain
Contact and rights email: agents@xiran-ai.com
Identity details are in the Legal Notice. No data-protection officer is appointed: one is not required at this size (GDPR Art. 37 and Spanish LOPDGDD Art. 34). Rights requests go to the email above.
2. Data, purposes, lawful bases and retention
XIRAN designs AI agents for service businesses in Spain, especially clinics and driving schools, and also gyms, spas and tutoring academies. This policy covers people who visit xiran-ai.com, request a demo or use the demo chat. It does not cover patients or students of a client: that is section 8.
| Processing | Data | Purpose | Lawful basis | Retention |
|---|---|---|---|---|
| Contact form and voice-demo lead form | Name, company, email and/or phone, sector, volume, message, any website you enter, and visit source (UTM parameters and referrer, stored for the browser session) | Reply and prepare the demo or proposal | Pre-contractual steps at your request (GDPR Art. 6(1)(b)) | 12 months from the last contact if there is no contract. If you become a client, for the relationship plus legal periods (for example 6 years commercial and 4 years tax) |
| Commercial messages | Name and email | News about XIRAN services | Consent (GDPR Art. 6(1)(a) and Spanish LSSI-CE Art. 21). The box starts unticked | Until you withdraw consent |
| Google Calendar booking | Name, email and the slot you choose in Google’s form | Schedule the call | Pre-contractual steps (Art. 6(1)(b)) | 12 months from the appointment |
| AI demo chat | Messages you type, session id and IP | Run the demo and debug errors | Legitimate interest in showing and improving the service (Art. 6(1)(f)) | 30 days. Do not type real health or personal data: it is a fictional demo |
| Cookieless analytics (Cloudflare Web Analytics) | Aggregated technical visit data (URL, performance, IP handled by Cloudflare) | Measure traffic in aggregate | Legitimate interest (Art. 6(1)(f)) | Aggregated, for Cloudflare Web Analytics’ own period |
| Cookie analytics (Google Analytics 4, ID G-JJ0YS2TB4G) | Cookie id, pages viewed, device, language | Usage statistics | Consent (Art. 6(1)(a) and LSSI-CE Art. 22.2). It does not load if you reject | Cookies up to 2 years. Data in Google Analytics: 14 months |
| Security and site operation | IP address and technical request logs | Serve the page, prevent abuse and keep the service available | Legitimate interest (Art. 6(1)(f)) | For as long as the host (Vercel) and the CDN (Cloudflare) keep those logs |
We have weighed those legitimate interests against your rights. You can object at any time by emailing agents@xiran-ai.com.
You do not have to give us data. Without the fields marked * we cannot handle the request. The marketing box is optional: if you leave it unticked, we use your data only to reply.
We do not make automated decisions that produce legal or similarly significant effects, and we do not build profiles for that purpose. The demo chat generates replies with an AI model. It does not decide contracts, credit or health.
Lead data comes from you. This site does not import leads from public sources.
3. Recipients and processors
We do not sell your data or disclose it to third parties for their own purposes. These providers process it for us:
- Vercel Inc. (United States): site hosting.
- Cloudflare, Inc. (United States): DNS, CDN, security and cookieless analytics.
- Google LLC / Google Ireland Limited: Google Analytics 4, only if you accept cookies, and Google Calendar on the contact page when that acceptance is already in place, or if you choose to load the calendar there or open the booking page.
- n8n automation server at
n8n.wizdom-ai.com: run by Jorge Luis Hernandez Vera on a server rented from Hetzner Online GmbH (Germany, European Union). Hetzner is the hosting provider and the processor for that infrastructure. It receives the forms (/webhook/verus-leadsand/webhook/xiran-lead) and demo-chat messages. That hosting stays in the EU and is not an international transfer. - OpenRouter, Inc. (United States): processor that serves the demo chat with the DeepSeek V4.1 Flash model. OpenRouter receives the message and routes it to the model provider. Its privacy policy (31 August 2026) states that OpenRouter does not use inputs or outputs to train its own models. Its privacy guide states that OpenRouter does not store prompt and response text unless the account turns on private logging or use for product improvement (that page says both are off by default); that it may sample a small number of prompts for anonymous categorisation; and that it does keep request metadata (for example token counts and latency) without that text. OpenRouter’s public provider table, checked on 3 October 2026, lists DeepSeek as headquartered in China, as retaining prompts, and as training on them. That table is what OpenRouter publishes: it is not a direct check of DeepSeek’s own policy or of the account settings used by this demo.
- jsDelivr (CDN): delivers the chat library on pages that show it. It sees IP and user agent, not the form contents.
- The
/demopage also loads cdn.tailwindcss.com and unpkg.com (icons). They see IP and user agent.
Fonts are served from this site. There is no request to Google Fonts.
Further processors may apply when a client buys the product (voice, WhatsApp, model). That list is provided with the processing agreement. It is not yet a page on this site.
4. International transfers
Vercel, Cloudflare and Google are US companies. Where the provider is certified under the EU–US Data Privacy Framework, the transfer relies on that adequacy decision. Otherwise we use the European Commission’s Standard Contractual Clauses (Art. 46(2)(c)) or another Art. 46 safeguard. You can ask about the safeguards at agents@xiran-ai.com. Certification status should be rechecked, because it changes.
The n8n server is hosted by Hetzner Online GmbH in Germany. That hosting stays in the European Union and is not an international transfer.
The demo chat goes through OpenRouter, Inc. (United States), which routes each message to the DeepSeek V4.1 Flash model provider. OpenRouter’s privacy policy says personal data may be transferred to its servers in the United States or to other countries outside the European Economic Area and the United Kingdom, and that it relies on adequacy decisions under GDPR Art. 45 and on standard contractual clauses under Art. 46. That policy does not state a Data Privacy Framework certification. OpenRouter’s provider table lists DeepSeek in China: processing may take place outside the EEA, including in China. We do not state that DeepSeek applies zero retention or refrains from training.
[TO CONFIRM: whether the OpenRouter account used by the demo has prompt logging turned off, whether routing requires zero retention or blocks providers that train or retain data, and whether a signed processing agreement and standard contractual clauses with OpenRouter, Inc. exist for this use.]
5. Your rights
You can request access, rectification, erasure, objection, restriction and portability, and you can withdraw consent at any time (without affecting processing that was lawful before). Email agents@xiran-ai.com and name the right. We reply within one month.
Withdrawing cookie consent is as direct as giving it: use “Cookie settings” in the footer of every page. For commercial email, reply to the message or write to the same address.
If you think we have not handled your rights, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es, C/ Jorge Juan 6, 28001 Madrid).
6. Cookies
Details are in the Cookie Policy. Google Analytics does not load, and does not send data to Google, until you accept. If you reject, it stays unloaded.
7. Security
The site is served over HTTPS. Demo-chat messages are kept for at most 30 days on the automation server. This page does not state encryption at rest of those logs as a verified fact. The model path, and what OpenRouter publishes about retention and training, are in sections 3 and 4. Measures for a product a client buys are set out in that client’s processing agreement.
8. XIRAN as a processor
When a clinic, driving school or other business hires XIRAN, data about its patients, students or customers (conversations, appointments and, where relevant, health data) is processed on behalf of that business, which is the controller. XIRAN acts as processor (GDPR Art. 28), only on documented instructions and under a processing agreement. If you are a patient or student, exercise your rights with the business you contacted. If a request reaches us, we will pass it on without delay.
We do not use that data for our own purposes or to train XIRAN’s AI models. This website policy does not set the purposes of patient data.
9. Changes
We will publish changes here and show the last-updated date.