Privacy policy

Last updated: 2026

Informational translation. This is an English translation provided for convenience. The legally binding version is the Spanish one, available at /privacidad.

In accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), users are informed about the processing of their personal data.

1. Data controller

  • Controller: David Blanco Hernández (Koru FactorIA)
  • Tax ID (NIF): 72734170M
  • Registered address: C/ Durana, 38, 3º, Aretxabaleta, Gipuzkoa (Spain)
  • Email: david@korufactoria.com

2. What data we process and for what purpose

We process the data you provide through the contact form:

  • Data: name, email, company (optional) and the content of your message.
  • Purpose: to handle and answer your enquiry and, where applicable, manage a possible business relationship.

If you book a call through Cal.com, that platform will process the data needed to manage the appointment under its own privacy policy.

If you use the Koru assistant, we process the content of the conversation to reply to you; if you provide your name, email or business details, they are stored as a business contact (lead). In voice mode, your microphone is processed in real time with OpenAI solely to keep the conversation going; the audio is not stored. To access this voice demo we ask for your name, email and how we can help you: we store that data together with the conversation transcript to manage the trial and send you a follow-up email about your experience (basis: your consent). You can withdraw it at any time.

3. Legal basis

The legal basis is your consent (art. 6.1.a GDPR), which you give by ticking the acceptance box and submitting the form, and the interest in applying pre-contractual measures at your request (art. 6.1.b GDPR).

4. Retention

We keep your data for as long as necessary to handle your request and, if a business relationship begins, for the legally required period. Afterwards it is deleted or anonymised.

5. Recipients and data processors

We do not share your data with third parties except where legally required. To provide the service we use providers acting as data processors:

  • n8n (automation), hosted on the controller's own server, to process form submissions.
  • Airtable (Airtable, Inc., USA), where received messages are recorded as leads.
  • Google (Gmail / Google Workspace), to receive and answer enquiries by email.
  • OpenAI (OpenAI, L.L.C., USA), which processes the Koru assistant conversations to generate replies.
  • Cal.com, to manage call bookings.
  • Hosting provider (VPS server with EasyPanel) where the website is hosted.

6. International transfers

Some of the above providers (such as Airtable and Google) have their headquarters or servers in the United States. In those cases, the data transfer is covered by the safeguards provided by the GDPR, mainly those providers' adherence to the EU-U.S. Data Privacy Framework and/or the signing of standard contractual clauses approved by the European Commission.

7. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, as well as withdraw your consent at any time (without affecting the lawfulness of processing based on consent before its withdrawal), by writing to david@korufactoria.com, indicating the right you wish to exercise. You may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. Security

We apply reasonable technical and organisational measures to protect your data against unauthorised access, loss or alteration.