Imane

Privacy Policy

Last updated: 30 June 2026

This is an English translation of the Spanish original. If the two differ, the Spanish version is the one that applies.

1. Data controller

More Solutions Malaga Consulting, S.L. (trading as «Malaga Consulting»), owner and operator of the Imane platform.

2. What Imane is, and our two roles

Imane is a virtual assistant with artificial intelligence (a chatbot) for small businesses. It answers questions from your own customers on digital channels (the web, Telegram, WhatsApp and others as they are added) and it can connect to the tools you already use.

For the data of your own account and your company, Malaga Consulting acts as the controller. For the data of third parties captured by the bot (the people who talk to your assistant), we normally act as the processor: we handle it following your instructions and in order to provide the service to you. In that case you are the controller, and it is up to you to inform those people and to have a legal basis for processing their data.

3. What data we collect

3.1. Account data (our customers)

  • Name, email and password (hashed, through Supabase Auth).
  • Trading name, sector and tax details of the company.
  • Payment details tokenised by Stripe (we do NOT store card numbers).
  • The configuration you provide: the bot's knowledge base, brand profile, templates and so on.
  • Security records of your activity on the platform (including the IP address and the browser or device) in the audit log.

3.2. Virtual assistant data (conversations)

  • Messages exchanged with the bot.
  • Contacts and leads: name, phone, email, company, language, tags and notes captured during the conversation.
  • Technical identifiers: on the web, a sessionId in localStorage; on Telegram and WhatsApp, the chat identifier.
  • The language detected in the conversation.

3.3. Integrations you connect

If you decide to connect Imane to an external tool (a calendar, a messaging channel or a social network, for example), we store only the access tokens and the minimum data needed for that integration to work. You can disconnect it at any time and we delete the tokens that go with it.

3.4. Technical and security data

  • Error and diagnostic logs (Sentry), which may include technical identifiers.
  • IP addresses, browser and activity events, for security and to prevent abuse.
  • Usage data, to apply the limits of your plan.

4. What we use the data for

  • Providing the service you have signed up for.
  • Talking to your team (notifications, usage alerts).
  • Invoicing and meeting our accounting and tax obligations.
  • Keeping the platform secure and preventing abuse.
  • Improving the service (in aggregate and anonymised form).

We do not sell data to third parties. We do not use your data or your contacts' data to train AI models.

5. Legal basis

  • Performance of the contract: to provide the service you have signed up for.
  • Legal obligation: invoicing and tax.
  • Legitimate interest: platform security and preventing abuse.
  • Consent: non-essential cookies, marketing communications and the voluntary connection of external tools.

6. Where the data is hosted

Imane's database and files are self-hosted on our own infrastructure, on IONOS servers located in the European Union. We do not use managed databases outside the EU for primary storage.

7. Processors (suppliers)

To run Imane we rely on the following suppliers, each with its own data processing agreement (DPA) and, where it applies, standard contractual clauses (SCCs) for international transfers:

  • IONOS (European Union): hosting of the application, the database and file storage.
  • Anthropic (USA): processes the messages with its Claude model. It does not retain the data to train models.
  • Stripe (EU/USA): payment processing.
  • Resend (USA): sending transactional email.
  • Sentry (USA): error monitoring.
  • Telegram / WhatsApp and any other channel you turn on: the messages pass through their servers.
  • The tools you connect yourself (Google, Meta or LinkedIn, for example): they handle the data under their own policies, through their APIs.

8. How long we keep it

Data is kept for as long as the account is active. If you cancel, we keep it only for the periods the law requires and then delete it:

  • Invoicing and accounting: up to 6 years (Spanish commercial and tax law).
  • Bot conversations: according to your plan (30 days on Starter, 180 on Basis, unlimited on Pro and Custom), only so you can see them in your dashboard.

9. Your rights

You have the right to access, correct, delete, restrict the processing of, object to and port your data. To exercise them, write to us at info@malaga-consulting.com identifying yourself. For deletion you can also follow the procedure on our data deletion page.

If you are a third party (someone who talked to the bot of a company that uses Imane) and you want to exercise your rights, go to that company, which is the controller of your data; if you get no answer, write to us and we will step in.

If you believe we are not handling your rights properly, you can complain to the Spanish Data Protection Agency (AEPD): aepd.es.

10. Security

  • HTTPS across the whole service.
  • Hashed passwords (bcrypt through Supabase).
  • Multi-tenant isolation with Row Level Security in Postgres.
  • Channel and integration tokens encrypted and reachable only by the backend.
  • Regular backups of the database and the files.

11. DPA for business customers

Since in many cases we handle the data of the people who talk to your bot on your behalf (we are the processor), if your business needs a signed Data Processing Agreement (DPA) to meet its own GDPR obligations, write to us at info@malaga-consulting.com and we will provide one.

12. Changes to this policy

Any substantial change will be notified by email at least 30 days in advance.