Privacy policy
This English translation is provided for convenience only. In the event of any discrepancy, the Spanish version prevails and is the only legally binding text.
Last updated: 25 October 2026
1. Data controller
NICOLAS CIERI, NIE Z2248368P, Avenida España 230, Local Derecha, 29680 Estepona (Málaga), Spain. Privacy contact: privacidad@devroam.com. Given the volume and nature of the processing, no Data Protection Officer has been appointed.
2. Two different roles
As controller, DevRoam processes the data of visitors to this website and of its customers (subscribed businesses). As processor (Art. 28 GDPR), DevRoam processes the data of people who call those businesses, following their instructions and under the data processing agreement.
3. Data processed and purposes
| Group | Data | Purpose | Legal basis |
|---|---|---|---|
| Website visitors | Browsing data, cookies (with consent) | Operation, analytics and advertising | Legitimate interest / consent |
| Customers | Identification, contact, billing | Providing the service and billing | Contract and legal obligation |
| Callers (as processor) | Number, voice, recording and transcript, appointment details | Answering the call on the business's behalf | As determined by the business acting as controller |
4. Artificial intelligence and transparency
In accordance with Regulation (EU) 2024/1689 on Artificial Intelligence (Art. 50), callers are informed at the start of the conversation that they are interacting with an AI system. DevRoam does not make decisions with legal effects on callers; answers follow the rules set by each business.
5. Providers and international transfers
Data is stored on Amazon Web Services in the Ireland region (eu-west-1). The following providers (sub-processors) are involved in providing the service; some process the voice and text of conversations in the USA. Where a provider processes data outside the European Economic Area, the transfer is covered by the EU-US Data Privacy Framework (certified providers) or the European Commission's standard contractual clauses. More detail in the data processing agreement.
| Provider | Purpose | Processing location | Transfer safeguard |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Hosting, database, storage, authentication, email (SES), SMS (End User Messaging; disabled) and fallback language model (Bedrock) | EU: Ireland (eu-west-1); Bedrock fallback in Frankfurt (eu-central-1) | Not applicable (EEA) |
| Anthropic | Language model that generates the assistant's replies | USA | EU-US Data Privacy Framework or standard contractual clauses |
| Deepgram | Real-time speech transcription | USA | EU-US Data Privacy Framework or standard contractual clauses |
| ElevenLabs | Speech synthesis | USA / EU | EU-US Data Privacy Framework or standard contractual clauses |
| xAI | Fallback speech transcription and synthesis | USA | Standard contractual clauses |
| DIDWW | Phone numbers and call transport (carrier) | As per carrier contract | Standard contractual clauses where data leaves the EEA |
| Twilio | Fallback SMS (disabled) | USA | EU-US Data Privacy Framework or standard contractual clauses |
| Meta Platforms (WhatsApp Business) | WhatsApp confirmation, reminder and notification messages | EU / USA | EU-US Data Privacy Framework or standard contractual clauses |
| Stripe | Subscription billing and, if the business enables them, booking deposits (Stripe Connect) | EU / USA | EU-US Data Privacy Framework or standard contractual clauses |
| Google (Firebase Cloud Messaging) | Push notifications for the Android app | USA | EU-US Data Privacy Framework |
| Apple (APNs) | Push notifications for the iOS app | USA | EU-US Data Privacy Framework |
| Google (Calendar) / Microsoft (Outlook) | Only if the business connects its calendar: reading availability and creating appointments | USA / EU | EU-US Data Privacy Framework |
6. Retention
Recordings and transcripts: a period each business can configure in the app; 24 months by default. Billing data: statutory periods.
7. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability at privacidad@devroam.com, and lodge a complaint with the Spanish Data Protection Agency (aepd.es). If you called a business that uses DevRoam, please contact that business, which is the controller; we'll help it handle your request.
8. Security
Encryption in transit and at rest, access control and activity logging: encrypted database and backups, role-based access with authentication, and HTTPS/TLS connections.