Company
Privacy notice
Last updated: 2 October 2026
1. Who the controller is
Nicolás Leránoz Fernández, a sole trader operating under the trade name Lera. Spanish tax ID (NIF) 73511637A. Address: C/ Concejo de Sagaseta 16, 3B, 31016 Pamplona (Navarra), Spain. Email: hola@leracore.com. Phone: +34 644 504 282. No Data Protection Officer has been appointed, as it isn’t mandatory in our case (Art. 37 GDPR); for any privacy question write to hola@leracore.com.
2. Lera’s two roles
We are the controller of the data of people who visit the website, request a demo or contact us, sign up and use the panel, and of billing data: that is what this notice covers. When Lera answers calls on behalf of a client business, that business is the controller of the callers’ data and Lera acts as a processor, following its instructions and the Data Processing Agreement published on this website. Informing callers is the business’s duty. Making sure they know they are talking to an artificial intelligence system is ours, as the provider of the system (Art. 50(1) of the EU AI Act).
3. What data we process
Contact and commercial data: name, email, phone, business and sector you give us in forms or when booking a demo, and the messages you send us. Account data: email, name, company, role, workspace and technical sign-in data; the password is stored hashed (bcrypt), never in plain text. Billing data: what is needed to manage the prepaid balance and payments; card payments are processed by Stripe and we don’t store the card number. Proof of acceptance of the contracts: when you accept the Customer Agreement and the Data Processing Agreement we keep your email, the date and time, the IP address, the browser, the version of the text and its digital fingerprint; if you accept on behalf of a company as a partner, also the company name, tax ID, address and the name and position of the signatory. Free-trial control: the email in normalised form and the IP address used, so the same person can’t repeat it. Custom voices: if you clone a voice we don’t keep the sample audio, only its digital fingerprint; we keep the proof of consent with who gave it, when, from which IP, with which version of the text and whose voice it is, and the synthetic voice stays at ElevenLabs until you delete it. Technical browsing data strictly necessary for the website to work and be protected. On the website voice demo we don’t record the audio; we keep the text of the conversation and its analysis, with any personal data said in it redacted, to improve the demo. We tell you in the demo itself when it starts. We don’t ask for special categories of data and the service is not aimed at minors.
4. Purposes and legal basis
Handling demo, contact or support requests: pre-contractual steps at your request (Art. 6(1)(b) GDPR). Setting up the account, running the panel and providing the service: performance of the contract (Art. 6(1)(b)). Managing the balance, payments and invoicing: performance of the contract and compliance with accounting and tax obligations (Art. 6(1)(b) and (c)). Keeping proof of acceptance of the contracts and of consent for a cloned voice: our legitimate interest in being able to prove they were accepted and to defend ourselves against a claim (Art. 6(1)(f)). Security and prevention of abuse and fraud, including making sure the free trial isn’t repeated: legitimate interest (Art. 6(1)(f)). Reasonable improvement of the service, including reviewing the text of the website voice demo conversations: legitimate interest (Art. 6(1)(f)). Marketing communications about Lera: your consent, given by ticking the box at signup, which you can withdraw at any time (Art. 6(1)(a)). Where the basis is legitimate interest, you can object by writing to hola@leracore.com.
5. Which data is required
To create an account and sign the contract we need your email and the data the form marks as required, and to pay, your billing details; without them we can’t set up your account or charge you. Everything else is optional. For a demo or a contact request, we only need what it takes to reply.
6. Who receives the data
We don’t sell personal data. We rely on providers that process data on our behalf, under contract and confidentiality obligations: Contabo (hosting of the application and database, Germany), Backblaze (encrypted backups, Amsterdam), Stripe (payments), Resend and Google Workspace (email delivery), Cloudflare Turnstile (anti-abuse at signup), Google (sign-in, if you choose it), Calendly (demo booking), plus Anthropic for the panel copilot. The providers involved in the calls we handle on behalf of our clients are listed on the Sub-processors page; the website voice demo runs on the same engine, with those same providers. For internal operations alerts we use Telegram, without personal data. We may disclose data to authorities when the law requires it.
7. Transfers outside the European Economic Area
Data at rest is hosted in the European Union. Some providers (for example Stripe, Resend, Google, Cloudflare, Anthropic or OpenAI) may process it in the United States. In those cases the GDPR safeguards apply: the European Commission’s standard contractual clauses and, where the provider is certified, the EU-US Data Privacy Framework. You can ask us for a copy of the applicable safeguards by writing to hola@leracore.com.
8. How long we keep it
Account and billing data: for as long as the relationship lasts and, afterwards, for as long as accounting and tax obligations require and during the limitation period for possible liabilities. Data from a demo or contact request that doesn’t lead to signup: for as long as needed to handle it plus a reasonable follow-up period. Proof of acceptance of the contracts: for as long as liabilities may arise from the contract, including after the account is closed. Free-trial control: for as long as the trial is on offer, including after the account is closed. Proof of consent for a cloned voice: once the account is closed we keep only the voice identifier, the version of the accepted text, the date, whose voice it was (your own, an employee’s or a third party’s) and the email of whoever accepted as a fingerprint, not in plain text, for as long as it may be needed to prove that consent. Text and analysis of the website voice demo conversations: 7 days. Database backups are kept encrypted for 14 days. Call data is governed by the Data Processing Agreement. When data is no longer needed it is deleted or blocked until any liabilities are time-barred.
9. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you have given at any time, without affecting processing carried out before. Write to hola@leracore.com saying what you are asking for; we will reply within one month. We don’t make automated decisions with legal effects on you or build profiles for that purpose. If your data is processed by Lera on behalf of a business (for example, after a call), that business is the controller: we will pass your request on without delay. If you think we haven’t handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid, www.aepd.es).
10. Security
We apply technical and organisational measures appropriate to the risk: encryption in transit, a database not exposed to the internet, encrypted credentials, hashed passwords, role-based access control, separation of each client’s data, encrypted backups and logging of administrative actions.
11. Changes to this notice
We will publish the current version here with its date. If the change is substantial, we will let you know by reasonable means.