Book a consultationBook a call

Privacy Policy

Last updated: 28 October 2026

This policy covers the Nairoo website, the assistant on it, and the Nairoo app used by guides, transport companies and restaurants. Where they differ, it says so.

Who is responsible for your data

  • Controller NOMAD ERA LABS, S.L.U.
  • Tax ID B23887573
  • Address C/ Paseo de Gracia, 19, 08007 Barcelona, Spain
  • Email fabio@getnairoo.com

Write to that address for anything in this policy, including exercising your rights. It is the only address we use for data protection matters.

The website

The consultation form

The website has one form. When you submit it we receive the name, email address, company, current system and departure volume you entered, plus a tag identifying which button you clicked so we know what you were reading when you got in touch.

We use it to reply to you and, if it goes that way, to arrange a conversation about your operation. The legal basis is the steps taken at your request before entering into a contract (Art. 6.1.b GDPR) and our legitimate interest in answering enquiries addressed to us (Art. 6.1.f GDPR). We do not add you to a marketing list.

Analytics

If — and only if — you accept analytics cookies, we use Google Analytics 4 through Google Tag Manager to count visits and see which pages are read. Nothing analytical loads before you accept: the tags are blocked until then, and rejecting is one click, exactly like accepting. The legal basis is your consent (Art. 6.1.a GDPR), which you can withdraw at any time from the Cookies Policy.

The full list of cookies, with names and durations, is in that same policy.

Advertising

Behind a separate switch, and only if you turn that one on, we use the Meta pixel to measure whether our advertising on Facebook and Instagram brings anyone here, and to build audiences of people whose work resembles our customers'. This tells Meta that a browser visited this site and which pages it saw.

For this processing, Meta Platforms Ireland Ltd. and NOMAD ERA LABS, S.L.U. act as joint controllers under Article 26 GDPR, on the terms of Meta's Controller Addendum. In practice: we decide to collect it, Meta decides how it is used within its own advertising systems, and Meta is responsible for answering requests about the data once it holds it. You can exercise your rights against either of us.

Accepting analytics does not accept advertising. They are separate switches because they are separate purposes, and the banner asks them as two questions. The legal basis is your consent (Art. 6.1.a GDPR), withdrawable at any time from the Cookies Policy.

The assistant

The website has an assistant you can ask questions of. What you type, and what it answers, is sent to Anthropic — the company that provides the language model — so that it can produce a reply. It is grounded only in this website and a document we maintain; it has no access to any customer system.

Do not type anything into it you would not put in a first email to a supplier. We ask it not to request personal data, and it has no reason to.

If you choose to end the conversation by requesting a consultation, the transcript travels with that request so you do not have to explain your operation twice — and it is then kept exactly as long as the request itself. If you do not, we do not store the conversation. The legal basis is our legitimate interest in answering questions about our own product (Art. 6.1.f GDPR), and your consent for the transcript that accompanies a consultation request (Art. 6.1.a).

Fonts

The typeface is requested from Google's servers when a page loads, which discloses your IP address to Google as part of that request.

The Nairoo app

The app is for the suppliers an operator works with — guides, transport companies, restaurants and bars. It is how they receive the departures assigned to them and everything they need for the job. The operator's own team works in the web platform, not the app.

What the app collects

  • Account and profile. Name, email address, phone number and the role you hold with the operator who invited you. This is what identifies you when you sign in and what lets us show you your own assignments and nobody else's.
  • Push notification token. An identifier issued by your device so we can send you a notice when a departure is assigned, changed or cancelled. It identifies the device, not you personally, and it is the only way an assignment can reach you without you opening the app.

What the app does not collect

The app does not track your location, in use or in the background. It carries no advertising identifiers, no third-party analytics and no behavioural profiling. We do not read your contacts, your photos or your calendar.

We process this data on behalf of the operator who invited you, which is the controller of it. Nairoo acts as its processor under a data processing agreement (Art. 28 GDPR). Push notifications can be switched off at any time in your device settings without losing access to the app.

Operators who use Nairoo

If your company uses Nairoo, we process the details of your contact people to manage the contract, support and invoicing. The legal basis is the performance of the contract and our tax and accounting obligations (Art. 6.1.b and 6.1.c GDPR). We keep them while the contract lasts and afterwards for the periods the law requires.

The data your company enters in Nairoo about its own customers — names, contact details, bookings and, if it asks for them, food allergies or intolerances — is processed by Nairoo on your company's behalf, as processor, under the data processing agreement in Annex I of our Service Terms. For questions about that data, customers should contact the operator they booked with.

Who else processes your data

  • Netlify — hosting and form handling. Consultation requests are stored on Netlify's infrastructure and forwarded to us by email.
  • Google — Fonts on every page; Analytics and Tag Manager only with your consent.
  • Meta Platforms Ireland Ltd. — the advertising pixel, only with your consent, as joint controller.
  • Anthropic — the language model behind the site assistant, for the questions you choose to ask it.
  • Apple and Google — app distribution through the App Store and Google Play, and delivery of push notifications through their notification services.
  • Google (Firebase Cloud Messaging) — delivery of push notifications to the mobile app.
  • Pusher Ltd. — real-time notifications inside the web application.

International transfers

Some of those providers are established outside the European Economic Area, or process data there. Those transfers take place under the safeguards each provider has in place — Standard Contractual Clauses approved by the European Commission and, where applicable, the EU–US Data Privacy Framework. You can ask us for details of the safeguards that apply to any specific transfer.

How long we keep it

  • Consultation requests — while the commercial conversation is live, and up to two years afterwards in case you come back. Then deleted.
  • App accounts — while the account is active. When the operator who invited you removes you, or its contract with Nairoo ends, the account is deleted within 60 days, and only what tax and commercial law requires is kept.
  • Analytics — 14 months, after which Google Analytics deletes it automatically.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict its use, to object to it, or to receive it in a portable format. Write to fabio@getnairoo.com and we will answer within one month.

If you are a guide, driver or restaurant using the app, the operator who invited you is the controller of your data. You can write to them or to fabio@getnairoo.com, and we will pass your request on.

If you think we have handled your data badly, you can complain to the Spanish Data Protection Agency, www.aepd.es, or to the supervisory authority where you live.

Age

Neither the website nor the app is intended for anyone under 14. We do not knowingly collect data from children.

Security

We apply technical and organisational measures appropriate to the risk, and we will not pretend that makes a breach impossible. If one occurs and it is likely to affect your rights, we will tell you and the authority within the deadlines the GDPR sets.

Changes

When this policy changes, the new version is published here with its date. We do not apply changes retroactively.