Privacy Policy

Last updated: November 4, 2026

At gexep we take personal data protection seriously. This policy explains what data we process when you visit our website, sign up or use the gexep platform, why we use it and what rights you have, in accordance with the General Data Protection Regulation (GDPR) and other applicable law.

1. Data controller

Controller: Omelcia Technologies SL ("gexep")
Registration number: NIF
Address: Calle Antonia Gómez de Orga, 2, 1C, 46019 Valencia, España
Privacy contact: admin@gexep.com

2. When we are controller and when processor

gexep processes personal data in two different situations:

As controller, for the data of people who visit the website, sign up, try or buy gexep (for example, sign-up form and billing data).
As processor, for the data our customers enter or generate on the platform: contacts, calls, recordings, transcriptions, campaigns or CRM data. In that case the customer is the controller and gexep only processes the data on their instructions and under the data processing terms included in the Terms of Service. If you called or were called by one of our customers, please contact that company first.

3. Data we process

Sign-up data: first and last name, business email, phone, company, country, team size, language and the plan you were interested in when you signed up.
Account and usage data: users, roles, credentials (passwords are stored hashed), settings, automations, token consumption and activity logs.
Communications data: phone numbers, call metadata (date, duration, status, cost) and, when the customer enables them, recordings, transcriptions, summaries and AI-generated analysis.
Billing data: tax and subscription details. Card details are handled directly by our payment provider; gexep does not store them.
Technical data: IP address, browser and the technical cookies described below.

4. Purposes and legal basis

Purpose	Legal basis
Creating your account and your 7-day trial, assigning a gexep number and sending your credentials.	Performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR).
Providing the service: telephony, AI agents, automations, campaigns, CRM and support.	Performance of a contract.
Billing, payments and tax and accounting obligations.	Legal obligation (Art. 6(1)(c) GDPR).
Security and prevention of fraud and telephony abuse.	Legitimate interest (Art. 6(1)(f) GDPR).
Messages about your account, the end of your trial and service changes.	Performance of a contract and legitimate interest.
Marketing communications about gexep.	Legitimate interest for customers, or your consent. You can object at any time.
Measuring and improving the website and product with aggregated data.	Legitimate interest.

We do not make decisions with legal effects on you based solely on automated processing. We do not use customer data to train our own AI models.

5. Recipients and providers

We do not sell personal data. To provide the service we work with providers acting as processors or sub-processors, under contract and with appropriate safeguards:

Telephony: Twilio and Telnyx (numbers, calls, recordings).
Artificial intelligence: OpenAI (conversation, transcription and analysis) and ElevenLabs (voice synthesis).
Payments: Stripe.
Email and hosting: OVHcloud and our hosting provider.
Integrations enabled by the customer: for example Google Calendar or Microsoft Outlook, only if the customer connects them.

We may also disclose data to public authorities when required by law.

6. International transfers

Some providers are located in the United States or other countries outside the European Economic Area. In those cases transfers rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses, together with supplementary security measures.

7. Retention

Account data: while the account is active. When the 7-day trial ends, the account continues on the gexep Free plan and data is kept until you close it.
Recordings, transcriptions and customer data: according to the customer's settings and instructions, and in any case deleted after the account is closed, unless the law requires otherwise.
Billing data: for the periods required by tax and commercial law.
Technical and security logs: for a limited, proportionate period.

After those periods, data is restricted for the limitation period of any possible claims and then deleted.

8. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw your consent where it is the legal basis, by writing to admin@gexep.com. We may ask you to verify your identity.

If you believe we have not handled your request properly, you can lodge a complaint with the data protection authority: la Agencia Española de Protección de Datos (AEPD), or with the authority of your country of residence.

9. Security

We apply technical and organisational measures appropriate to the risk: encrypted connections, hashed passwords, separation of each customer's data, access control and backups. No system is infallible; if a security breach affecting your data occurs, we will act as required by the GDPR.

10. Cookies

The gexep website only uses technical cookies that are necessary for it to work and do not require consent:

Cookie	Purpose	Duration
PHPSESSID	Keeps the form session and protects submissions (CSRF).	Session
site_lang	Remembers the language you chose.	1 year

We do not use advertising or third-party cookies. If we add analytics or marketing cookies in the future, we will ask for your consent first.

11. Children

gexep is a service for businesses and professionals. It is not intended for people under 18 and we do not knowingly process their data.

12. Changes to this policy

We may update this policy to reflect legal or service changes. We will publish the new version on this page and, if the changes are significant, let you know by email or within the platform.