Privacy Policy

Last updated: 23 October 2026

This Privacy Policy explains how Cordada Tech SL ("Cordada Tech", "we") processes personal data in connection with enrutar: the enrutar.com website, the app.enrutar.com application, the iOS and Android apps and the connector for AI assistants. We comply with the GDPR, the Spanish LOPDGDD and the Spanish LSSI.

This is an English translation of our Spanish privacy policy. If they differ, the Spanish version prevails.

Controller and contact

• Controller: Cordada Tech SL
• Trade name: enrutar
• Address: Av/Sants de la Pedra, 1, 10, 46500 Sagunto, Valencia, Spain
• Contact email (privacy and support): hola@enrutar.com
• Contact form: enrutar.com/en/contact
• DPO: not appointed

Controller or processor

• As a controller we process the data of the people who use enrutar (user accounts), billing data, and the data of people who visit our website or request a demo, and of our marketing communications.
• As a processor we process the data that the companies using enrutar (our customers) keep in the service about their own customers and employees: contacts, jobs, visits, estimates, work reports, conversations or clock-ins. That company is the controller of that data, and we only process it on its instructions and under the data processing agreement (DPA), available on request at hola@enrutar.com.

Scope and eligibility

• Who the service is for: companies and professionals, mainly in Spain and Poland.
• Minimum age: over 18. enrutar is not directed at minors.

Data we process

• Account: first name, last name, email, phone, company and job title, access level, language, notification preferences and password (stored as a hash).
• Billing: company name, tax ID (NIF/CIF), address and payment history. Payment data is processed by Stripe; we do not store cards.
• Service content (as a processor): data about our customers' own customers (name, phone, email and addresses), jobs, visits, estimates, invoices, work reports with photos and signatures, comments, files, voice notes and WhatsApp and email conversations.
• Our customers' employees (as a processor): schedule, assignments, logged hours, leave and working-time records (clock-in, clock-out, breaks, IP address and, where applicable, the clock-in device). If the company enables it, we store the location at the moment of clocking in or logging hours; enrutar does not track location continuously.
• Usage and technical data: IP address, device and push notification identifiers, logs, browser and operating system, product usage events and cookies or similar technologies.
• Demo and contact requests: email, phone, country, company, job title, team size, preferred time for a call and anything you tell us. We also receive them from Meta lead ad forms (Facebook and Instagram).
• AI assistants: data about each connection with ChatGPT, Claude or another assistant. See AI assistants.

We do not ask for special categories of data. If a company records sick leave, we store the type of leave and the dates; we recommend not including diagnoses or other health data in the notes.

Purposes and legal bases

• Providing the service and support: performance of the contract.
• enrutar's AI features: performance of the contract and, for our customers' content, their instructions.
• Billing and legal obligations: legal obligation.
• Security, fraud prevention and protecting forms against spam: legitimate interest.
• Product analytics: legitimate interest and, where non-essential cookies are needed, consent through the banner.
• Handling demo and contact requests: steps taken at your request before entering into a contract. To prepare the call we may look up public information about your company (for example, its website), based on our legitimate interest.
• Measuring advertising campaigns (Google Ads, Meta): consent.
• Email marketing (newsletters): consent (opt-in), with an unsubscribe option.

We do not make automated decisions with legal or similarly significant effects.

AI features in enrutar

• enrutar uses AI models for the Eva assistant, to understand WhatsApp messages and emails and turn them into jobs or proposed visits, to summarize jobs and conversations, to transcribe voice notes and audio (including dictation in Issue Express) and to describe attached photos and documents.
• Providers: OpenAI for AI features and for all transcription (voice notes, audio attachments and dictation in Issue Express, including live), and Google (Gemini) to summarize jobs, draft the job in Issue Express and as a fallback for some OpenAI features.
• All of them act as sub-processors under business terms: we do not allow them to use the data to train their models, and they only keep it for as long as needed to process each request and, where applicable, for a limited period to prevent abuse.
• We send only the data each feature needs and apply security and pseudonymization measures where appropriate.

AI assistants (ChatGPT and Claude)

You can connect enrutar to ChatGPT (by OpenAI), Claude (by Anthropic) or another compatible assistant to look up and update your enrutar data from a conversation. How it works: AI assistants guide.

• Only with your explicit consent. You start the connection from the assistant and complete it on an enrutar screen where you sign in, choose the organization, see what the assistant will be able to do and press Allow. In addition, an administrator with Full Access must turn on Allow connecting AI assistants for the organization (it is off by default), and only people with Full Access or Management Access can connect.
• What enrutar shares with the assistant. Only what the assistant looks up to answer you, with your permissions checked on every request: jobs, visits, customers (name, phone, email and addresses), estimates, work reports, catalog, the organization's people and teams, logged hours and, with Full Access only, working-time records (never locations, devices or IP addresses). This can include personal data about your customers and employees.
• What we receive from the assistant. The requests it makes to enrutar (for example, finding tomorrow's visits or creating a job with the details you give it), not the rest of your conversation. The assistant never receives your password: it uses its own access, of which we only store a hash. If you don't use it for 60 days, it expires and you will need to connect it again.
• Everything is recorded. What the assistant changes appears in the history under its name (for example, "Ana via ChatGPT"). The assistant does not delete data, does not send messages or documents to your customers and does not change settings, users or billing.
• Who processes the data afterwards. What enrutar returns to the assistant is received by its provider (OpenAI, Anthropic or another), which processes it under your account and your terms with them and its own privacy policy: OpenAI, Anthropic. For this feature it is not a sub-processor of Cordada Tech. If the information belongs to your company's customers or employees, your company, as controller, decides whether to allow this feature.
• Revoking access. Disconnect the assistant at any time in Settings › AI assistants: it loses access immediately. Administrators with Full Access can disconnect any connection in the organization or turn off AI assistants for the whole organization. You can also remove the connector from your ChatGPT or Claude settings.
• Retention. We keep the data about each connection (person, assistant, dates connected, last used and disconnected, and the changes it made) for as long as the organization's account exists. Connection requests that are not completed are deleted the day after they expire.

Recipients, sub-processors and transfers

We do not sell personal data. We only share it with:

• Sub-processors that provide services to us, under a data processing agreement and only for the purposes stated (see the table).
• Your AI assistant's provider, when you connect it (see the previous section).
• The people you send messages and documents to from enrutar, such as your customers, who receive confirmations, estimates or work reports by WhatsApp or email.
• Public authorities, judges and courts, when the law requires it (for example, the Spanish Tax Agency).
• Professional advisers (accountants, lawyers, auditors), bound by confidentiality.

If you turn on browser notifications, they are delivered through your browser's push service (for example, Google, Mozilla, Apple or Microsoft).

We host and process data in the EEA whenever possible. When a provider processes it outside the EEA, the transfer relies on a European Commission adequacy decision (such as the EU-U.S. Data Privacy Framework, for certified companies, or the one for the United Kingdom) or on the Standard Contractual Clauses, with additional measures where appropriate. You can ask for more information at hola@enrutar.com.

Cookies and consent

• Essential: always on, no consent needed.
• Analytics (Google Analytics, Mixpanel, Ahrefs) and advertising/remarketing (Meta Ads, Google Ads): require your prior consent through the banner. The same choice applies on enrutar.com and app.enrutar.com.
• Forms use Google reCAPTCHA to stop spam and abuse.
• You can manage or withdraw your consent by clearing your browser data.
• Full details in our Cookie Policy.

Retention

• Accounts and content: while the account is active. If it is closed or you ask for deletion, we delete or anonymize the data except what we must keep by law; backups drop it when they expire.
• Working-time records: we keep them on the company's behalf while its account is active. The company must keep them for 4 years (art. 34.9 of the Spanish Workers' Statute).
• Billing: 6 years (Spanish Commercial Code and tax law).
• Demo and contact requests: for as long as the business relationship lasts and, if you don't become a customer, up to 2 years after the last contact.
• Newsletter: until you unsubscribe.
• AI assistants: see AI assistants.
• Logs: 30 days on our servers and up to 90 days in error monitoring tools.
• Backups: hourly; kept for 1 month.
• Analytics and advertising: according to each tool's settings or until you withdraw your consent.

Security

• Encryption in transit (TLS) and at rest where applicable, passwords and access credentials stored as hashes, encrypted backups, permission-based access, logging and monitoring.
• We currently do not have mandatory MFA or certifications (ISO 27001/SOC 2).

Your rights and controls

• You can exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw your consent at any time, without affecting earlier processing.
• How: email hola@enrutar.com from your account's email address, or request deletion on Delete account. We may ask you to verify your identity.
• Response time: one month, extendable by two more months for complex requests.
• Controls in enrutar:
  • Edit your profile and notification preferences in the app, and turn off push notifications in your device or browser settings.
  • Unsubscribe from the newsletter with the link in every email.
  • Disconnect AI assistants in Settings › AI assistants. Administrators with Full Access can turn them off for the whole organization.
  • Your company decides whether location is requested when clocking in; you grant or withdraw location permission on your device.
• If you are a customer or employee of a company that uses enrutar, that company is the controller of your data: contact it. If you write to us, we will pass your request on.
• Complaints: to the Spanish Data Protection Agency (aepd.es) or the data protection authority in your country.

Marketing and communications

• We send newsletters with your consent through Loops; every email has an unsubscribe link.
• Operational communications needed for the service are sent without a marketing basis.

Accounts and access

• Sign-in with email and password or with a WhatsApp code; no SSO currently.
• Administrators have no access to end users' data beyond what the product's features allow.

Incidents and breaches

• We will notify the AEPD within 72 hours where required, and affected people if there is a high risk.
• Contact channel: hola@enrutar.com.
• We keep a record of incidents.

Changes to this policy

We may update this Privacy Policy. We will notify material changes by email. The "last updated" date shows the current version.

Contact

If you have questions about this policy or need help, email us at hola@enrutar.com or use the contact form.