Legal

Privacy policy

This page explains what data we process, what for, who we share it with, and how long we keep it. It is written to be understood on the first read: if anything is unclear, write to us and we will clear it up.

Last updated: 26 August 2026Version 2026-08-26

1. Who processes your data

Muvly AI is a service of José Jorge Márquez Gómez, Spanish tax number (NIF) 15407058W, based at Avenida Mairena 17, 41520 El Viso del Alcor (Sevilla), España.

For anything related to this policy or to your data, write to info@muvly.ai. A person answers, not an automated form.

2. What data we process, and whose it is

Not all the data flowing through Muvly is ours, and our role differs for each group. This distinction is the most important part of this policy.

  • If you visit this website or join the waiting list

    We process your name, your email, your company name if you give it to us, whatever you write in the comments box, and the language you browse in. From the form we also keep a cryptographic fingerprint of your IP address to stop spam: we store the hash, never the IP, and that hash cannot be reversed. For this group, Muvly AI is the data controller.

  • If you are a customer of a moving company that uses Muvly

    The assistant processes what you tell it in the conversation, the origin and destination addresses, your phone number and contact email, the moving date, the inventory of your belongings, and any photos you upload of them. This data is not ours: the controller is the moving company that installed Muvly on its website. Muvly AI acts as a data processor, following that company’s instructions under the processing agreement required by Article 28 GDPR.

In practice: if you are an end customer and want to exercise your rights, your counterpart is the moving company you are talking to. If you write to us instead, we will pass your request on to them and tell you so.

3. What we use the data for, and on what legal basis

Each processing activity has a specific purpose and a legal basis behind it.

  • Preview waiting list

    To let you know when we open places and to send you the sign-up invitation. Basis: your consent, given when you submit the form and withdrawable at any time (Article 6(1)(a) GDPR).

  • Sales contact and answering your questions

    To reply to what you ask and explain the product. Basis: your consent.

  • Providing the service to the client company

    To run the assistant, calculate quotes with that company rates, and hand it the resulting contact. Basis: performance of our contract with that company (Article 6(1)(b)). Towards the end customer, the legal basis is determined by the controller company, not by us.

  • Security and abuse prevention

    To rate-limit requests and detect automated submissions on the forms and the API. Basis: our legitimate interest in keeping the service up and free of junk (Article 6(1)(f)).

  • Measuring website usage

    To know which pages get read so we can improve them. Basis: your consent, and only if you give it in the cookie notice. Details in section 7.

4. Who we share data with

We do not sell data and we do not hand it to anyone to advertise to you. We do work with providers that process data on our behalf or on behalf of the client company, because without them the service does not run:

  • Amazon Web Services (Amazon SES)

    Sending the service emails: the sign-up invitation and operational notices. It receives your email address and the message content.

  • IONOS

    Hosting of the info@muvly.ai mailbox and of the domain DNS zone. It sees the emails you send us.

  • Google Maps Platform

    Geocoding addresses and calculating the distance between origin and destination. We send it the address to look up, never the full conversation.

  • Large language model providers

    OpenAI, Anthropic, Google or another, depending on what each moving company has configured in its account. They receive the conversation text and, if inventory photos are uploaded, those images, because they are what generates the assistant replies.

  • Authorities and public bodies

    Only where a law requires us to provide them with information.

Some of these providers are US-based or may process data outside the European Economic Area. When that happens, the transfer relies on the Standard Contractual Clauses approved by the European Commission or, where the provider is certified, on the adequacy decision for the EU-U.S. Data Privacy Framework. You can ask us for a copy of those safeguards at info@muvly.ai.

5. How long we keep it

The periods below are not an intention: they are what the system does on its own, without anyone having to remember.

  • Assistant conversation, inventory and photos

    180 days. A daily automated job deletes expired sessions, and the photos leave the disk before their database row, so none is left orphaned.

  • Integration API call traces

    180 days. They record the requests third-party systems make to get a quote, and they carry addresses, so they are purged the same way.

  • Quote and end-customer contact details

    The moving company keeps these as its own commercial record, and it sets the period. Deleting the chat does not touch them: they are separate things.

  • Waiting list

    For as long as your interest in joining the preview stands. If you ask to be removed, we delete your record.

  • Proof that you accepted this policy

    The date and the version you accepted when signing up, for the duration of the relationship and afterwards for the applicable statutory limitation periods.

6. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you have given us at any time, without affecting processing carried out before the withdrawal.

To exercise them, write to info@muvly.ai stating which right you want to exercise. We reply within one month; if the case is complex, we will tell you and extend it.

If you are an end customer of a moving company that uses Muvly, go to that company first: it is the controller of that data. We will help them respond to you.

If you believe your request has not been handled properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority in your country.

7. Cookies and browser storage

This is what this website does today, no more and no less:

  • Language cookie (NEXT_LOCALE)

    First-party and strictly technical. It remembers the language you pick so we do not ask again. It lasts a year, identifies nobody, and needs no consent.

  • Analytics

    The site only loads Google Tag Manager if the deployment has a container configured. When it does not, no third-party script is inserted and no analytics cookie is set: there is nothing to accept and the notice does not even appear.

  • If analytics is active

    Nothing loads until you click “Accept” in the notice. We start with everything denied and, on acceptance, only analytics storage is enabled. Advertising and personalisation categories stay denied at all times.

  • Your choice in the notice

    It is stored in your browser local storage, under the key muvly-cookie-consent. It is not a cookie and it never travels to our servers. Clear the site data in your browser and the notice comes back.

  • The assistant embedded on a moving company website

    It authenticates with a header, not with cookies, and it sets no advertising cookies.

8. Changes to this policy

This is version 2026-08-26. When something relevant changes we will publish a new version here, with its date, and the previous one will stop applying.

If you accepted this policy when creating your account, we store which version you accepted and when, so that both sides know exactly which text you agreed to.