Transparency on the use of Artificial Intelligence

1. Purpose and scope

This page implements the transparency obligations of article 50 of Regulation (EU) 2024/1689 (hereinafter, the "AI Act") in relation to the Lueira artificial intelligence systems that hold conversations with people:

• the conversational assistant that Lueira customers offer to their own end customers via WhatsApp and a chat widget ("AI Assistant"), already mentioned in section 9 of the Terms and Conditions and in sections 3 and 5 of the Privacy Policy; and
• the artificial intelligence assistants built into the Lueira management application, used by the staff of Lueira's customers (for example, the support assistant, the business analyst and the forms assistant) ("In-app Assistants").

This policy does not cover artificial intelligence processes that do not hold a conversation with a person, such as voice-note transcription, automatic text translation or data extraction from documents. Those processes may be subject to other rules, such as the GDPR, but not to the obligation to disclose that a person is interacting with an artificial intelligence system.

2. Roles under the AI Act: provider and deployer

The AI Act distinguishes roles that are different from the data controller and data processor roles you already know from the Privacy Policy and the DPA. These should not be confused: the same entity can be a data processor for GDPR purposes and, at the same time, a provider or deployer for AI Act purposes.

• MALADETA STUDIO, S.L. acts as the provider of both AI systems: it develops them and makes them available to its customers under the Lueira brand.
• The Lueira customer that activates the AI Assistant to serve its own end customers acts as the deployer towards those end customers.
• For the In-app Assistants, the Lueira customer and its staff are users of the system. A customer that publishes, under its own responsibility, content generated with the help of an assistant (for example, product descriptions) is responsible for reviewing it before publication and for meeting the obligations that apply to it as the deployer of that content.

3. Plain-language description of the systems

AI Assistant. It is a conversational assistant reachable via WhatsApp and via a chat widget that can be embedded on the Lueira customer's website. Among other functions, the AI Assistant:

• Answers enquiries using each Lueira customer's own knowledge base (see section 10).
• Calculates prices for the available activities, rentals or services.
• Can generate payment links.
• Can create or manage bookings on the user's behalf.
• Hands the conversation off to a member of staff when it cannot resolve the request or when the user asks to (see section 7).

In-app Assistants. They are chat assistants inside the Lueira management application. Among other functions:

• They answer questions about how to use Lueira from Lueira's help guides and videos, and point the user to the right screen.
• They run read-only checks of the customer account's configuration, with the user's own permissions, when the user asks them to.
• They read the images and PDF files that the user attaches (for example, a price list or a product sheet) in order to answer about them.
• Where this function is enabled for the customer's account, they can propose creating or changing catalogue data (products and prices, packages, extras) and orders (for example, adding a comment or assigning a customer) based on what the user asks or attaches. Nothing is created or changed until the user reviews the proposal, can edit it, and confirms it. Changes are applied with the user's own permissions and are recorded in Lueira's audit log as made by the AI assistant on behalf of that user. Products that are created stay hidden from the online store until the customer reviews and publishes them.
• They refer the user to the Lueira team when the user asks or when they cannot resolve the request.

The In-app Assistants cannot delete data, confirm, complete or cancel orders, or send messages to third parties on their own.

None of the systems described does the following:

• They do not make medical, legal or safety-critical decisions about people.
• They do not perform biometric identification or emotion recognition.
• They do not analyze voice for biometric identification purposes: voice notes received via WhatsApp are only transcribed to text so the enquiry can be processed.

4. The right to information under article 50 of the AI Act

Article 50 of the AI Act recognizes the right to know that you are interacting with an artificial intelligence system. The AI Assistant identifies itself as an artificial intelligence assistant at the start of the conversation, both on WhatsApp and in the web chat widget, and confirms it whenever it is asked whether it is a person.

The In-app Assistants display, next to the field where the user types and throughout the conversation, a notice that the user is talking to an artificial intelligence and not to a person, and introduce themselves as such in the welcome message. When an assistant proposes changes, the proposal states that it was generated by an AI on the user's behalf and that it must be reviewed before it is confirmed.

This right to information is distinct from the right not to be subject to automated decisions with significant effects without human intervention, already regulated under the GDPR in section 9 of the Terms and Conditions and in section 6 of the Privacy Policy. Both rights are complementary and coexist.

5. Marking and detection of AI-generated content

Article 50(2) of the AI Act requires providers of generative AI systems to mark the content they generate in a machine-readable format and to ensure it can be detected as AI-generated, using technical solutions that are effective, interoperable, robust and reliable as far as technically feasible.

Lueira currently applies the following measures to the text generated by the In-app Assistants:

• Each generated message carries a digitally signed, time-stamped provenance record, which is kept with the message in the conversation and can be verified with Lueira's public key.
• Lueira keeps, for a limited period of 365 days, a fingerprint (hash) of each generated text. The fingerprint does not include the text or any customer or user data, and makes it possible to check whether a specific text was generated by a Lueira assistant.
• Anyone can check whether a text was generated by a Lueira assistant, and obtain the public verification key, through the public verification service: https://assistant.lueira.com/ai/provenance/verify (POST method, with the text in the "text" field) and https://assistant.lueira.com/ai/provenance/keys. The answer is given as a readable sentence.

A fingerprint only identifies an identical text (apart from spaces and line breaks): a text that is not in the record is not proof that a person wrote it, and a rewritten or paraphrased text may not be detected.

In line with the European Commission's guidelines on article 50, the extraction and structuring of data from documents without summarising them, translations and standard editing corrections, and very short outputs are outside this marking. Lueira periodically reviews the scope and the marking techniques, including the watermarks of the model providers, as the state of the art evolves.

6. Risk classification of the systems

Neither the AI Assistant nor the In-app Assistants are a prohibited practice under article 5 of the AI Act: they do not perform subliminal manipulation, social scoring, or biometric categorization of people.

Nor are they high-risk systems under Annex III of the AI Act: they are not used for employment or recruitment decisions, creditworthiness assessment, biometric identification, management of critical infrastructure, education or academic assessment, or for access to essential services within the meaning of Annex III. Managing bookings for leisure and active tourism activities, or administering a product catalogue, does not fall within any of the high-risk cases listed in that annex.

Accordingly, these systems are subject to the transparency obligations under article 50 ("limited risk" systems), which are met by informing people that they are interacting with an artificial intelligence (section 4) and by the marking and detection of the generated content (section 5). The human oversight described below is an additional safeguard.

7. Human oversight

The user has the right to request the intervention of a person at any time, as described in section 9 of the Terms and Conditions and in section 6 of the Privacy Policy.

In the In-app Assistants, no change is applied unless the user has reviewed and expressly confirmed it, and the user can edit or discard the proposal. Applied changes are identified in the audit log. Deleting data and confirming, completing or cancelling orders are always manual actions.

8. AI infrastructure providers

Lueira's AI systems run on general-purpose artificial intelligence models provided by specialized external providers. In the current configuration, the AI Assistant uses OpenAI (responses from the specialist sub-agents, the safety guardrail against manipulation of the assistant, voice-note transcription, and knowledge-base search) and OpenRouter (the model used by the supervisor agent that composes the final reply), and the In-app Assistants use models from OpenAI, Google and/or Anthropic, depending on the assistant and the configuration. Lueira may change these providers over time to optimize the performance of the systems; the up-to-date list of sub-processors that process personal data through them is available in the Data Processing Agreement (DPA).

9. Lueira does not train its own models with customer data

As detailed in section 5 of the Privacy Policy, Lueira does not use its customers' data to train its own artificial intelligence models.

10. The assistants' knowledge base

The AI Assistant answers using the help content published by each Lueira customer, not generic internet content. This means responses are grounded in the information the customer itself has made available to the assistant.

The In-app Assistants answer from Lueira's help guides and videos, not from generic internet content, and the customer account data they access is what the user can see with their own permissions.

11. Limitations of the systems

The AI Assistant includes safeguards to prevent incorrect commitments (for example, confirming a booking or payment that has not actually been made), but, like any artificial intelligence system, it may occasionally produce inaccurate responses. We recommend always verifying booking or payment confirmations through the corresponding official channel.

The In-app Assistants can also make mistakes, for example when reading an attached document or interpreting a price. That is why they show their proposals for the user to review before applying them, and we recommend always checking the amounts, taxes and texts that will be shown to end customers.

12. Processing of personal data

The processing of personal data arising from the use of the AI Assistant and the In-app Assistants is governed by Lueira's Privacy Policy.

Files that the user attaches to an In-app Assistant (images or PDFs) are sent to the model provider so that it can read them. We recommend not attaching personal data that is not necessary.

13. Restrictions on the public API, MCP and similar functionality

Access to LUEIRA's public API, its MCP (Model Context Protocol) server, or any other feature, tool or integration offered by LUEIRA does not grant the user any right to use such access to replicate, clone, recreate or develop, whether directly or through third parties, products or services that reproduce or are substantially similar to LUEIRA, to its functionality, whether past, present or future, or to its distinctive elements. Any use of LUEIRA's public API, MCP server or any other functionality for the direct or indirect purpose of building a competing or functionally equivalent solution to LUEIRA is expressly prohibited.

Breach of this clause will entitle LUEIRA to immediately suspend or cancel the infringing user's access to the API, the MCP server and the remaining services, without prejudice to any legal action LUEIRA may be entitled to take.

14. Changes to this policy

Lueira may update this policy to adapt it to regulatory or case-law changes, or changes to how the AI systems described here work. When changes are significant, we will notify you through a notice on the platform or by email at least 30 days in advance.

We recommend that you review this policy periodically. The date of the last update always appears at the bottom of this page.

15. Contact

For any query about how the AI Assistant or the In-app Assistants work, you may contact us through:

• Email: support@lueira.com
• Email (data protection): rgpd@maladetastudio.com