Privacy Policy

Introduction

This policy describes how BAI Business processes personal data received through this website and the associated forms and emails.

Data controller

• Owner: Héctor Redondo Salgado
• Tax ID (NIF / intra-EU VAT): ES45579222F
• Address: Calle de la Solana de Opañel, 16, Madrid, Spain
• Contact: info@baibusiness.com

What data we process

If you email us, submit the contact form or book a strategic call, we process the data you provide directly: name, email, organization, phone (if supplied), preferred communication channel, and any message content. The other forms on the site collect only what they ask for: your email, and sometimes your company name, for the newsletter, the calculator and the guide download; your name and your email or phone for the pre-call checklist; and your name, your email (optional, not published) and your comment for blog comments. A comment is published with your name and its text after review; if you want us to remove it, write to info@baibusiness.com. If you accept all cookies, we also measure the use of the site with Google Tag Manager and Google Analytics (see the cookie policy). We do not collect data through any other means on the public site.

The forms on this site (blog comments, information request, call booking, newsletter, calculator, guide download and pre-call checklist) are protected with Cloudflare Turnstile, which tells people from automated programs. It loads the first time you touch a form, not when you only read a page. At that moment your browser connects to Cloudflare (challenges.cloudflare.com) and sends it your IP address, your browser's TLS fingerprint, its User-Agent header and this site's key and origin. Cloudflare does not receive what you type into the form. When you send the form, our server sends your request to the BAI platform, which limits how many submissions it accepts each minute across the whole site (not per visitor), and the platform checks the Turnstile result with Cloudflare, to which it sends the IP address from which it receives the request, which is our server's and not yours.

Purpose

We use this data solely to reply to you, coordinate the 30-minute strategic call, send any documentation you request (for example the operational-friction diagnostic), and, if you have explicitly subscribed, send the BAI editorial newsletter on a weekly cadence. We do not sell personal data or share it with third parties for their own purposes. The processors listed in this policy act on behalf of BAI, except Cloudflare: besides providing the form protection service, it uses the Turnstile signals to improve its own bot detection, as controller of that processing (see "Data processors"). We use Turnstile and the submission counter only to protect the forms against abuse.

Legal basis

Processing is based on your explicit consent (Article 6.1.a GDPR) when you request information, book a call, subscribe, or post a comment, and on the legitimate interest of the data controller when we reply to communications you initiate.

Protecting the forms with Turnstile and the per-minute submission limit rest on the controller's legitimate interest in the security of the site and in preventing abuse (Article 6(1)(f) GDPR).

Retention

We retain data while you maintain an active relationship with BAI (subscription, call, customer) and for up to two years after the last contact. When that period ends, or when you ask us to delete your data, we do not keep it in a form that identifies you: we replace your personal data with values that identify no one and keep only the structure of the record (for example, that a booking or a conversation took place). If you unsubscribe from the newsletter or tell us you do not want to be contacted, we stop writing to you and keep only what is needed to respect that choice: a one-way fingerprint of your email address, used only to check that we do not write to you again (Article 21(3) GDPR; Article 23(1) of Spanish Organic Law 3/2018 allows this processing). The process is described in data deletion.

Your rights

You may exercise your rights of access, rectification, deletion, opposition, restriction of processing, and portability at any time by writing to info@baibusiness.com. You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos), the supervisory authority for this site.

Requests from public authorities

If a public authority asks us for personal data, we check that the request is lawful and that the authority is competent before we disclose anything. We challenge a request that has no legal basis, that comes from an authority outside the European Union without an international agreement that allows it, or that asks for more than is necessary. We disclose only the data the request requires. We keep a written record of each request, of our response and of the legal reasoning. Where we act on behalf of a business that connected its channels, we tell that business before disclosing, unless the law forbids it.

Data processors

For transactional emails we use Resend (Resend Inc.) as our delivery provider, under Resend's data processing addendum, which forms part of its terms of service. The site and the platform are hosted on IONOS servers in Spain that BAI Business operates. To measure use of the website we use Google Tag Manager and Google Analytics (Google LLC), only if you accept all cookies (consent, Article 6.1.a GDPR, which you can withdraw at any time from "Cookie settings" in the footer). Nothing is sent to Google before you accept. If you accept, Google receives your IP address and technical data about the visit and processes them in the United States under the EU-US Data Privacy Framework; the detail is in the cookie policy. The processors of the platform's Meta-channel data are listed in the next section.

Artificial intelligence provider. The platform's AI features send text to Google LLC through the Gemini API, which acts as our sub-processor. For some requests our routing policy uses Anthropic (Claude API) instead; its terms are in the Meta-channels section below. The AI is used for: the receptionist, which answers the people who write to a business through its website chat or its connected channels; the conversation the receptionist holds with a client in the client portal, including the onboarding interview; and the platform's assistants, which help a business's team with its own data (for example suggested replies, summaries, translations and searches in its knowledge base).

What is sent: what the person writes in the conversation, the earlier messages needed to answer, the fragments of the business's own knowledge base that are relevant to the question, and the documents that a business uploads so that the platform reads them (for example to create a template). In receptionist and assistant conversations, email addresses, phone numbers, payment card numbers, bank account numbers (IBAN) and Spanish ID numbers (DNI/NIE) are masked before the text is sent; other personal data a person writes in a message, such as a name or an address, is not masked.

Under the paid Gemini API terms, Google does not use prompts or responses to improve its products and keeps logs only for a limited period, to detect and prevent abuse. Google may process the data in any country where it or its sub-processors keep facilities, including the United States. The transfer relies on Google LLC's certification under the EU-U.S. Data Privacy Framework and, where that does not apply, on the standard contractual clauses of Google's data processing addendum.

When BAI Business provides its platform to a client company (for example by hosting its website, CRM or chat), it acts as data processor on behalf of that company, which is the controller of the data of its own visitors and customers. It does so only on that company's instructions and under a data processing agreement under Article 28 GDPR, which sets the subject matter and duration of the processing, the data and the people concerned, the security measures, the authorised sub-processors and the return or deletion of the data at the end.

To protect the forms we use Cloudflare Turnstile (Cloudflare, Inc.). Cloudflare processes, as processor on behalf of BAI, the signals needed to provide the service and, as controller, those it uses to improve its bot detection, as stated in its Turnstile privacy addendum. It may process them in the United States; Cloudflare relies on its EU-U.S. Data Privacy Framework certification and, if that stops being valid, on standard contractual clauses (Cloudflare's GDPR information). Unlike Google, Cloudflare is contacted even if you chose "Only necessary", because it is a security measure of the form and not a measurement tool; it only happens if you touch a form.

Data received from Facebook, Instagram and WhatsApp (Meta channels)

This section applies to businesses that use the BAI Business platform (app.baibusiness.com) and connect their own Facebook Page (Messenger), Instagram professional account or WhatsApp Business account, and to the people who write to those businesses through those channels. It covers the platform, not the public website. The processors it lists act only on our behalf.

What we receive

• From the business, when it connects a channel: the identifiers of its Page, Instagram account (id and username) and WhatsApp Business account, and the access tokens Meta issues for them. Tokens are stored encrypted and are never shown in the interface.
• From Meta, when a person messages the business: the text of the message, the sender's identifier in that channel (a Page-scoped or Instagram-scoped id, or the sender's phone number on WhatsApp) and the time of the message.

Why we use it

BAI acts on behalf of the business that connected the channel. We show each message in that business's inbox, let the business's AI receptionist answer it inside the messaging window Meta allows, hand the conversation to a human when needed, and, when the person asks for it, create a booking or a contact record for that business. A business can also publish its own product content to its own Page or Instagram account; that does not read data about its followers. The receptionist is the business's own front-desk assistant, configured by that business; BAI does not offer it as a general-purpose AI assistant. We do not use this data for advertising, profiling or sale, and we do not combine it across businesses: every workspace sees only its own data.

Who processes it for us

• IONOS: hosting of the platform and its database (data centre in Spain), under the data processing agreement that forms part of its general terms and conditions.
• Google (Gemini API) and Anthropic (Claude API): artificial intelligence providers that generate the receptionist's reply; our routing policy decides which one answers a given request. Email addresses, phone numbers, payment card numbers, bank account numbers (IBAN) and Spanish ID numbers (DNI/NIE) are masked before the text is sent. Other personal data a person writes in a message, such as a name or an address, is not masked.
• Under their terms they may process it in any country where they keep facilities; each provider acts under its data processing terms (Google, for the paid Gemini API: data processing addendum; Anthropic: data processing addendum, which forms part of its commercial terms).
• Resend: email delivery of the notification the business operator receives when a conversation is handed to a human, which contains a masked summary.
• Self-hosted secrets vault, on our own servers: storage of our application credentials. It receives no message content.

How long we keep it

Message content follows the Retention section above. A person or a business can ask for earlier deletion at any time.

Deleting your data

If you wrote to a business that uses BAI Business, write to info@baibusiness.com or use the self-service form described in data deletion. If you connected your own Facebook Page or Instagram account to BAI Business with Facebook or Instagram Login, you can also remove BAI Business in your Facebook or Instagram app settings and ask Meta to delete your data: Meta then notifies our data deletion callback, we disconnect the Pages and Instagram accounts you connected, we remove the access tokens we stored for them, and we return a confirmation code and a status link. Conversations you had with a business's Page are held by that business and are not part of that request: where the business offers it, its chat lets you withdraw your consent or request erasure; otherwise write to us as described above.

Automated decisions

When you use the authenticated platform at app.baibusiness.com, the system may perform AI-assisted processing (lead classification, suggested replies). You have the right to request human review of any significant decision made through automated processing. The AI providers that process this data, what is sent to them and the safeguards for the international transfer are described under "Data processors".