Privacy Policy

Introduction

This policy describes how BAI Business processes personal data received through this website and the associated forms and emails.

Data controller

• Owner: Héctor Redondo Salgado
• Tax ID (NIF / intra-EU VAT): ES45579222F
• Address: Calle de la Solana de Opañel, 16, Madrid, Spain
• Contact: info@baibusiness.com

What data we process

If you email us, submit the contact form or book a strategic call, we process the data you provide directly: name, email, organization, phone (if supplied), preferred communication channel, and any message content. We do not collect data through any other means on the public site.

Purpose

We use this data solely to reply to you, coordinate the 25-minute strategic call, send any documentation you request (for example the operational-friction diagnostic), and, if you have explicitly subscribed, send the BAI editorial newsletter on a weekly cadence. We do not sell personal data or share it with third parties for their own purposes; the processors listed in this policy act only on our behalf.

Legal basis

Processing is based on your explicit consent (Article 6.1.a GDPR) when you request information, book a call, or subscribe, and on the legitimate interest of the data controller when we reply to communications you initiate.

Retention

We retain data while you maintain an active relationship with BAI (subscription, call, customer) and for up to two years after the last contact. When that period ends, or when you ask us to delete your data, we do not keep it in a form that identifies you: we replace your personal data with values that identify no one and keep only the structure of the record (for example, that a booking or a conversation took place). If you unsubscribe from the newsletter or tell us you do not want to be contacted, we stop writing to you and keep only what is needed to respect that choice: a one-way fingerprint of your email address, used only to check that we do not write to you again (Article 21(3) GDPR; Article 23(1) of Spanish Organic Law 3/2018 allows this processing). The process is described in data deletion.

Your rights

You may exercise your rights of access, rectification, deletion, opposition, restriction of processing, and portability at any time by writing to info@baibusiness.com. You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos), the supervisory authority for this site.

Requests from public authorities

If a public authority asks us for personal data, we check that the request is lawful and that the authority is competent before we disclose anything. We challenge a request that has no legal basis, that comes from an authority outside the European Union without an international agreement that allows it, or that asks for more than is necessary. We disclose only the data the request requires. We keep a written record of each request, of our response and of the legal reasoning. Where we act on behalf of a business that connected its channels, we tell that business before disclosing, unless the law forbids it.

Data processors

For transactional emails we use Resend (Resend Inc.) as our delivery provider, under Resend's data processing addendum, which forms part of its terms of service. The site and the platform are hosted on IONOS servers in Spain that BAI Business operates. To measure use of the website we use Google Tag Manager and Google Analytics (Google LLC), only if you accept all cookies (consent, Article 6.1.a GDPR, which you can withdraw at any time from "Cookie settings" in the footer). Nothing is sent to Google before you accept. If you accept, Google receives your IP address and technical data about the visit and processes them in the United States under the EU-US Data Privacy Framework; the detail is in the cookie policy. The processors of the platform's Meta-channel data are listed in the next section.

When BAI Business provides its platform to a client company (for example by hosting its website, CRM or chat), it acts as data processor on behalf of that company, which is the controller of the data of its own visitors and customers. It does so only on that company's instructions and under a data processing agreement under Article 28 GDPR, which sets the subject matter and duration of the processing, the data and the people concerned, the security measures, the authorised sub-processors and the return or deletion of the data at the end.

Data received from Facebook, Instagram and WhatsApp (Meta channels)

This section applies to businesses that use the BAI Business platform (app.baibusiness.com) and connect their own Facebook Page (Messenger), Instagram professional account or WhatsApp Business account, and to the people who write to those businesses through those channels. It covers the platform, not the public website. The processors it lists act only on our behalf.

What we receive

• From the business, when it connects a channel: the identifiers of its Page, Instagram account (id and username) and WhatsApp Business account, and the access tokens Meta issues for them. Tokens are stored encrypted and are never shown in the interface.
• From Meta, when a person messages the business: the text of the message, the sender's identifier in that channel (a Page-scoped or Instagram-scoped id, or the sender's phone number on WhatsApp) and the time of the message.

Why we use it

BAI acts on behalf of the business that connected the channel. We show each message in that business's inbox, let the business's AI receptionist answer it inside the messaging window Meta allows, hand the conversation to a human when needed, and, when the person asks for it, create a booking or a contact record for that business. A business can also publish its own product content to its own Page or Instagram account; that does not read data about its followers. The receptionist is the business's own front-desk assistant, configured by that business; BAI does not offer it as a general-purpose AI assistant. We do not use this data for advertising, profiling or sale, and we do not combine it across businesses: every workspace sees only its own data.

Who processes it for us

• IONOS: hosting of the platform and its database (data centre in Spain), under the data processing agreement that forms part of its general terms and conditions.
• Google (Gemini API) and Anthropic (Claude API): artificial intelligence providers that generate the receptionist's reply; our routing policy decides which one answers a given request. Email addresses, phone numbers, payment card numbers, bank account numbers (IBAN) and Spanish ID numbers (DNI/NIE) are masked before the text is sent. Other personal data a person writes in a message, such as a name or an address, is not masked.
• Under their terms they may process it in any country where they keep facilities; each provider acts under its data processing terms (Google, for the paid Gemini API: data processing addendum; Anthropic: data processing addendum, which forms part of its commercial terms).
• Resend: email delivery of the notification the business operator receives when a conversation is handed to a human, which contains a masked summary.
• Self-hosted secrets vault, on our own servers: storage of our application credentials. It receives no message content.

How long we keep it

Message content follows the Retention section above. A person or a business can ask for earlier deletion at any time.

Deleting your data

If you wrote to a business that uses BAI Business, write to info@baibusiness.com or use the self-service form described in data deletion. If you connected your own Facebook Page or Instagram account to BAI Business with Facebook or Instagram Login, you can also remove BAI Business in your Facebook or Instagram app settings and ask Meta to delete your data: Meta then notifies our data deletion callback, we disconnect the Pages and Instagram accounts you connected, we remove the access tokens we stored for them, and we return a confirmation code and a status link. Conversations you had with a business's Page are held by that business and are not part of that request: where the business offers it, its chat lets you withdraw your consent or request erasure; otherwise write to us as described above.

Automated decisions

When you use the authenticated platform at app.baibusiness.com, the system may perform AI-assisted processing (lead classification, suggested replies). You have the right to request human review of any significant decision made through automated processing.