Privacy policy: Your privacy, made clear.

For the website, beta requests, accounts, security, support and billing, the controller is Marcos Gonzalez, a self-employed individual trading under the name Baruxa, Av. Víctor Gallego 4, Zamora, España. Contact for privacy and rights: [email protected]. No data protection officer has been appointed, without prejudice to reviewing whether such an appointment is mandatory.

When a customer company brings in data about its customers, buyers, employees, suppliers or other contacts, that company usually determines the purpose and is the controller. Baruxa acts as processor to host, query, transform and display that data, following documented instructions and a data processing agreement. Requests concerning that data must be addressed to the customer; Baruxa will assist it in accordance with the agreement. Baruxa is an independent controller for accounts, billing, security, support and its own communications. This allocation depends on the actual activity and does not replace the analysis required by the General Data Protection Regulation (GDPR).

1. 01
   Beta list: email, plan, language, consent to be contacted and status; to confirm and manage the request, send the launch notice requested and process unsubscriptions. Unsubscribing deletes or anonymises the request. No newsletters are sent without separate authorisation.
2. 02
   Account: name, email, protected credential, company, country, plan, acceptance of the terms and confirmation of legal age; to create the account, verify the email address, and provide and protect the service.
3. 03
   Payment: plan, amount, subscription status and transaction references; Stripe processes the payment and Baruxa does not need to store the full card number.
4. 04
   Support and security: messages and technical events to deal with incidents, protect accounts, prevent fraud and provide evidence of relevant actions.
5. 05
   Customer data: the data from the sources the customer connects (orders, payments, invoices, inventory, campaigns, CRM and similar), the calculated metrics, the recorded decisions and actions, and the documents it uploads; to provide the service on the customer’s instructions.
6. 06
   Aggregated improvement (optional): if the administrator accepts, Baruxa may use aggregated and anonymised data to improve the service and for benchmarking. Acceptance is not a requirement for opening an account. It does not replace the customer’s legal basis for the source personal data, nor does it authorise the disclosure of identifiable data.
7. 07
   Web analytics: pages viewed, where the visit came from, language, device and browser type, approximate location (country or city) and browsing events, through Google Analytics 4; to measure traffic and improve the website. If you accept the optional cookies, this data is associated with a pseudonymous identifier stored in cookies. If you do not accept them, no analytics cookie is stored or read: only technical pings without cookies or identifiers are sent to Google, which Google uses to estimate traffic in aggregate. According to Google, Google Analytics 4 does not log or store IP addresses. We do not use analytics for advertising or profiling: advertising permissions are always denied.

Account and payment data are processed to take pre-contractual measures and to perform the contract; billing data, to comply with a legal obligation; security and the defence of rights, on the basis of an assessed legitimate interest; the waitlist, on the basis of the request/consent to be contacted, which you can withdraw using the unsubscribe link; aggregated use, on the basis of the optional acceptance; analytics with cookies, on the basis of your consent, which you can withdraw at any time, and the cookieless pings, on the basis of a legitimate interest in understanding, in aggregate, how the website is used, to which you can object by writing to us. Non-essential cookies are only activated with prior consent.

AI is optional and no-AI mode is the default: in that mode, no data is sent to model providers. If the customer activates Copilot, only the data necessary for each task is sent to the chosen model provider through Baruxa’s gateway, which may pseudonymise or filter personal data before sending it; in Enterprise, a model hosted within the customer’s perimeter may be used. External agents that the customer connects through the MCP server access only the data and actions that the customer authorises, and what such an agent does with the data is governed by the relationship between the customer and its provider. Do not include special categories of data, such as health data, without a basis under Article 9 of the GDPR and appropriate safeguards. Model providers that may access data appear in the list of sub-processors, which the customer may request.

We use the necessary hosting, email, payment, security and support providers, which are subject to contractual obligations. Stripe is involved in the payment and the subscription. Google Ireland Limited provides the web analytics as a processor, under Google’s data processing terms; Google LLC, in the United States, may access that data, and that transfer is covered by the EU-U.S. Data Privacy Framework, under which Google LLC is certified, and by the European Commission’s standard contractual clauses. Users authorised by the customer may view the data the customer brings in. If a provider processes data outside the EEA, the safeguards and transfer mechanisms required by the GDPR will apply. The customer may request the current list of sub-processors and locations through the privacy contact.

When you consent to optional behavior analytics, Contentsquare/Hotjar also processes site interaction and possible session-replay data for us. See the Contentsquare Privacy Center for its current privacy information.

Waitlist data is kept until you unsubscribe or until the purpose of announcing the launch has ended, unless claims are pending. Account data is kept for as long as the account remains active; when it is closed, the data is deleted or returned in accordance with the instructions and the agreement, except for data needed for tax/accounting obligations, the defence of claims or technical backup cycles. Customer data is retained in accordance with the customer’s instructions and the agreed schedule. Analytics data is kept in Google Analytics for a maximum of 14 months and then deleted; analytics cookies expire after 2 years or when you delete them.

You may exercise the rights of access, rectification, erasure, objection, restriction and portability where applicable, and withdraw your consent without retroactive effect. Write to [email protected]; we may ask for reasonable information to verify your identity. You may also lodge a complaint with the Spanish Data Protection Agency. Where we act as processor, we will forward the request to the customer that is the controller or tell you how to contact it.

We apply reasonable access, logging, protection and continuity measures proportionate to the risk. Where we act as processor, we will notify the customer of breaches in accordance with the agreement. A company that configures a workflow with rules or agents must assess whether it affects individuals, whether it is solely automated, and what information, human intervention, objection and impact assessment the law requires. Specific uses of AI must be assessed to determine the applicable obligations and safeguards.

Necessary. We store in your browser only what is essential for the website to work: your cookie choice, your language (the baruxa_lang cookie, which lasts one year and is only set if you choose a language) and, for five minutes, the result of confirming your place on the list. These do not require consent.

Analytics (optional). Only if you click ‘Accept all’ does Google Analytics set _ga, which distinguishes visitors, and _ga_HX2DX27Q8L, which keeps the state of the visit; both expire after 2 years. If you decline, they are not set. We do not use advertising cookies. More information on how Google uses this data at policies.google.com.

Contentsquare/Hotjar (optional). We load this behavior analytics tag only after “Accept all”. It may use first-party cookies (including _cs_id and _cs_s) to measure interactions and, if enabled for this project, session replays. It does not load if you reject. See the Contentsquare Privacy Center.

You can change or withdraw your choice at any time from ‘Cookie settings’, in the footer of the home page, or by clearing the site data in your browser. Fonts are served from the site itself, so that the browser does not request the files from Google Fonts or transmit your IP address to it in order to load them. External links are governed by the third party’s policy.

We will publish changes here with the updated date. We will give notice of material changes through the appropriate channel and request fresh consent where necessary.