Privacy Policy
Last updated: March 2026
Introduction
SOA Concierge ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services.
We comply with the EU General Data Protection Regulation (GDPR), Spanish data protection laws, and other applicable privacy regulations. Please read this Privacy Policy carefully. If you do not agree with our policies and practices, please do not use our Service.
1. Data Controller
The data controller responsible for your personal data is:
Bernat Vidal
Email: bvidal@borbalan.com
Location: Palma de Mallorca, Spain
2. Information We Collect
2.1 Information You Provide Directly
- Account Information: Email address, name, and password when you create an account
- Chat Messages: All conversation history and messages you send to our AI concierge
- Communication: Messages you send us via support email or contact forms
2.2 Automatically Collected Information
- Usage Data: How often you use the Service, which features you access, and how long you spend on each page
- Device Information: Device type, operating system, browser type, and IP address
- Log Data: Date, time, pages visited, and errors encountered
- Cookies: Session cookies to maintain your login and preferences
3. Legal Basis and How We Use Your Data
We process your personal data for the following purposes:
| Purpose | Legal Basis |
|---|---|
| Provide and maintain the Service | Contract performance (necessary to provide the Service) |
| Process payments and manage subscriptions | Contract performance & Legal obligation |
| Improve our AI models and Service quality | Legitimate interest (service improvement) |
| Send administrative communications | Contract performance & Legal obligation |
| Detect and prevent fraud | Legal obligation & Legitimate interest |
| Comply with legal obligations | Legal obligation |
4. Third-Party Data Sharing
We share your data with the following third parties:
Stripe (Payment Processor)
We share your email address and subscription information with Stripe to process payments. Stripe is certified under Privacy Shield and complies with GDPR.
Anthropic (Claude AI API)
Your chat messages are sent to Anthropic's Claude API to generate recommendations. Anthropic processes this data according to their privacy policy and does not use chat messages for training without consent.
Legal Requirements
We may disclose your information if required by law, such as in response to a court order, government agency, or to protect our legal rights.
5. Data Retention Period
We retain your personal data as follows:
- Chat Sessions: Retained for 90 days after the last message, then automatically deleted
- Account Data: Retained for the duration of your account, or up to 30 days after you request account deletion
- Payment Records: Retained for 7 years for tax and legal compliance purposes
- Log Data: Retained for 30 days, then automatically deleted
6. Your Privacy Rights (GDPR)
Under GDPR, you have the following rights:
- Right to Access: Request a copy of all personal data we hold about you
- Right to Rectification: Request correction of inaccurate data
- Right to Erasure: Request deletion of your personal data (with exceptions for legal obligations)
- Right to Restrict Processing: Request that we stop processing your data
- Right to Data Portability: Request your data in a structured, machine-readable format
- Right to Object: Object to processing of your data for certain purposes
To exercise any of these rights, contact us at bvidal@borbalan.com. We will respond within 30 days.
7. Account Deletion Process
You can request account deletion from your account settings or by emailing bvidal@borbalan.com. When you request deletion:
- Your account is immediately deactivated
- A 30-day grace period begins during which you can reactivate your account
- After 30 days, all chat history and personal data are permanently deleted
- Payment records are retained for 7 years for tax purposes
8. Cookies and Tracking
We use cookies only for essential functionality:
- Session Cookies: Required to keep you logged in
- CSRF Tokens: Required to protect against security attacks
We do NOT use tracking cookies, analytics pixels, or any third-party advertising services.
9. Data Security
We implement industry-standard security measures to protect your data:
- HTTPS encryption for all data transmission
- Password hashing using bcrypt
- Prepared statements to prevent SQL injection
- Regular security updates and patches
- CSRF protection for form submissions
However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.
10. Children's Privacy
Our Service is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us immediately at bvidal@borbalan.com.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Changes will be effective immediately upon posting. Your continued use of the Service constitutes acceptance of the updated Privacy Policy.
12. Contact Us
If you have questions about this Privacy Policy or our privacy practices, please contact us at:
Data Protection Officer:
Email: bvidal@borbalan.com
Location: Palma de Mallorca, Spain
If you believe your privacy has been violated, you also have the right to lodge a complaint with your local data protection authority.