1. Data controller
Basis Technologies S.L. (“basis”), with registered address at Carrer de Pallars 108, 08018 Barcelona (España) and tax ID B-12345678, is the controller of your personal data. You can reach our data protection officer at dpo@example.invalid.
2. Data we process
- Account: name, email, phone, company and role.
- Service use: projects, budgets, certifications, calendar, contacts and the documents you enter or dictate.
- Voice and messages: voice notes, calls to the agent and connected messages (e.g. WhatsApp or email), together with their transcriptions.
- Billing: tax and payment details (full card data is held by our payment provider; it never reaches our servers).
- Technical: access logs, device data and the cookie data described in the cookie policy.
3. Purposes and legal basis
| Purpose | Legal basis |
|---|---|
| Providing the service: transcribing, budgeting, certifying and organising your project | Performance of the contract (Art. 6.1.b GDPR) |
| Subscription billing | Legal obligation and contract |
| Improving the product with aggregated metrics | Legitimate interest (Art. 6.1.f) |
| Commercial communications about basis | Consent (revocable at any time) |
4. Voice and artificial intelligence data
Voice notes are transcribed to carry out your instructions. The original audio is kept for 30 days so you can review it and is then deleted; the transcriptions remain attached to your project as part of your documentation.
5. Who we share data with
Only with processors necessary to operate: EU hosting (Frankfurt and Madrid), our payment provider, our messaging provider and transcription and AI providers. All under Art. 28 GDPR contracts. We do not sell data. Ever.
6. Retention
- Your account and project data: for as long as the subscription is active.
- After cancellation: 30 days for you to export; then permanent deletion.
- Invoices: for the periods required by tax law (usually 6 years).
7. Your rights
You can exercise access, rectification, erasure, objection, restriction and portability by writing to dpo@example.invalid. We reply within a maximum of 30 days. You may also lodge a complaint with the Spanish Data Protection Agency (aepd.es).
8. Security
We encrypt data at rest (AES-256) and in transit (TLS 1.3), and apply role-based access control, audit logging and daily backups. The whole team signs confidentiality agreements and accesses only what is essential.
9. Changes to this policy
If we change anything significant, we will notify you by email and inside the platform at least 15 days in advance. The current version is always published on this page.