Privacy policy

In accordance with the General Data Protection Regulation (EU GDPR 2016/679) and Spanish Organic Law 3/2018 (LOPDGDD), details of the data controller are set out below:

• Trade name: Bitora
• Data controller: Javier Galiana Hernández (self-employed natural person / autónomo)
• Tax ID (NIF): 48736704A
• Registered location / Address: Urbanización Benfis Park, Calle 6, 7ñ, 03316 Benferri (Alicante), España
• Contact phone: +34 644 98 11 69
• Privacy & Contact email: support@bitora.es
• Legal details: You can review complete ownership and company details in our Legal Notice.

Bitora acts as Data Controller for web inquiries, technical support, user accounts in Bitora Business Manager (BBM), and service invoicing; and as Data Processor in custom software projects when processing data on behalf of clients under contract.

We process personal data for the following purposes and legal bases (Art. 6 GDPR):

• Inquiries and free process diagnostic: Responding to messages and preparing tailored automation proposals (pre-contractual steps at your request, Art. 6.1.b GDPR). Operational insights shared in diagnostic requests are handled with strict professional secrecy.
• AI Virtual Assistant (Bix Chat): Serving real-time user inquiries and assisting navigation via Bix (legitimate interest and pre-contractual customer care, Arts. 6.1.f and 6.1.b GDPR).
• SaaS Platform (BBM): User account administration, security authentication, and service execution (contractual execution, Art. 6.1.b GDPR).
• Billing and payments: Processing recurring subscriptions via Stripe Payments Europe, Ltd. and fulfilling statutory accounting and tax duties (contract execution and legal obligation, Arts. 6.1.b and 6.1.c GDPR).
• Commercial communications and educational blog articles: Sending technology and AI insights only when users explicitly opt-in (express consent, Art. 6.1.a GDPR, revocable at any time).
• First-party web analytics: Aggregated measurement of visits and sources only upon prior user consent in the cookie banner (Art. 6.1.a GDPR).

Infrastructure and Technology Partners (Data Processors)

Our core services rely on trusted service providers operating under Data Processing Agreements (Art. 28 GDPR):

• Primary hosting and servers: Contabo GmbH (Germany / European Union), ensuring that databases and central servers reside inside the European Economic Area (EEA) with encryption at rest and in transit (AES-256 / TLS).
• Transactional email delivery: European-hosted transactional email service (`contact-api` / JetEmail) for instantaneous form submissions.
• Payment gateway: Stripe Payments Europe, Ltd. (Ireland / EU) with certified Level 1 PCI-DSS compliance.

In accordance with Article 50 of the EU Artificial Intelligence Act (Regulation EU 2024/1689) on transparency obligations for AI systems interacting with natural persons, users are hereby informed:

• Automated nature: The «Bix» assistant on our website is an automated artificial intelligence system, not a human operator.
• AI API Providers: Bix queries are processed using the enterprise API services of OpenAI (OpenAI Ireland Ltd. / OpenAI, LLC) and Google Gemini (Google Ireland Ltd. / Google LLC).
• Anonymous storage and no human review: Chat logs stored by Bitora are strictly anonymized and dissociated from user identities or IP addresses. Conversations are not subjected to manual review or human monitoring.
• No model training guarantee: Under commercial enterprise API terms with OpenAI and Google Gemini, prompt inputs and conversational data submitted to Bix are NEVER used to train, fine-tune, or improve public foundation models.
• Sensitive data warning: Bix is designed for informational purposes. Users must not share passwords, financial credentials, or special categories of personal data (health, political views, biometrics).

We retain personal data strictly for statutory periods:

• Invoicing and tax records: 5 years pursuant to commercial and tax statutory periods.
• Security logs: 90 days for technical audit trails and threat prevention.
• Inquiries and diagnostics: Up to 1 year following last contact if no contract ensues.
• Bix chat conversations: Completely anonymized logs do not constitute identifiable personal data.

You can exercise your GDPR rights of access, rectification, erasure, restriction, portability, objection, and the right not to be subject to automated decision-making by emailing support@bitora.es or via our Data Management and Deletion portal.

You also have the right to withdraw consent at any time and to lodge a complaint with the Spanish Data Protection Agency (AEPD).

Minors: Services are intended for individuals aged 14 and over (or 18+ for contractual SaaS services). We do not knowingly collect personal data from minors.

Security and incident reporting: We enforce strong technical measures including TLS 1.3 transit encryption and AES-256 storage. In the unlikely event of a security breach posing risks to data subjects, Bitora will notify the AEPD within 72 hours pursuant to Articles 33 and 34 GDPR.