Privacy policy

This policy explains what personal data we process at Noobit, for what purposes, on what legal basis, for how long, who we share it with and how to exercise your rights. Noobit is a service for businesses and professionals: we do not offer it to consumers.

1. Data controller

Noobit Loop, S.L., Spanish tax ID (NIF) B88820311, with its address at Calle Sant Roc, 25, 08503 Gurb (Barcelona), Spain. For any privacy matter: [email protected].

2. Two different roles: controller and processor

We are the data controller for the data we process for ourselves: that of the people who use a Noobit account, billing data, and the data of anyone who writes to us from the website and of anyone who visits noobit.ai. This policy is about that data.

We are the data processor for the data each customer puts on the platform so that we can provide the service to them: their catalog, the files they upload, the voice notes they dictate and the orders they sync from their store, which include their buyers' names and email addresses. The customer is the controller of that data and decides what goes in and for what purpose. We process it only on the customer's instructions, under the data processing clause of the Terms of service. If you are a buyer from a store that uses Noobit, contact that store to exercise your rights; if you write to us instead, we will pass your request on to it.

3. What data we process, why, and on what legal basis

• Account users (name, email, role, encrypted password, date of last login and a log of the actions they take on the platform): to give access to the service, keep it secure and keep a record of who changed what. Basis: performance of the contract with the customer and our legitimate interest in keeping the service secure and traceable (Art. 6(1)(b) and 6(1)(f) GDPR; Art. 19 of the LOPDGDD, Spain's Organic Law 3/2018 on Personal Data Protection and Digital Rights, for the contact details of professionals).
• Billing data (company name, tax ID, tax address, and billing contact person, email and phone number): to invoice and to meet our tax and accounting obligations. Basis: the contract and a legal obligation (Art. 6(1)(b) and 6(1)(c) GDPR).
• Service usage (tasks run, credits used and the user who launched them): to charge for what is used and to resolve issues. Basis: the contract.
• Contact, demo and access forms (name, email, company, message and any catalog or store details you give us): to reply to you, prepare your demo or give you access. We store them in our database and they reach us by email. Basis: your request, as a pre-contractual measure (Art. 6(1)(b) GDPR).
• Job applications you send us by email: to consider them when we open a position. Basis: your consent, which you give by sending your application and can withdraw at any time.
• Browsing the public website: analytics with Google Analytics, with cookies only if you accept them. Basis: your consent. Details in the Cookie policy.
• Communications to customers about the service (changes, incidents, news about features similar to those contracted). Basis: the contract and our legitimate interest (Art. 21.2 of the LSSI-CE, Spain's law on information society services and electronic commerce). You can object to the ones that are not operational by writing to us.

We do not make automated decisions with legal effects on people, nor do we carry out profiling. We do not ask for special categories of data (health, ideology, biometrics…); if any were to appear incidentally in a file or a voice note, it would be because the customer uploaded them.

4. Artificial intelligence

To write product content, process images, research products and transcribe voice notes, we send AI providers the content needed for each task. What we send is mostly product information; the data of stores' buyers is never sent to the AI. We use these providers under their business offerings, which do not use the data they receive to train their models. We do not use our customers' data to train models either.

5. Who we share data with

We do not sell data or disclose it to third parties, except where required by law. We do work with these providers, which process it on our behalf and only to provide their service to us:

• Hetzner Online: Servers and database. Location: Germany (EU).
• Cloudflare: Network, CDN, storage of images, files, audio and backups (R2), downloading images from suppliers. Location: EU and global network (United States).
• OpenAI: AI models: writing, vision, image editing and transcription of voice notes. Location: United States.
• Google (Gemini): AI models and web research with Google Search. Location: United States.
• NPAW: Text AI models for the Economy AI level. Location: Spain (EU).
• Anthropic: Text AI models (occasional use). Location: United States.
• Sentry (Functional Software): Application error logging. Location: Germany (EU).
• Google (Gmail): Email notifications from the website forms (contact, demo and access). Location: United States.
• Google (Analytics 4): Analytics for the public website, only with your consent to cookies. Location: United States.

Payments are currently made by bank transfer; the bank processes the payment data as a controller in its own right.

6. Transfers outside the European Economic Area

The database and files are in the European Union, but some of the providers listed above (mainly the AI providers) process data in the United States. These transfers rely on the EU-U.S. Data Privacy Framework when the provider participates in it and, when it does not, on the standard contractual clauses approved by the European Commission.

7. How long we keep data

• Account and service data: for as long as the contract lasts. When it ends, we delete the customer's data within 30 days, except for data we must keep by law.
• Billing: six years, under commercial and tax regulations.
• Voice note audio: 90 days by default (the customer can change this); the transcription stays with the rest of the product record.
• Contact, demo and access forms: up to 12 months if no contract is signed.
• Job applications: up to 12 months.
• Backups: deleted data may remain in backups, which are used only to restore the service.

8. Security

Encryption in transit, encrypted connection credentials, isolation between customers, backups and a log of actions. We describe it in detail in Security.

9. Your rights

You can request access to your data, have it rectified or erased, object to its processing, restrict it and request its portability, as well as withdraw any consent you have given. Write to us at [email protected] stating which right you want to exercise; we will reply within one month. If you believe we have not handled your request properly, you can file a complaint with the Spanish Data Protection Agency (AEPD, aepd.es).

10. Changes to this policy

If we change anything significant, we will notify customers by email before it takes effect. The date at the top shows the last update.