Privacy policy

Here we explain what data we process when you visit bb1studio.com, request a trial or sign up for a service: what for, for how long and who else processes it. Last updated: 31 October 2026.

Controller

Guanabomalu, S.L. (BB1 Studio), NIF B38413647, Avenida Santa Cruz, 66, 1º D, San Isidro, 38611 Granadilla de Abona, Santa Cruz de Tenerife. For any privacy matter: hola@bb1studio.com.

What data we process and why

What for	What data	Legal basis	How long
Handling your trial request	Business name and type, your name, email, business WhatsApp number, languages, website, page language and acceptance of the terms, with date and time	Pre-contractual steps you request (Art. 6(1)(b) GDPR)	90 days if the trial does not start
Sending you the Before You Send or Plantatam trial code	Email, page language, acceptance of the terms with date and time, and the internal number of your code	Trial terms (Art. 6(1)(b) GDPR)	90 days
Preparing your Vistobueno report and keeping it on your private link	The documents you upload (only while they are read), what you tell us about your plans and the resulting report; of the link, only an irreversible fingerprint	The service you ask for (Art. 6(1)(b) GDPR); for other people's data in the documents, our legitimate interest in providing it to you (Art. 6(1)(f) GDPR)	Documents: deleted when the reading ends. Report: 30 days from when you request it or open it in full, or until you delete it
Opening the full Vistobueno report you pay for	Paddle's payment identifier and the report it belongs to; never your card details	Contract (Art. 6(1)(b) GDPR)	Same as the report
Preparing and providing the trial	Business details, menu (photos or PDF), opening hours, the owner's name, email and phone, the assistant's profile, trial dates and counters	Trial terms (Art. 6(1)(b) GDPR)	90 days from the end, if you do not sign up
Preventing repeat free trials	A pseudonymised fingerprint (HMAC) of your email, the phone numbers, the business name and the menu (files, link and dishes with their prices); for this we do not keep the data in clear text	Legitimate interest in one free trial per business (Art. 6(1)(f) GDPR)	24 months
Providing and invoicing the service you sign up for	The above plus billing details	Contract (Art. 6(1)(b)) and legal obligations (Art. 6(1)(c) GDPR)	For the duration of the contract; then the statutory periods
Sending you news and offers, only if you tick the box	Email and WhatsApp, with the date of your consent	Your consent (Art. 6(1)(a) GDPR and Art. 21 LSSI-CE)	Until you withdraw it
Protecting the forms from abuse	A pseudonymised fingerprint (HMAC) of your IP address; your IP is not stored in our tables	Legitimate interest in security (Art. 6(1)(f) GDPR)	1 hour
Keeping the server secure and stable	Technical log of each submission, with your IP and what you sent	Legitimate interest (Art. 6(1)(f) GDPR)	About 15 minutes
Fixing technical faults	Error log, which may include your IP and what you sent	Legitimate interest (Art. 6(1)(f) GDPR)	14 days
Replying to what you write to us, by email or through our contact forms	What you tell us and your contact details; in our contact forms, your name, your email address and, if you give them, your phone number and your business	Your request (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f) GDPR)	As long as needed to help you

Without the required form fields we can't prepare your trial. The emails we exchange with you and the system alerts are kept in our mailbox for six years, the period that Article 30 of the Spanish Código de Comercio (Commercial Code) sets for business correspondence. What we delete may remain for up to 14 more days in the backups, which are then erased.

If you're a customer of a business that uses the assistant

If you message a business on WhatsApp that uses the BB1 Studio Assistant, that business is the controller of your data. We process it on its behalf, as a processor, to reply to you, handle your booking and prepare a summary of questions for the business. The assistant tells you at the start that it's automated. To exercise your rights, contact the business; if you write to us, we'll pass it on.

If you use Before You Send

For the trial we only ask for your email (see the table above). When you use the app, the texts and screenshots you analyse are sent to Anthropic, and voice notes to Groq for transcription; the result comes back to your browser. Our server doesn't keep your messages or the analyses: your history stays only in your browser, and you can delete it from the app.

Of your code we keep only a one-way fingerprint (a hash) and how many analyses you have left. Your browser keeps a technical cookie that keeps your access open for 30 days. Don't analyse other people's sensitive data, such as their health or their beliefs, and remove names that aren't needed.

If you use Plantatam

For the trial we only ask for your email (see the table above). When you use the app, the photos and the note you write are sent to Anthropic to be analysed; the result comes back to your browser. Before sending them, the app makes the photos smaller and removes the location and camera data. Our server doesn't keep your photos or the results: your history stays only in your browser, and you can delete it from the app.

Of your code we keep only a one-way fingerprint (a hash) and how many analyses you have left. Your browser keeps a technical cookie that keeps your access open for 30 days. Photograph only the plant: no people or personal details.

If you use Vistobueno

To use Vistobueno we don't ask for your name or email. The documents you upload and what you tell us about your plans are sent to Anthropic to be read; before that, the app shrinks the photos and removes their location and camera data. Our server doesn't keep the documents: it deletes them as soon as the reading is done.

We keep the resulting report on a private link for 30 days from when you request it or open it in full, and you can delete it earlier from the app. Of the link we keep only an irreversible fingerprint (a hash): without the link, nobody can open the report. Your reports stay on your phone, without the documents, until you delete them.

A community's documents contain other people's data, such as neighbours, the administrator or the seller: upload them only if you're entitled to have them. We use them only to prepare your report. If you pay, the payment is handled by Paddle, which is the seller and the controller of the payment data; we receive only the payment identifier and the report it belongs to. If you use a code, we keep its fingerprint and how many reports it has left.

Who else processes your data

Only the providers we need to operate, under a data processing agreement:

• WIIT AG (webtropia), in Germany: the server that runs the site, the assistant and the apps.
• Google: the email service we use to write to you.
• Anthropic: the AI that reads your menu, prepares your business profile and drafts the assistant's replies; in Before You Send, it analyses messages and screenshots; in Plantatam, the photos of your plants, and in Vistobueno, the community's documents.
• Meta (WhatsApp): if you message us on WhatsApp.
• Groq: it transcribes the voice notes you send to the assistant or to Before You Send.
• Paddle (Paddle.com Market Limited), in the United Kingdom: it sells and charges for the full Vistobueno reports as reseller ("Merchant of Record") and sends you the invoice.
• Our accountants and the tax authorities: only for invoicing and when the law requires it.

We don't sell your data or pass it to anyone for their own purposes.

Data outside the European Union

Anthropic and Groq are in the United States, and Google and Meta may send data there. They do so with the safeguards the GDPR requires: the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses, depending on the provider. Under its commercial terms, Anthropic does not use this data to train its models. Paddle is in the United Kingdom, which has an adequacy decision from the European Commission.

Automated decisions

We don't make automated decisions that have legal effects on you. The AI prepares your business profile and checks how the assistant replies, but a person reviews and approves every trial. In Before You Send, the AI only gives you a guide: you decide what to reply. In Plantatam, it gives you guidance about your plant: you decide what to do. In Vistobueno, it gives you information about the community's documents: you decide, with a lawyer, a notary or a gestor if you need one.

Your rights

You can ask to access your data, correct it, erase it, object to its use, restrict it or take it with you (portability). You can also withdraw your consent at any time, without affecting what happened before. Write to us at hola@bb1studio.com or from our contact page saying which right you want to exercise: we'll reply within one month at most.

If you're not satisfied, you can complain to the Agencia Española de Protección de Datos, the Spanish data protection authority (aepd.es).

Security

The server is in the European Union, connections are encrypted (HTTPS) and access is restricted. We make daily backups, which are deleted after 14 days.