Privacy policy

1. Introduction

At Boeasy, we take the protection of your personal data very seriously. This Privacy Policy explains how we collect, use and protect your information when you request a demo, use our enterprise platform or connect your systems to Boeasy.

Data controller: BOEASY SOLUTIONS, SL (Tax ID: B26896530), with registered address at Avenida Reina Victoria 30, Madrid, Spain. You can contact us at legal@boeasy.es.

2. Data we collect

We collect the following types of personal data:

2.1 Data you provide

• Requests and demos: Professional email address, name, organisation, role and any requirements you choose to share.
• Account registration: Email address and password.
• User profile: Alert preferences and sectors of interest.
• Chat conversations: Queries submitted to the AI assistant and its responses.

2.2 Data collected automatically

• Usage data: Pages visited, features used and searches performed.
• Technical data: Browser type, device and operating system.
• Cookies: We use essential and analytics cookies (see section 6).

3. Purposes of processing

We use your data to:

• Manage access: Process demo requests, enable authorised users and manage your account.
• Provide the service: Provide documentary coverage, analysis, alerts, search and agreed integrations.
• AI processing: Classify, relate and analyse documents and answer queries using artificial intelligence systems.
• Communications: Send transactional emails, including invitations, password recovery messages and configured alerts.
• Service improvement: Analyse use of the platform to improve its features.
• Security: Detect and prevent fraud or unauthorised use.

4. Legal basis for processing

We process your data on the following bases:

• Consent (Article 6(1)(a) GDPR): Analytics cookies and promotional communications where you have requested them.
• Performance of a contract (Article 6(1)(b) GDPR): Provision of the service, account management and processing of chat queries.
• Legitimate interests (Article 6(1)(f) GDPR): Platform security, fraud prevention and service improvement.

5. Data retention

Retention periods vary depending on the type of data:

• Account data: While your account remains active. Deleted within a maximum of 30 days after cancellation.
• Demo requests: For as long as necessary to handle and follow up the request, unless you ask us to delete it earlier or a legal retention obligation applies.
• Chat conversations: While your account remains active. You may delete individual conversations at any time.
• Analytics data: 12 months from collection.
• Security logs: 6 months.
• Legal obligations: Certain data may be retained for periods required by applicable law, including tax obligations.

6. Cookies and analytics

We use cookies to improve your experience and analyse use of the platform.

6.1 Essential cookies

These are necessary for basic operation of the service, including authentication and preferences. They do not require consent.

6.2 Analytics cookies

We use PostHog to analyse use of the platform. This helps us understand how you use Boeasy and improve the service. Analytics cookies are activated only if you give your consent through the cookie banner.

• Provider: PostHog (EU Cloud, Frankfurt, GDPR compliant).
• Data collected: Pages visited, features used and interaction events.
• Identification of authenticated users: If you consent to analytics cookies and are signed in, we share your internal identifier, email address and full name with PostHog to personalise your experience and understand how you use Boeasy. This information is associated with your account only while you are authenticated and always requires prior consent.
• We do not collect: IP address (anonymised) or sensitive data.
• Retention: Analytics data is automatically deleted after 12 months.

You may withdraw consent at any time through cookie settings or by clearing site data in your browser, which immediately stops any additional data being sent to PostHog. See our Cookie Policy for more details.

7. Data sharing

We do not sell your data. We may use providers acting as processors for the following categories of services:

• Infrastructure: Hosting, storage, networks and security.
• Communications: Transactional email and notifications.
• Artificial intelligence: Processing queries and documents where necessary for the contracted service.
• Analytics: Usage measurement, only where you have given consent.

We limit access to the data needed for each service and apply the required contractual safeguards.

8. International transfers

Where processing involves an international transfer, we will apply an adequacy decision, standard contractual clauses or another valid safeguard under the GDPR.

9. Your rights

You have the right to:

• Access: Request a copy of your personal data.
• Rectification: Correct inaccurate or incomplete data.
• Erasure: Request deletion of your data (the “right to be forgotten”).
• Portability: Receive your data in a structured format and transfer it to another service.
• Object: Object to processing in certain circumstances.
• Restriction: Request restriction of processing.
• Withdraw consent: Withdraw your consent at any time.

To exercise these rights, contact us at legal@boeasy.es. We will respond within one month under Article 12(3) GDPR, extendable by two additional months in particularly complex cases.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at aepd.es.

10. Use of artificial intelligence

Boeasy uses artificial intelligence systems for the following purposes:

• Document classification: Automatic categorisation by topic, entity and relevance.
• Summary generation: Summaries of documents from configured sources.
• AI queries: Answers and relationships based on the knowledge available in Boeasy.

We do not make automated decisions producing legal effects about users within the meaning of Article 22 GDPR. AI is used exclusively as an aid for processing public information.

AI-generated results may contain errors or inaccuracies. We recommend always checking information against official sources before making decisions based on it.

11. Security

We implement technical and organisational measures to protect your data, including:

• Encryption of data in transit (HTTPS/TLS).
• Password hashing using secure algorithms (bcrypt).
• Restricted database access.
• Continuous security monitoring.

12. Children

Boeasy is an enterprise service intended for people aged 18 or over or users authorised by their organisation. If you are a parent or guardian and believe your child has provided us with personal data, contact us so that we can delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a notice on our platform. The date of the latest update appears at the beginning of this document.

14. Contact

For any question about this Privacy Policy or our processing of your personal data: