Version of 9 September 2026. Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Controller
BABYROCK MINERALS, S.L., NIF B88957212, Avenida Ramon Escayola 129, 08197 Sant Cugat del Vallès (Barcelona).
Privacy contact: [email protected]. We do not have a data protection officer: we are not in the cases where the law requires one.
This policy covers www.babyrock.ai, payment and the app at app.babyrock.ai, and BabyRock Social WhatsApp with you. The BabyHunters introducer programme, when live, will have its own agreement; it is not advertised on this site.
2. Two roles, not one
A. We are controller when we process data for our relationship with you: account, billing, WhatsApp and email with the shop, prospecting, and site analytics if you accept cookies.
B. We are processor when we process the content of Google reviews and the replies we publish on your listing. The shop is the controller. That processing is in the processing agreement, accepted when you subscribe.
We never ask for the owner’s Google password.
3. What we process as controller, why, and on what basis
Sign-up and contract. Name or shop sign, email, WhatsApp, city, Google Maps URL, legal name, tax ID, billing address, plan and payment status. Basis: performance of the contract (GDPR art. 6(1)(b)) and the legal duty to invoice (art. 6(1)(c)).
Payment. Stripe processes card data. We receive the payment result, the Stripe customer id and, if Stripe sends it, a card fingerprint (not the number). Basis: contract and legal duty.
WhatsApp and email with you. The Fil Babyrock thread (1 to 3 star drafts, recap, billing). Basis: contract. Meta carries the message.
Prospecting. If a shop has a business email or WhatsApp on its website, we may write once per channel, with a way to object (STOP / BAJA). We do not use the Maps phone as WhatsApp unless it is published as a business channel. Basis: legitimate interest in offering a B2B service (art. 6(1)(f)) and LSSI article 21. You may object at any time.
Free listing audit. If you ask for it, we process the public address of your Google listing, the channel you write to us from (WhatsApp or email) and the score and fixes we return, to answer you and, if you wish, to talk about the service afterwards. Basis: your consent (art. 6(1)(a) GDPR), asked in the conversation and withdrawable at any time. We do not give that data to anyone for advertising.
Public site. Pages visited, language, device. If you accept analytics cookies, Google Analytics. Basis: consent (art. 6(1)(a)). Detail: cookies.
Service journal (as processor, see the processing agreement). Review text, the author’s public name on Google, stars, drafts, published text, who clicked publish. Needed to provide the service and to show what was published if there is a dispute.
We do not sell data. We do not profile you in a way that produces legal effects.
4. Recipients
Only those who need the data for the service:
- Stripe (payment and invoice).
- Google (Business Profile, reviews, and Analytics if you consented).
- Meta (WhatsApp Cloud API).
- Zoho (email, EU data centre).
- xAI (help with the draft; a person reviews it afterwards).
- DataForSEO (reading public reviews when a count is needed).
- Hosting of the app and Postgres in the European Union.
- GitHub (pages for the public site www.babyrock.ai).
The people who publish or block a reply are people we authorise. They are in the European Union today. If someone later works from outside the EEA, we will say so here and we will sign the relevant clauses before they see data.
The tax authority, a court or the Spanish DPA (AEPD), if they ask us on a legal basis.
5. Transfers outside the EEA
Google, Meta, Stripe, xAI and GitHub may process data in the United States or other countries. Where there is no adequacy decision, we use the European Commission’s standard contractual clauses or another Chapter V GDPR safeguard. Zoho Mail is configured in the EU.
6. Retention
- Invoices and tax data: 6 years (article 30 of the Spanish Commercial Code), or any longer tax period.
- Account, WhatsApp and service journal: for the life of the contract and 24 months after, unless a dispute is open.
- Prospects who never subscribe: 12 months after last contact, or until they object.
- A free listing audit that does not lead to a contract: 12 months from the last conversation.
- Cookie consent: until you withdraw it, or 12 months, after which we ask again.
When we stop, we remove manager access. We do not delete text already published on Google: it is your listing.
7. Rights
You may access, rectify, erase, restrict, object and ask for portability. Write to [email protected]. We will answer within a month.
You may also complain to the Spanish Data Protection Agency (www.aepd.es).
If the data sits in a Google review, Google is the controller of that platform. We can help with the reply; we cannot delete someone else’s review.
8. Children
The service is for shops. It is not aimed at anyone under 18.
9. Changes
If this policy changes in a material way, we will tell you by WhatsApp or email and we will update the version date.