Who we are
BertoProduction, Alicante, Spain, NIF Y-4514/312-R, is the data controller for the personal data described in this policy. You can reach us at info@bertoproduction.com.
What we collect
We collect only what is needed to answer an enquiry and to run the service:
- Account data for business users: name, email address, password (stored only as a cryptographic hash), interface language.
- Conversation data: the messages exchanged with the AI agent, the detected language, and any contact details the visitor chooses to give.
- Appointment data: date, time, service and any note the visitor adds.
- Technical data: IP address and browser user agent, recorded with consent and used for security and abuse prevention.
- Usage data: counts of conversations and AI calls, used for billing and capacity planning.
Why we process it
Performance of a contract: providing the service to the business that subscribes to it (Art. 6(1)(b) GDPR).
Legitimate interest: answering an enquiry a visitor started, keeping the service secure, and preventing abuse (Art. 6(1)(f) GDPR).
Consent: where the visitor accepts the privacy policy before starting a chat, and for any optional communication (Art. 6(1)(a) GDPR).
Legal obligation: retaining invoices and accounting records (Art. 6(1)(c) GDPR).
AI processing
Messages are sent to an AI model provider to generate a reply. The provider in use for this installation is no external provider — the offline model runs on our own servers, processing in our own servers, with no transfer to a third party. Messages are not used to train third-party models under the API terms we operate under. If no provider is configured, an offline model runs on our own servers and no message leaves this installation.
Who else sees the data
We share data only with processors that are necessary to run the service:
- Hosting and database: Hetzner Online GmbH, European Union.
- AI model provider: no external provider — the offline model runs on our own servers.
- Payments: Stripe Payments Europe Ltd, where a subscription is paid.
- Email delivery: Hostinger International Ltd.
- Calendar, where the business connects one: Google Ireland Ltd.
How long we keep it
Conversations and contacts are deleted automatically after the retention period the business configures (default: 730 days). Aggregated statistics are kept without personal data. Invoices are kept for 10 years as required by tax law. Audit logs are kept for 24 months.
Your rights
You can ask for access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest. Write to info@bertoproduction.com and we will answer within one month. You can also complain to your national supervisory authority.
Where the agent contacted you automatically, you can stop it at any time by replying with a request to stop, or by using the unsubscribe link in any email. The request is honoured immediately and permanently, across every channel.
International transfers
Where a processor is outside the EEA, the transfer is covered by Standard Contractual Clauses. The list of processors and their locations is available on request.
Security
Passwords are hashed with scrypt. Third-party credentials are encrypted at rest with AES-256-GCM. Access is restricted per business account, all traffic is encrypted in transit, and administrative access is logged.