Privacy Policy

1Data controller

Company

CARABELA AI SL

Tax ID (NIF)

B26870923

Registered office

Paseo del Club Deportivo, 1, Edificio 4, 1st floor, 28223 Pozuelo de Alarcón (Madrid), Spain

Privacy contact

general@carabela.ai

2Data we process

Depending on the interaction, we may process the following categories of data:

• Professional identification and contact data: name, surname, email, phone, company and job title.
• Request and communication data: content of messages, queries, demo requests and scheduled meetings.
• Customer and billing data: contracting entity, contact person, tax and payment information.
• Platform access and usage data: credentials, activity logs, IP address, technical identifiers and usage metrics.
• Customer-uploaded content: documents, tender specifications, proposals and other materials the customer chooses to process through the service.
• Browsing data: obtained through cookies and similar technologies, as detailed in our Cookie Policy.

We do not request special categories of data. We recommend not including such information in communications or in documents uploaded to the platform unless strictly necessary.

3Purposes of processing

• Responding to enquiries, information requests and demo requests.
• Managing the contractual relationship with customers and providing the SaaS service.
• Enabling access, use and administration of the platform.
• Billing and compliance with accounting, tax and commercial obligations.
• Sending commercial communications about our services where there is a legal basis to do so.
• Ensuring security, availability and improvement of the service.
• Compliance with legal obligations and responses to requests from competent authorities.

4Legal basis

• Performance of a contract or pre-contractual measures (art. 6.1.b GDPR): handling requests, onboarding and provision of the service.
• Compliance with legal obligations (art. 6.1.c GDPR): accounting, tax, commercial and cooperation obligations with authorities.
• Legitimate interest (art. 6.1.f GDPR): platform security, fraud prevention, service improvement and commercial communications about similar products to existing customers (art. 21.2 LSSI).
• Consent (art. 6.1.a GDPR): commercial communications to non-customers, subscriptions and non-essential cookies. Consent may be withdrawn at any time.

5Processing within the SaaS platform

With respect to personal data and documents that the customer enters or generates within the platform, Carabela AI acts as a data processor on behalf of the customer, who remains the data controller. Such processing is governed by the corresponding service agreement and by a Data Processing Agreement (DPA) pursuant to article 28 GDPR, made available to the customer and which may be executed upon request.

Carabela AI processes such information solely on the documented instructions of the customer, for the sole purpose of providing the contracted service, and applies appropriate technical and organisational measures to ensure confidentiality and integrity.

6Use of artificial intelligence

The platform incorporates artificial intelligence features (including third-party language models) to assist customers with tender analysis, search, drafting and similar tasks.

• Customer content is processed solely for the purpose of delivering the requested service.
• Customer data and documents are not used to train general AI models, except with express, separate and informed authorisation.
• Where third-party AI model providers are used, they are engaged under terms that prohibit the use of customer content for training their models.
• AI-generated outputs may contain inaccuracies; the customer remains responsible for reviewing them before use.

The Site’s conversational assistant

The Site includes a conversational assistant. When you write to it, the content of your messages is sent to a language-model provider in order to generate the reply. This processing is distinct from the one described in the previous section: here Carabela AI acts as data controller, not as a processor on behalf of a client.

Please do not enter third-party personal data, tender documentation or confidential information into the assistant. It is a commercial information channel, not the environment in which the contracted service is delivered.

7Recipients and processors

We do not transfer personal data to third parties except where legally required. To deliver the service, we engage providers acting as data processors, duly bound by contract under art. 28 GDPR. Categories of providers include, as required:

• Cloud infrastructure and hosting.
• Artificial intelligence model providers.
• Web analytics tools (including Google Analytics).
• Customer communication and meeting scheduling solutions.
• Billing and payment platforms.
• Support, CRM and transactional email tools.

An up-to-date list of sub-processors used in the provision of the service may be made available to customers upon request as part of the DPA.

8International transfers

Some providers may be located outside the European Economic Area. In such cases, transfers are made under appropriate safeguards provided by the GDPR, in particular European Commission adequacy decisions or Standard Contractual Clauses (SCCs), supplemented where necessary by additional measures ensuring an equivalent level of protection.

9Retention periods

• Commercial contacts and leads: while there is mutual interest and, in any case, until deletion is requested.
• Customer and platform data: for the term of the contract and, after termination, for the applicable statutory limitation periods.
• Customer-uploaded content: as set out in the contract and DPA; on termination, returned or deleted in accordance with the customer's instructions.
• Data subject to legal obligations (tax, accounting, commercial): for the periods required by applicable law.
• Commercial communications: until consent is withdrawn or unsubscription is requested.

10Rights of data subjects

Data subjects may exercise their rights of access, rectification, erasure, objection, restriction of processing, portability and not to be subject to automated individual decisions, as well as withdraw any consent given.

Requests may be sent to general@carabela.ai, indicating the right to be exercised. Where the data relates to processing in which Carabela AI acts as processor, the request will be forwarded to the controller customer or handled in accordance with their instructions.

Data subjects also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if they consider that their rights have not been duly addressed.

11Security

We implement appropriate technical and organisational measures pursuant to art. 32 GDPR to ensure the confidentiality, integrity, availability and resilience of systems and services, including access control, encryption in transit, activity logging, backups and incident management processes.

12Commercial communications

We only send electronic commercial communications where prior consent exists or, in the case of customers, where they relate to products or services similar to those contracted, in accordance with art. 21.2 LSSI. Recipients may object or unsubscribe at any time, simply and free of charge, via the link included in each communication or by writing to general@carabela.ai.

13Cookies

The use of cookies and similar technologies on the website is governed by our Cookie Policy, which details their type, purpose and how to manage consent.

14Minors

Our services are aimed at professionals and organisations (B2B environment) and not at minors. We do not knowingly collect data from minors. Should we become aware of such processing, we will proceed to delete the data.

15Changes to this Policy

This Policy may be updated to reflect regulatory, case-law or service changes. The version in force will be the one published on the website, indicating the date of the last update.