Legal · GDPR

Privacy Policy

Your privacy is a priority for ayudas.ai. Here we explain what data we process, why, and how we protect it.

Last updated: October 2025

Real privacy

We do not use Google Analytics, Facebook Pixel or invasive trackers.

AI control

We do not train on your conversations without explicit consent (opt-in).

Data in Europe

Infrastructure and analytics focused on GDPR compliance in the European region.

We never sell data

Your data is yours; we do not commercialise it with third parties.

01Data Controller Identity

The ayudas.ai platform is operated by BIK AI Technologies, S.L. (Tax ID: B75890202), with registered address at Av. San Antonio 17, 48450, Etxebarri (Spain).

Privacy enquiries

[email protected]

02Personal Data Collected

We may process identification data, company data, project data, conversations with BIA, platform usage data and billing data.

Identification data: name, email, phone.
Company data: registered name, tax ID, sector.
Project data and documentation provided.
Usage data to improve performance and experience.

We do not store complete card details directly: payment is processed via Stripe.

03Purposes of Processing

We process data in accordance with the GDPR and the LOPDGDD for:

Provision of the service and account management.
Management of subscriptions, payments and invoices.
Technical support and relevant communications.
Own analytics for product improvement.
Use of the BIA Agent in real time.

Purpose	Legal Basis (Art. 6 GDPR)
Account and profile management	Performance of contract (Art. 6.1.b)
Grant search and matching (AI)	Performance of contract (Art. 6.1.b) + Legitimate interests (Art. 6.1.f)
Billing and subscriptions	Performance of contract (Art. 6.1.b) + Legal obligation (Art. 6.1.c)
Alert notifications	Consent (Art. 6.1.a) + Legitimate interests (Art. 6.1.f)
Web analytics (PostHog, Matomo)	Consent (Art. 6.1.a)
Commercial communications	Consent (Art. 6.1.a)
Security and fraud prevention	Legitimate interests (Art. 6.1.f)

04Data Recipients and Providers

We work with trusted providers under data processing agreements (Art. 28 GDPR):

Provider	Data Processed	Location
AWS Cognito	Email, user identifier (authentication)	EU (Ireland)
AWS Bedrock (Claude)	Content of conversations with the AI agent	EU (Paris)
Stripe	Payment and billing data	EU + USA (EU-US DPF)
PostHog	Usage analytics (consent only)	EU (self-hosted)
Matomo	Usage analytics and tag management (consent only)	EU (self-hosted)
Cloudflare Turnstile	IP, browser fingerprint (CAPTCHA verification)	Global (EU-US DPF)
AWS SES	Email address (notification delivery)	EU (Ireland)

International transfers: Stripe and Cloudflare may process data outside the EEA, covered by the EU-US Data Privacy Framework Adequacy Decision. AWS operates within the EU region. No additional transfers to third countries are made.

Enhanced privacy: we do not use Google Analytics, Facebook Pixel or equivalent trackers. PostHog and Matomo are self-hosted on European infrastructure.

05Data Retention Period

Account and profile data: for as long as the account is active. Deleted upon requesting account erasure.
AI conversation history: 12 months from creation. Deleted automatically.
Billing and payments: 7 years in accordance with the General Tax Law (Art. 66) and commercial regulations.
Activity logs: 24 months. Anonymised immediately upon account deletion.
Notifications and emails: 6 months for composed emails, 12 months for notification records.
Usage counters: 13 months (current month + 12 previous).
Marketing: until consent is withdrawn.
Stored documents: 2 years by default, unless a longer legal requirement applies.

Data is automatically deleted upon reaching the retention period through scheduled clean-up processes.

06User Rights (ARSULIPO)

Access

Rectification

Erasure

Restriction

Portability

Objection

To exercise your rights, write to [email protected] stating your request and proving your identity.

If you are not satisfied with how your data is processed, you may lodge a complaint with the AEPD (www.aepd.es).

07Automated Decisions and Profiling

We do not make decisions with legal or significant effects based solely on automated processes.

The BIA Agent provides advisory recommendations, but the final decision always rests with the user.

08Data Security

TLS/SSL encryption in transit.
Access controls and permission segregation.
Backups and security monitoring.
Incident response protocols.

In the event of a significant security breach, we will notify within the timeframes required by the GDPR.

09Children's Privacy

The services are not directed at children under 14 years of age without verifiable parental consent.

If we detect improper processing of children's data, we will apply deletion and protection measures.

10Changes to the Privacy Policy

We may update this Policy to reflect legal, technical or business changes.

We will always publish the current version on this page.
We will indicate the date of the last amendment.
If the change is material, new consent may be requested.

11Contact

Questions about privacy? We are here to help.

BIK AI Technologies, S.L.

Av. San Antonio 17, 48450, Etxebarri (Spain)

Tax ID: B75890202