Privacy Policy
Last updated: [DATE]
This Privacy Policy explains how Barbelo ("Barbelo," "we," "us," or "our"), operated by [LEGAL ENTITY NAME], collects, uses, and protects your personal data when you use our website and Service.
We are based in the European Union and process personal data in accordance with the General Data Protection Regulation (GDPR).
1. Data We Collect
Account data
When you sign in (via Google OAuth or email), we collect:
- Your email address
- Your name and profile picture, if provided by Google
- A unique user identifier
Usage data
- Search queries you submit (keyword and AI Search)
- The number of AI Search queries used per day, to enforce free/paid usage limits
- General usage patterns (pages visited, features used) for service improvement
Payment data (paid subscribers only)
Subscription status and billing history.
We do not directly collect or store your payment card details. Payments are processed by our third-party payment processor, Lemon Squeezy, which acts as the merchant of record. Please refer to Lemon Squeezy's own privacy policy for how they handle your payment information.
Technical data
IP address, browser type, and device information, collected automatically for security and analytics purposes.
2. How We Use Your Data
We use your data to:
- Provide and maintain the Service, including authentication and personalized features
- Enforce free-tier usage limits and manage paid subscriptions
- Process your search and AI Search queries, including sending relevant text to our AI provider (Google Gemini) to generate answers
- Improve and monitor the performance and reliability of the Service
- Communicate with you about your account, service changes, or support requests
- Comply with legal obligations
3. Third-Party Services We Use
To operate Barbelo, we share limited data with the following third-party service providers, each acting as a data processor on our behalf:
| Service | Purpose | Data Involved |
|---|---|---|
| Supabase | Database hosting, authentication | Account data, usage data |
| Google (Gemini API) | AI-generated search answers and embeddings | Search queries, retrieved transcript excerpts |
| Google OAuth | Sign-in | Email, name, profile picture |
| Qdrant (self-hosted on Railway) | Semantic search index | Transcript content (not personal data) |
| Railway | Backend and database infrastructure hosting | All data in transit/storage on our backend |
| Vercel | Website hosting | Technical/browser data |
| Lemon Squeezy | Payment processing (when applicable) | Billing information, subscription status |
We do not sell your personal data to third parties.
4. AI Processing Notice
When you use AI Search or chat features, your question is sent to Google's Gemini API for processing, along with relevant excerpts from indexed transcripts. Google's own privacy and data handling terms apply to this processing. We do not send your account email or identity to Gemini as part of this process — only the query text and retrieved context are sent.
5. Data Retention
- Account data is retained for as long as your account is active. If you delete your account, we will delete your personal data within a reasonable period, except where retention is required by law (e.g., billing records).
- Usage/query-count data is retained for a limited period for rate-limiting and analytics purposes.
- Search query content may be retained in aggregated or anonymized form to improve the Service.
6. Your Rights (GDPR)
If you are located in the European Union, you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate data
- Erase your data ("right to be forgotten")
- Restrict or object to certain processing
- Data portability — receive your data in a structured, machine-readable format
- Withdraw consent at any time, where processing is based on consent
- Lodge a complaint with your local Data Protection Authority, or the supervisory authority in the EU member state where [LEGAL ENTITY NAME] is registered
To exercise any of these rights, contact us at [CONTACT EMAIL].
7. Cookies
Barbelo uses essential cookies for authentication and session management. We do not currently use third-party advertising or tracking cookies. If this changes, we will update this policy and request consent where required.
8. Children's Privacy
Barbelo is not directed at children under 16. We do not knowingly collect personal data from children under this age. If you believe a child has provided us with personal data, please contact us so we can delete it.
9. Data Security
We take reasonable technical and organizational measures to protect your data, including encrypted connections (HTTPS), access controls, and secure third-party infrastructure providers. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
10. International Data Transfers
Some of our service providers (e.g., Google, Vercel, Railway) may process data outside the European Economic Area. Where this occurs, we rely on appropriate safeguards, such as Standard Contractual Clauses, to ensure your data remains protected.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via the Service or by email. The "Last updated" date at the top reflects the most recent revision.
12. Contact
For any questions about this Privacy Policy or your personal data, contact:
[CONTACT EMAIL]
[LEGAL ENTITY NAME], European Union
This document is a general template and does not constitute legal advice. Before publishing, we recommend a review by a qualified attorney or GDPR specialist familiar with your specific business structure and data processing arrangements.