Privacy Policy

This Privacy Policy explains how Volcanic Labs SLU, operating Biel.ai (“Biel”, “we”, “us”), collects and uses personal data when you visit our website, create or administer an account, contact us, or use Biel's services.

1. Who is responsible for your data

Volcanic Labs SLU controls personal data for website visitors, prospective customers, account administrators, billing contacts and people contacting Biel. Customers generally control the documentation, questions and conversations Biel processes on their behalf. For that processing, Biel is a processor under the DPA.

2. Data we collect

• Account and organization data: name, work email, company, role, authentication information and team membership.
• Billing data: subscription, transaction and billing-contact information. Payment-card details are processed by our payment provider rather than stored directly by Biel.
• Customer content: connected documentation, source content, configuration, prompts, questions, conversations, feedback and generated answers.
• Technical and usage data: IP address, device and browser information, timestamps, pages viewed, feature usage, authentication events, diagnostic information and security logs.
• Communications: information you submit through support, contact, demo, program-application and other forms.
• Attribution and preference data: referral source, landing page, campaign parameters, click identifiers, promotional eligibility and cookie or local-storage preferences.

We receive data directly from you, automatically through your use of our website and Services, and from your organization or its authorized administrators, connected sources and service providers involved in authentication, payments or support.

3. Why we process data

• Provide and administer the Services: to create accounts, authenticate users, process payments and deliver support. We rely on performance of a contract or requested pre-contractual steps when you are the contracting party. For contacts acting for an organization, we rely on our legitimate interest in managing that business relationship. Customer content processed on an organization's behalf follows section 4 and the DPA.
• Secure and improve Biel: to prevent abuse, investigate incidents, troubleshoot, measure performance and improve reliability. The legal basis is our legitimate interest in operating a secure and effective service.
• Meet legal obligations: including accounting, tax, compliance and lawful requests. The legal basis is compliance with applicable law.
• Communicate about the service: to send transactional, security, billing and support messages, including manual review of unpaid usage. We rely on the contract when you are the contracting party or our legitimate interest in administering the business relationship.
• Analytics and marketing: to understand website acquisition and usage and, where permitted, send product news or offers. We rely on consent where the law requires it. You may withdraw consent at any time.

4. When Biel acts as a processor

We process documentation, end-user questions and conversations, identifiers and related technical data on the customer’s documented instructions to provide, secure, support and maintain Biel. We do not use customer content or end-user conversations to train AI models. The DPA sets out processor obligations, deletion and audit rights.

For rights requests about a Biel experience on another organisation’s site or service, contact that organisation first. It controls the experience and can identify the relevant project and data.

5. Who receives data

We do not sell personal data. We share data only as needed with the customer that operates the relevant Biel experience, service providers that help us host and operate Biel, professional advisers, and authorities where required by law. Infrastructure, database, communications, monitoring, payment and AI-model providers may process data on our behalf. Our current providers are listed in the provider documentation.

6. International transfers

Some providers process data outside the European Economic Area. Where required, we use an adequacy decision, the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism, together with supplementary safeguards where appropriate. Contact us to request further information about the safeguards relevant to your data.

7. Retention

• Account and organization data is retained while the account is active and for a limited period afterwards for support, security and dispute resolution.
• Customer Personal Data is retained according to the customer's instructions, subscription configuration and the DPA, then deleted from active systems and allowed to expire from protected backups.
• Security and diagnostic logs are retained for periods proportionate to security, troubleshooting and legal needs.
• Application and sales communications are retained while the relationship is active and afterwards only as needed for follow-up, recordkeeping or legal claims.
• Business and accounting records are generally retained for six years from the last accounting entry, as required by Spanish law. A different period may apply where another legal obligation or the establishment, exercise or defense of legal claims requires it.
• Data that has been irreversibly anonymized may be retained for analytics and service improvement.

8. Your rights

Depending on the processing and applicable law, you may request access, correction, deletion, restriction or portability, object to processing, and withdraw consent without affecting earlier lawful processing. You can object to direct marketing at any time and complain to the Spanish Data Protection Agency (AEPD) or your local supervisory authority.

Contact [email protected]. We may need to verify identity. For requests where Biel is controller, we respond without undue delay and within one month. Where the law permits, complexity or the number of requests may require up to two additional months. We explain any extension within the first month. Customer-controlled data requests follow section 4.

9. Cookies and similar technologies

We use cookies and similar technologies for essential functions, preferences, campaign attribution and promotional eligibility, and self-hosted Umami for audience measurement. Where required, we obtain consent before optional uses. Accept, reject or withdraw your choice through “Cookie settings” in the footer. Rejecting optional uses does not prevent essential website access.

Attribution may include referral source, landing page, campaign parameters and advertising click identifiers, shared across biel.ai subdomains to associate a referral with signup. Attribution cookies last up to 90 days and promotional cookies up to 30 days. You can also block or clear storage in your browser. See our Security Overview for provider and security details.

10. Marketing communications

We send marketing communications when you have requested them, consented to them, or where another lawful exception applies. Marketing choices are separate from service and security messages. You can unsubscribe using the link in an email or by contacting us. Withdrawing from marketing does not affect necessary account, billing, security or support communications.

11. Required information

Fields marked as required are needed to create an account, process an application, enter a contract or answer your request. If you do not provide them, we may be unable to provide the requested service. Optional fields may be left blank.

12. Changes to this policy

We may update this policy to reflect changes to Biel, our providers or legal requirements. We will update the date above and give additional notice where a change materially affects how we use personal data.

13. Contact us

Volcanic Labs SLU

Email: [email protected]

Address: Plaza de Galicia, Local 7, 38612, Santa Cruz de Tenerife, Spain