Legal

Privacy Policy.

Last updated: July 2026. We collect the minimum, encrypt what we keep, and never train a shared model on your customers. Here is the honest, full version.

Who we are

BABAV.CO ("BABAV", "we", "us") runs an omnichannel AI assistant that helps small brands and creators manage conversations, publish content, and run outreach across their connected social and email channels.

This policy covers everyone who touches the service: visitors, trial users, paying customers, and the people our customers interact with whose messages flow through the product.

Controller vs. processor. For your own account, billing, and usage data, BABAV is the data controller. For the content that passes through the service on your behalf — the messages, comments, and contacts of the people you reach — you are the controller and BABAV is your processor, acting on your instructions. Need a Data Processing Agreement? Email support@babav.co.

What we collect

You give us

  • Account — your email and workspace/brand details. You sign in with a one-time email link; we never store passwords.
  • Billing — company name and billing details. Card numbers are handled by Stripe and never touch our servers.
  • Brand configuration — your voice settings, knowledge base, rules, and per-channel preferences.
  • Support — anything you email us.

From your connected channels

When you connect a channel (Threads, Instagram, Facebook, WhatsApp, YouTube, Gmail, TikTok, X, Telegram, Discord, LinkedIn, and Twitch), we receive what that platform's OAuth scope or bot connection grants — typically incoming DMs, comments, mentions, or emails, basic profile metadata for the people interacting with you, and permission to publish or reply on your behalf. We request only the scopes the features you turn on actually need.

Automatically

  • Usage and action counts (needed to bill accurately), error logs, and performance telemetry.
  • Basic device/network data including IP address, used for security and abuse prevention.

How we use it

  • Operate the service — generate and send replies, publish content, score and add leads, run outreach.
  • Bill you accurately, which means counting the actions we successfully complete for you.
  • Detect and prevent fraud, abuse, and security incidents.
  • Improve reliability from operational logs and aggregated metrics.
  • Send operational email (receipts, security notices) and, only if you opt in, product updates.
  • Meet a genuine legal obligation when we actually have one.
We do not sell your data. We do not rent it, share it for advertising, or use it for anything beyond running the service you pay for.

AI processing & training

BABAV uses Google Vertex AI for its AI features: Gemini 2.5 (Flash and Pro) generates text replies, drafts, and summaries; Veo generates video. Optional voice narration on generated video uses ElevenLabs. Inference runs in Google Cloud (region us-west1).

Under Google's Vertex AI terms, your inputs and outputs are not used to train Google's or any third party's models.

On training: the part people ask about. BABAV does not have its own foundation model and does not train one on your content. The only learning that happens is per-customer voice learning — your feedback tunes only your own brand's replies. It is additive, reversible, and never feeds a shared, base, or platform-wide model, and is never shared across customers.

Google user data

Where you connect Gmail or YouTube, BABAV's use of Google user data follows the Google API Services User Data Policy, including the Limited Use requirements.

  • Gmail — send only (gmail.send): to send the outreach and replies you compose or approve. This scope cannot read your inbox.
  • YouTube: only if you connect a channel, to publish videos you generate to your own channel.
  • Basic profile (openid, email, profile): to sign you in.

We request scopes incrementally, only when you enable the feature. We do not use Google user data for advertising, do not sell it, and do not use it to train generalized AI models. You can revoke access anytime from your Google Account permissions.

How we share data

  • Sub-processors — the vendors below, each bound by a data-processing agreement.
  • Connected platforms — when you publish or reply, we transmit that content to the platform you connected, on your behalf.
  • Legal — a valid legal demand, complied with to the extent required, and we notify you unless prohibited.
  • Corporate change — if BABAV is acquired, your data may transfer under terms at least as protective as this policy.

There is no scenario where your customers' messages end up in someone else's product.

Sub-processors

We keep the vendor list short and functional:

  • Google Cloud — hosting (Cloud Run) and our database (Firestore), plus Firebase Hosting for the dashboard. Primary region us-west1 (United States).
  • Google Vertex AI — Gemini (text) and Veo (video) inference.
  • ElevenLabs — optional voice narration for generated video.
  • Stripe — payments and billing.
  • Resend — outbound transactional and outreach email delivery.
  • Postmark — inbound parsing of replies to your outreach (so two-way email works without reading your inbox).
  • Reoon — email-address verification for outreach lists.
  • Twilio — SMS opt-out (STOP/START) handling.

We will notify account owners of material changes to this list.

Security

  • OAuth tokens for every connected channel are encrypted at rest with AES-256-GCM; the encryption key is held in Google Secret Manager and never stored alongside the data.
  • Sign-in is passwordless (one-time email link); sessions are short-lived, signed tokens.
  • All traffic runs over HTTPS/TLS.
  • Production access is limited, authenticated, and logged.

No system is perfect. If a breach ever affects your data, we will notify affected account owners promptly with what we know and what we are doing.

Retention

  • Active account data — kept while your account is active, then purged on deletion (see below).
  • Channel tokens — wiped within minutes of disconnecting a channel.
  • Billing records — retained as long as tax and accounting law requires.
  • Backups — encrypted and roll off on a rolling ~90-day cycle.
  • Aggregated analytics — retained without personal identifiers.

Deletion & your rights

You can delete everything yourself in Settings → Account → Delete account, disconnect any single channel from Settings → Connections, or email us to do it for you. Full details and timelines are on our Data Deletion page.

Depending on where you live, you may have the right to access, correct, delete, export (JSON/CSV), restrict or object to processing, withdraw consent, and lodge a complaint with your data-protection authority. To exercise any of these, email support@babav.co; we aim to respond within 30 days. For California residents: we do not "sell" personal information.

International transfers

Our infrastructure is in the United States (Google Cloud, us-west1). If you use BABAV from elsewhere, your data is processed in the US. For EU, UK, and Swiss users we rely on Standard Contractual Clauses.

Children

BABAV is a business tool and is not directed at children under 16. We do not knowingly collect their data; if you believe we have, contact us and we will delete it.

Cookies

We keep cookies minimal and load site analytics only after you accept them. Full detail — including our use of Google Analytics 4 with Consent Mode — is in the Cookie Policy.

Changes & contact

We update this policy when our practices change and revise the date above; material changes are emailed to account owners in advance. Anything privacy-related: support@babav.co — a real person reads it.

Last updated: July 2026. This page is a clear-language summary of how BABAV actually works today; it is not a substitute for the binding agreement between you and BABAV, which controls if there is any conflict. Questions: support@babav.co.