Privacy Policy.

Section 01Who we are.

BABAV.CO is operated by BABAV LLC ("BABAV," "we," "us," or "our"), a Delaware limited liability company that runs an omnichannel AI-driven CRM and marketing automation platform. We provide software that helps you manage customer conversations, generate content, and run outbound campaigns across social platforms and email.

This Privacy Policy explains what data we handle, why we handle it, how we protect it, and what control you have over it. It applies to anyone using BABAV.CO — visitors, trial users, paying customers, and the customers of our customers whose data flows through our pipes.

Controller and processor. For the personal data of our own customers and site visitors — your account, billing, and usage information — BABAV acts as the data controller. For the content that flows through the service on your behalf — the messages, comments, emails, and contact records of the people you interact with — BABAV acts as a data processor, and you (our customer) are the controller. If you need a Data Processing Agreement (DPA) to meet GDPR Article 28 or similar obligations, we make a standard DPA available on request at support@babav.co.

Section 02Information we collect.

We split data into three buckets so it's clear what's what.

2.1 — Information you give us directly

• Account details: name, work email, workspace name, role (you sign in with a one-time email link — we don't store passwords)
• Billing information: company name, tax ID, billing address — credit card data is handled by our payment processor, never touches our servers
• Brand configuration: your tone settings, knowledge-base entries, silence rules, per-channel preferences
• Support communication: anything you email or message us

2.2 — Information from connected platforms

When you connect a channel (Threads, Instagram, Facebook, WhatsApp, YouTube, Gmail, Telegram, X, Discord, LinkedIn, Twitch), we receive whatever the platform's OAuth scope or bot connection grants. That typically includes incoming messages, comments, profile metadata for people interacting with you, post performance, and the ability to publish on your behalf. We only request the scopes we actually need for the features you've enabled. Google user data is covered in more detail in Section 05.

2.3 — Information collected automatically

• Usage data: pages viewed, features used, action counts, error logs
• Device data: browser, OS, screen size, IP address (truncated after 30 days)
• Performance telemetry: API latency, queue depth, channel sync health

Section 03How we use it.

We use the data we collect to:

• Operate the service — auto-reply, content generation, lead scoring, all of it
• Bill you accurately, which requires counting the actions we complete for you
• Detect abuse, fraud, and security incidents
• Improve product reliability — debugging from anonymized logs, never customer message bodies
• Send you operational email (receipts, security notices) and product updates (which you can opt out of)
• Comply with legal obligations when we actually have one

3.1 — Legal basis for processing (GDPR)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Performance of a contract — to provide the service you signed up for: connecting channels, generating and sending content, replying on your behalf, scoring leads, and running your account.
• Legitimate interests — to secure the platform, prevent fraud and abuse, debug and improve reliability from anonymized logs, and send you service-related communications. We balance these against your rights and don't use them to override your interests.
• Consent — for optional product-marketing email and any non-essential cookies, which you can withdraw at any time.
• Legal obligation — to keep records (for example, billing and tax records) and to respond to lawful requests.

For the data of the people you reach through the service, you determine the legal basis as the controller; BABAV processes it only on your documented instructions.

Section 04AI processing.

This is the part people usually want clarity on, so we'll be specific.

BABAV uses Google's Gemini 2.5 Flash via Vertex AI to generate text replies, summarize threads, and score sentiment. We use VEO 3.1 (standard and fast variants) via Vertex AI for video generation. All inference runs in Google Cloud, region us-west1.

Per our agreement with Google Cloud and Vertex AI, your inputs and outputs are not used to train any Google or third-party model. Vertex AI's data-use terms apply, which is why we picked it.

We also do not train our own models on your content. We don't have a foundation model. We're a tooling layer on top of Vertex AI, and that's it.

For diagnostics, we log AI request metadata (token counts, latency, error codes) but we strip message bodies and outputs from those logs within 24 hours unless a specific request has been flagged for debugging by you or our support team.

Section 05Google user data.

Because BABAV connects to Gmail and YouTube through Google's APIs, this section sets out exactly what Google user data we access, how we use it, and the commitments we make under Google's API Services User Data Policy. It supplements — and where Google data is concerned, takes precedence over — the rest of this policy.

5.1 — What we access

When you connect your Google account, we request only the scopes needed for the features you turn on:

• Gmail — send (gmail.send): to send the outbound emails and replies you compose or approve in BABAV. This is a send-only scope — it does not grant access to read your inbox.
• YouTube (youtube.upload): requested only if you connect a YouTube channel, to publish videos you generate in BABAV to your own channel.
• Basic profile (openid, email, profile): to sign you in and identify your account.

We request these scopes incrementally — only when you enable the feature that needs them — and never more than the feature requires. You can review and revoke BABAV's access at any time from your Google Account permissions page.

5.2 — How we use it

• To provide the user-facing features you've enabled: outbound and reply emails you compose or approve, and — if you connect YouTube — video publishing.
• To transmit content to Google on your behalf when you send an email or publish a video.
• For security, abuse and fraud detection, and to comply with the law where we have a genuine obligation.

OAuth tokens for your Google account are encrypted at rest (AES-256-GCM, keys in Google Cloud KMS) and wiped within minutes of you disconnecting the channel. We do not use Gmail or any Google user data to serve advertising, and we do not sell or rent it.

5.3 — Limited Use

In plain terms, that commitment means:

• We only use Google user data to provide or improve the features that are prominent in the BABAV user interface and that you have chosen to use.
• We only transfer Google user data to others where it is necessary to provide or improve those features, to comply with applicable law, or as part of a merger or acquisition after giving you notice.
• We do not use Google user data for serving advertisements, including retargeting, personalized, or interest-based advertising.
• We do not allow humans to read your Google user data unless: (a) you give explicit consent to read specific messages, for example when you raise a support request; (b) it is necessary for security purposes such as investigating abuse; (c) we are required to by applicable law; or (d) the data has been aggregated and anonymized and is used for internal operations.
• We do not use Google user data to train, develop, or improve generalized or non-personalized AI and/or machine-learning models. The Gemini and VEO models BABAV relies on are operated by Google under Vertex AI's terms, which prohibit using your inputs and outputs for model training.

Section 06How we share data.

We share data in a small number of well-defined situations:

• Service providers (subprocessors) — Google Cloud Platform (hosting, storage) and Google Vertex AI (Gemini and Veo inference); Stripe (payments); Postmark (transactional and outbound/inbound email delivery). Each is bound by a data processing agreement. We keep an up-to-date list and will notify account owners of material changes.
• Connected platforms — when you publish content or send replies, we transmit that content to the platform you've connected (Meta, Google, etc) on your behalf.
• Legal compliance — if we receive a valid subpoena, court order, or government request, we'll comply with what's legally required and notify you unless prohibited.
• Corporate transactions — if BABAV is acquired or merges, your data may transfer to the acquirer under terms at least as protective as this policy. We'll notify you in advance.

We do not share data with advertisers, data brokers, or anyone else for marketing purposes. There is no scenario where your customer messages end up in someone else's product.

Section 07Security.

Concrete measures, not vibes:

• OAuth tokens for all connected channels are encrypted at rest using AES-256-GCM with keys managed in Google Cloud KMS
• All traffic between you and BABAV uses TLS 1.3
• Database backups are encrypted and stored in a separate Cloud region
• Production access is restricted to authorized personnel, protected by multi-factor authentication, and logged
• We run automated dependency scanning on our code and third-party libraries
• SOC 2 Type I audit expected Q4 2026; Type II expected Q2 2027

No system is unbreakable. If we ever experience a breach affecting your data, we'll notify you within 72 hours of confirmation, with what we know, what's affected, and what we're doing about it.

Section 08Data retention.

We keep data only as long as we need it. Specifically:

• Active account data — for the life of your account, plus 30 days after cancellation in case you change your mind
• OAuth tokens — wiped within minutes of you disconnecting a channel
• Billing records — 7 years, as required by US tax law
• Anonymized analytics — indefinitely, but stripped of any personal identifiers
• Backups — encrypted backups roll off within 90 days, after which they're cryptographically destroyed

You can request earlier deletion at any time. See Section 10.

Section 09International transfers.

Our primary infrastructure is in the United States (Google Cloud us-west1). If you're accessing BABAV from outside the US, your data is transferred to and processed in the US.

For users in the EU, UK, and Switzerland, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission.

Regional residency for EU and Asia-Pacific customers is on our 2026 roadmap.

Section 10Your rights.

Depending on your location, you may have the right to:

• Access — request a copy of personal data we hold about you
• Correct — fix anything that's wrong
• Delete — ask us to erase your data, subject to legal retention requirements
• Export — get your data in a portable format (JSON or CSV)
• Restrict or object — limit how we process your data
• Withdraw consent — for anything we process on consent basis
• Lodge a complaint — with your local data protection authority

To exercise any of these, email support@babav.co. We'll respond within 30 days. We won't charge you for these requests unless they're clearly abusive.

For California residents: we do not "sell" personal information as defined by the CCPA. You have rights to know, delete, correct, and opt out, as described above.

Section 11Children's privacy.

BABAV is built for businesses and is not directed at children under 16. We don't knowingly collect data from anyone under 16. If you believe we have, contact us and we'll delete it.

Section 12Cookies & tracking.

We use a minimal cookie setup:

• Essential cookies — for authentication and security. These can't be disabled.
• Preference cookies — for things like dark-mode and last-viewed dashboard tab
• Analytics cookies — first-party only, no Google Analytics, no Facebook Pixel, no ad networks. We use a self-hosted analytics service that doesn't track individuals across sites.

Analytics and other non-essential cookies stay off until you accept them via our cookie banner — decline and none are set. You can also disable cookies in your browser without breaking the app, and change your choice anytime by clearing the babav_consent cookie.

Section 13Third-party services.

The integrations you connect (Threads, Instagram, Facebook, WhatsApp, YouTube, Gmail, Telegram, X, Discord, LinkedIn, Twitch) are governed by their own privacy policies. We send and receive data with these services on your authorization, but we're not responsible for how those companies handle data on their end.

When you connect a channel, the OAuth flow shows you exactly what permissions you're granting. Review them. Revoke them from your platform settings at any time.

Section 14Changes to this policy.

We update this policy when we change how we handle data. Material changes get emailed to account owners at least 30 days before they take effect. Minor edits (typos, link fixes, clarifying language) happen without notice. The "Last updated" date at the top reflects the most recent change.

We keep a changelog of every version. Email us if you want a copy.

Section 15Contact us.

For anything privacy-related — questions, requests, complaints, suggestions — or general support, email support@babav.co.

If you prefer postal mail, contact us first via email and we'll provide a current mailing address. We're remote-first and don't maintain a public office.