Privacy Policy
1. In short
- Bebabum Consulting SLU (Spain) is responsible for your data on Tibelu.
- We use your data to run your account and your chats with AI companions, and to keep the service safe.
- To write the replies, your messages and the conversation memory are sent to our AI provider, Anthropic, in the United States. Anthropic does not use them to train its models.
- We do not sell your data. We do not use analytics, advertising cookies or tracking pixels.
- You can download your data and delete your account at any time from your account.
- For any privacy question, write to legal@bebabum.com.
2. Who is responsible for your data
- Controller: Bebabum Consulting SLU
- NIF (Spanish tax ID): B66950221
- Address: Carrer de Floridablanca 75, 08015 Barcelona, Spain
- Privacy contact: legal@bebabum.com
We have not appointed a Data Protection Officer, as we are not required to at this stage. Our privacy contact above handles all questions and requests about your data.
This policy applies to the website and web app at tibelu.com. It follows the EU General Data Protection Regulation (GDPR), the Spanish Data Protection Act (LOPDGDD) and, for users in the United Kingdom, the UK GDPR.
3. What data we collect
Data you give us when you sign up:
- email address;
- display name (optional);
- no password: you sign in with a one-time link that we send to your email;
- date of birth (to check you are 18 or older);
- your choices at sign-up: acceptance of the Terms and this Privacy Policy, your confirmation that you understand companions are AI characters, your explicit consent to process sensitive topics you share in chats, and whether you want to receive marketing emails. We record the date and time of each one.
Data created when you use Tibelu:
- your conversations: the messages you send and the replies of the companions;
- the "memory" of each conversation: a short summary created automatically so the companion can remember the context;
- safety marks ("flags") on some messages, for example "crisis", "blocked" or "engine error";
- a count of the messages you send each day (for the daily limit);
- where you came from when you signed up, if you used a link from a companion's Instagram account (for example "ig:carla"). We get this only from the link itself. Instagram does not send us any data about you.
Technical data:
- your IP address, browser type, the pages you request, date and time, in our server logs, to run and protect the service;
- the strictly necessary cookies described in our Cookie Policy.
Data for paid plans (only when paid plans are available and you buy one): plan, dates, amounts, billing country and the status of your payments. Card details are handled directly by the payment provider. We do not see or store your full card number.
4. Sensitive information in your chats
You do not need to share sensitive information to use Tibelu. But in a personal conversation you may decide to tell a companion about your health, feelings, beliefs, sexual orientation or other sensitive matters. If you do, we use this information only to reply to you, keep the memory of your conversation and protect your safety. We never use it for advertising or to build a profile about you for other purposes.
The legal basis is your explicit consent (Article 9(2)(a) GDPR), which you give at sign-up. You can withdraw it at any time by deleting your account. If our safety system detects that your life or health may be at risk, we may also process this information to protect your vital interests (Articles 6(1)(d) and 9(2)(c) GDPR), as explained in our crisis protocol.
Please do not share other people's sensitive information, or identity documents, bank details or passwords, in your chats.
5. Why we use your data and on what legal basis
| Purpose | Data | Legal basis (GDPR) | How long we keep it |
|---|---|---|---|
| Create and manage your account, let you log in | Email, display name, password hash, sign-up choices | Performance of the contract (Art. 6(1)(b)) | Until you delete your account |
| Let you chat with the companions and keep the memory of each conversation | Messages, replies, conversation memory, display name | Performance of the contract (Art. 6(1)(b)); for sensitive information, explicit consent (Art. 9(2)(a)) | Until you delete your account |
| Check you are 18 or older and protect minors (including stopping a chat if there are signs the user is a minor) | Date of birth, messages | Performance of the contract (Art. 6(1)(b)) and our legitimate interest in keeping minors off the service (Art. 6(1)(f)) | Until you delete your account |
| Safety: detect crisis messages and reply with helplines, block content that breaks our rules, review flagged messages, prevent abuse | Messages, flags, account data | Legitimate interest in the safety of users and of the service, and compliance with the law (Art. 6(1)(f) and 6(1)(c)); vital interests in an emergency (Art. 6(1)(d) and 9(2)(c)) | With the conversation, until you delete your account |
| Keep proof that you accepted the Terms and confirmed you understand companions are AI | Dates and times of acceptance and confirmation, version of the Terms | Legal obligation and legitimate interest in proving compliance (Art. 6(1)(c) and 6(1)(f)) | Until you delete your account (see "Blocked data" below) |
| Apply the daily message limit and protect the service against attacks and misuse | Daily message count, IP address, server logs | Legitimate interest in the security and cost control of the service (Art. 6(1)(f)) | Message count: until you delete your account. Server logs: kept for a short period and then overwritten automatically. |
| Know which Instagram account brought you to Tibelu, to measure our communication | Sign-up source (for example "ig:carla") | Legitimate interest in understanding which channels work (Art. 6(1)(f)). We look at it in aggregate. | Until you delete your account |
| Send you news and offers by email (only if you ticked the box) | Email, display name, marketing choice | Your consent (Art. 6(1)(a) GDPR and Art. 21 LSSI-CE) | Until you withdraw your consent or delete your account |
| Manage paid plans, payments, invoices and refunds (when available) | Plan, amounts, dates, payment status, billing country | Performance of the contract (Art. 6(1)(b)) and tax and accounting obligations (Art. 6(1)(c)) | 6 years from the end of each financial year (Spanish Commercial Code, Art. 30), or longer if tax law requires it |
| Answer your questions, privacy requests and complaints | Email, content of your request | Legal obligation (Art. 6(1)(c)) and legitimate interest in handling your request (Art. 6(1)(f)) | As long as needed to handle the request, then up to 3 years to prove we handled it |
| Transfer Tibelu to a new company (see section 11) | All account and conversation data | Legitimate interest (Art. 6(1)(f) GDPR and Art. 21 LOPDGDD) | Not applicable: the new company becomes responsible |
When we rely on legitimate interest, you can object at any time (see section 9). We have checked that our interest does not override your rights.
We do not: sell your data, share it with advertisers, use it for targeted advertising, or use your conversations to train AI models.
6. How the AI uses your data
- To generate each reply, we send to our AI provider, Anthropic, the message you wrote, the recent messages of the conversation, the conversation memory and the character's instructions. We do not send your email, your date of birth or your display name.
- The conversation memory is a summary created automatically by the AI. It is used only inside that conversation, to make the companion consistent.
- If a message shows a risk of suicide or self-harm, it is not sent to the AI model. The service replies with helplines instead.
- Our automated systems mark some messages (flags). Our team may read flagged messages, and the conversation around them, to check that the safety rules work and to improve them. Our team may also read a conversation when you report a problem or ask us to.
- We do not make decisions based only on automated processing that have legal or similarly significant effects on you. If an automated system stops a chat or restricts your account, you can ask for a human review at legal@bebabum.com.
7. Who receives your data
We share your data only with the providers we need to run Tibelu. They act as our "processors": they may use your data only on our instructions and under a contract that protects it (Article 28 GDPR).
| Provider | Service | Where the data is |
|---|---|---|
| Amazon Web Services (Amazon Web Services EMEA SARL) | Server hosting, database and backups (Amazon EC2), and domain name system (Route 53) | European Union (Ireland, region eu-west-1) |
| Anthropic PBC | AI model (Claude) that generates the companions' replies and the conversation memory | United States |
| Payment provider (only when paid plans exist): Stripe or Paddle | Payment processing. If we use Paddle, Paddle acts as seller of record and is a separate controller of the payment data under its own privacy policy. | Depends on the provider. We will update this table before paid plans start. |
Anthropic and your data: under its commercial terms, Anthropic may not train its models on the data we send. It keeps this data only for a limited time , unless its automated safety systems flag the content (in that case it may keep it for up to 2 years) or the law requires it to keep it longer.
Instagram: the companions' Instagram accounts are run by us on Instagram, a service of Meta. When you use Instagram, Meta processes your data under its own privacy policy. We do not receive data from Meta about your visit to Tibelu.
Other recipients: public authorities, courts or law enforcement when the law requires it. In an emergency where someone's life may be in danger, we may share the minimum necessary data with emergency services.
8. Transfers outside the European Economic Area
Anthropic processes data in the United States. We protect this transfer with the European Commission's Standard Contractual Clauses included in Anthropic's data processing agreement (Article 46 GDPR), and, where the provider is certified, with the EU-US Data Privacy Framework (Article 45 GDPR). You can ask us for a copy of the safeguards at legal@bebabum.com.
Our hosting is in the European Union. If any other provider processes data outside the EEA, we will use the safeguards required by the GDPR.
9. Your rights
You have the right to:
- access your data and get a copy;
- rectify data that is wrong or incomplete;
- erase your data;
- restrict how we use your data in some cases;
- port your data: receive it in a structured, machine-readable format;
- object to uses based on our legitimate interest, and to marketing at any time;
- withdraw your consent at any time, without affecting what we did before;
- not be subject to decisions based only on automated processing with legal or similarly significant effects, and to ask for human review.
How to use your rights:
- Download your data in JSON format at any time from your account (data export).
- Delete your account and all your conversations from your account.
- For any other request, write to legal@bebabum.com from the email of your account. If we cannot confirm who you are, we may ask for more information. We do not need an ID document in most cases.
We answer within one month. If a request is complex, we may extend this by two more months and we will tell you why. Using your rights is free.
10. Right to complain
If you think we have not respected your rights, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), C/ Jorge Juan 6, 28001 Madrid, Spain, www.aepd.es. You can also complain to the data protection authority of the EU country where you live or work. In the United Kingdom, you can complain to the Information Commissioner's Office (ICO), ico.org.uk. We would like to help first, so please write to us at legal@bebabum.com.
11. If Tibelu moves to another company
We plan to transfer Tibelu to a new company. If we do, your account and conversation data will be transferred to that company, which will become the controller of your data and will continue to use it for the same purposes described in this policy. We will tell you at least 30 days before the transfer, with the name and contact details of the new company. If you do not want your data to be transferred, you can download it and delete your account before the transfer date.
12. How long we keep data
- We keep your account and conversations while your account is open.
- When you delete your account, we delete your account, conversations, memory and flags from our live database at once.
- Our backups are overwritten automatically within 14 days. Until then, deleted data stays only in those backups, with restricted access, and is used only if we must restore the service after a failure. If we ever restore a backup, we delete again the accounts that had been deleted.
- Blocked data: when Spanish law requires it (Article 32 LOPDGDD), we may keep a minimal record (for example, your email and the dates you accepted the Terms) blocked, with very restricted access, only to answer legal claims or requests from authorities, and only for the legal limitation period.
- The periods for each purpose are in the table in section 5.
13. Minors
Tibelu is only for adults aged 18 or older. We ask for your date of birth at sign-up and we do not let people under 18 create an account. If there are signs during a chat that a user is a minor, the conversation is stopped and we may suspend the account. If we learn that we hold data of a person under 18, we delete it. If you think a minor is using Tibelu, please tell us at legal@bebabum.com.
14. Security
We protect your data with technical and organisational measures that fit the risk, including:
- encrypted connections (HTTPS) between your browser and our server;
- no passwords: sign-in links are signed, work once and expire after a few minutes;
- hosting in the European Union with a provider that holds recognised security certifications;
- access to personal data limited to the people who need it, with strong authentication;
- daily backups, kept for 14 days;
- regular security updates and reviews.
No system is completely secure. If a security incident affects your data and creates a high risk for you, we will tell you without undue delay, and we will notify the AEPD when the law requires it.
15. Marketing emails
We will send you marketing emails only if you ticked the optional box at sign-up. At present we do not send any. Every marketing email will include an easy way to unsubscribe, and you can also write to legal@bebabum.com. Messages about your account or the service (for example, changes to the Terms) are not marketing and we may send them to you when needed.
16. Changes to this policy
We may update this policy, for example if we add a new provider or a new feature. We will publish the new version on this page with a new date and version number. If a change is important, we will tell you by email or in the app before it applies. If a change requires your consent, we will ask for it.
17. Contact
For any question about your data: legal@bebabum.com, or by post to Bebabum Consulting SLU, Carrer de Floridablanca 75, 08015 Barcelona, Spain.
This Privacy Policy is version 1.0, prepared for the alpha version of Tibelu.