Privacy Policy

In compliance with Mexico's Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), Argentina's Personal Data Protection Law 25.326, the European Union's General Data Protection Regulation (GDPR), Spain's Organic Law on Data Protection and Guarantee of Digital Rights (LOPDGDD), and other applicable international laws, BellMates acts as a Data Processor regarding guest data, and as a Data Controller regarding Host data.

Host Data: Name, email, property address, house rules and guides, and billing data. Payments are securely processed externally by Lemon Squeezy (Merchant of Record); BellMates does not store credit card or banking information.

Guest Data: Basic session metadata (anonymized IP address, browser type) and the text of conversations held with the Artificial Intelligence (Bella).

We process your personal data under the following legal bases: (a) Performance of the subscription contract for Host data; (b) Implied consent by initiating a conversation with the assistant for Guest data; (c) Legitimate interest for service improvement and abuse prevention.

You may withdraw your consent at any time by writing to privacy@bellmates.com, without affecting the lawfulness of prior processing.

Guest messages are processed through top-tier Artificial Intelligence providers via enterprise API access with active Data Processing Agreements (DPA). BellMates reserves the right to change, add, or replace AI providers at any time without prior notice, always maintaining equivalent or higher standards of privacy and security.

AI Privacy Guarantee: Data and transcripts are NOT used to train public foundational models. Chat logs are temporarily retained (maximum 30 days) exclusively for error debugging and improving property-specific context, after which they are irreversibly deleted.

We never sell your personal data. We only share strictly necessary information with essential infrastructure providers: Lemon Squeezy (payment processing), Vercel/AWS (secure hosting), and AI API providers.

All our providers comply with certified security standards and maintain active Data Processing Agreements (DPA).

Your data may be transferred to and processed on servers located outside your country of residence, including the United States and other jurisdictions where our infrastructure and artificial intelligence providers operate. These transfers are carried out under legally recognized mechanisms, including Standard Contractual Clauses (SCC), the EU-US Data Privacy Framework, and European Commission adequacy decisions (such as the one granted to Argentina).

By using our services, you expressly consent to this international transfer in accordance with the applicable legislation in your jurisdiction (Art. 36 LFPDPPP in Mexico, Art. 12 Law 25.326 in Argentina, Arts. 46-49 GDPR in the EU).

Mexico: Every user has the rights of Access, Rectification, Cancellation, and Opposition (ARCO Rights) under the LFPDPPP. Response deadline: 20 business days.

Argentina: Every data subject has the right to request information, rectification, deletion, and confidentiality of their data under Law 25.326 (Habeas Data), and the right to file a claim with the Agency for Access to Public Information (AAIP). Response deadline: 10 calendar days.

European Union / Spain: Every user has the rights of access, rectification, erasure, portability, restriction, and objection under the GDPR and LOPDGDD. You may file a complaint with the Spanish Data Protection Agency (AEPD) or the competent supervisory authority. Response deadline: 30 calendar days.

To exercise any of these rights, write to privacy@bellmates.com.