Privacy Policy

The entity that is responsible for processing your personal data when you purchase or interact with us is TIMBAL TECH, S.L. (hereinafter, “Timbal AI”), with VAT No. B19934314 and registered office at Carrer de Pere IV, 105, 109, Sant Martí, 08018 Barcelona, Spain.

Timbal AI processes personal data in the course of its business activities and, in particular, through the website www.timbal.ai, in accordance with the applicable personal data protection legislation. For any questions relating to the processing of your personal data, you may contact Timbal AI at privacy@timbal.ai.

At all times, Timbal AI will process personal data in accordance with the applicable legislation, including Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (“LOPDGDD”).

We recommend that you read this Privacy Policy together with our Cookie Policy.

Privacy statement

At Timbal AI, we recognize the importance of protecting users’ personal data and are committed to processing it in accordance with applicable data protection laws and the principles of lawfulness, fairness, transparency, data minimization, integrity, confidentiality and accountability.

The purpose of this Privacy Policy is to inform users of the website www.timbal.ai and the Services about how their personal data is processed, including what data may be collected, the purposes for which it is used, the legal bases relied upon, and the rights available to data subjects.

Timbal AI is committed to processing only the personal data necessary for each purpose and to implementing appropriate technical and organizational measures to safeguard such data against unauthorized access, loss, alteration or disclosure.

What type of personal data do we collect and how?

Information you submit or make available

If you request information or contact us through our website’s contact forms, we may ask you to enter certain personal data such as first name, last name, company name, country, email address and phone number.

If you choose to use the voice concierge on our contact page, your microphone audio is streamed to Timbal and processed in real time by our speech-to-text, language-model and text-to-speech providers (listed in our Sub-processors page) solely to understand your request and pre-fill the contact form for you. The call starts only after you press the call button and choose a language, and you can end it at any time. We process this audio to answer your enquiry (performance of pre-contractual measures at your request); the resulting form fields are handled exactly like a form submission.

Information we collect about your use of our Website

When you use our Website, we use standard automated data collection tools such as cookies. You can learn more about what types of data are collected, how it is used and why, as well as how to opt out of certain collection, by visiting our Cookie Policy. Google Analytics and PostHog (including masked session replay) are loaded only after you accept analytics cookies. The Website host, Framer, also runs a cookieless audience measurement that hashes the IP address and user agent with a daily-rotating secret and does not set a persistent identifier. While the vast majority of this data is not personal data, some may include certain information which may be considered personal data depending on where you live, like a user’s IP address. To the extent this data contains personal data, it will be treated as personal data under this Privacy Policy.

Information we collect about your use of our Services

When you use our Services, information and data is automatically generated and collected about how you are using our Services, since it can help us to understand how to better provide the Services to you. Most usage data is not personal data, and includes information like browser type, the pages or features of our Services accessed or used by the user and the time spent on those pages or features, and other statistical information. Some of this usage data may include certain information which may be considered personal data depending on where you live, like a user’s IP address. To the extent this data contains personal data, it will be treated as personal data and is covered under this Privacy Policy.

Special categories of personal data

Timbal AI does not intentionally collect or require special categories of personal data (such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data or sexual orientation).

Where such data is exceptionally included in content, files or information submitted by users in connection with the Services, it will only be processed where strictly necessary for the provision of the Services and subject to the safeguards required under applicable data protection laws.

For what purposes do we process your personal data?

We will process your personal data for different purposes depending on your relationship or interaction with us:

Provision of Services

When you use our Services, we may process your data:

• to provide, maintain and improve our Services;

• for billing, payment, or account management; for example, to identify your account and correctly identify your usage of our services;

• to investigate security issues, prevent fraud, or combat the illegal use of our Services;

• to provide you with support and respond to your questions, comments, and requests, including to keep in contact with you regarding the services you use;

• to generate and analyze statistical information about how our Services are used in the aggregate.

Legal basis: performance of a contract with the user and/or the implementation of pre-contractual measures, as well as Timbal AI’s legitimate interest in ensuring the security, integrity and continuous improvement of its Services.

Commercial communications

If you provide us with consent, or if you are already a Timbal AI customer and you have not opted out, we will process your data to send you emails and other content to promote our services. The communications we send you will be tailored to the information we have identified from information you have provided us.

Legal basis: the data subject’s consent and, where permitted under applicable legislation, Timbal AI’s legitimate interest in sending communications regarding products or services similar to those previously contracted or requested.

You can opt out of receiving this type of marketing content at any time by clicking the unsubscribe link at the bottom of any of our emails.

Analytics for internal analysis

When you use our Services (the Timbal AI platform, not this Website), we may process your personal data and aggregated information to understand how those Services are most in demand, identify areas where we can improve, and carry out internal analysis and statistics of our business activity. Measurement of this Website — Google Analytics, PostHog and any session replay — is not based on legitimate interest; it is described in our Cookie Policy and takes place only if you accept analytics cookies.

Legal basis (Services only): Timbal AI’s legitimate interest in improving, developing and optimizing its Services and business operations. Website analytics cookies rely on consent, as set out in the Cookie Policy.

Social networks

In the context of our social profiles we can process your data when you interact directly with us and send us a direct message to respond to any request. We can also track any mentions made of our brand through public profiles on social networks.

Legal basis: the data subject’s consent, the implementation of pre-contractual measures at the data subject’s request and/or Timbal AI’s legitimate interest in managing its online presence and responding to user interactions.

Compliance with legal obligations and defence of rights

We may process personal data where necessary to comply with applicable legal obligations, respond to requests from competent authorities, manage incidents and disputes, and protect or defend the rights and legitimate interests of Timbal AI.

Legal basis: compliance with legal obligations and, where applicable, Timbal AI’s legitimate interest in the establishment, exercise or defence of legal claims.

Who do we share your personal data with?

We may share your personal data with third parties as follows:

• with service providers that assist us in the provision of our services and the operation of our business, acting on our behalf and subject to the corresponding data processing agreements and confidentiality obligations;

• with payment service providers and other suppliers where necessary to provide our Services or manage our contractual relationship with you;

• with competent public authorities, courts, regulators or law enforcement bodies where required by applicable law, legal process or regulatory obligations;

• where you have expressly requested or authorized us to share your personal data with a third party;

• in connection with a merger, acquisition, corporate restructuring, financing transaction or sale of all or part of our business, provided that the recipient is subject to appropriate confidentiality and data protection obligations.

Where we use service providers, cloud infrastructure providers or AI technology providers to process personal data on our behalf, they will act as data processors and only process personal data in accordance with our instructions and subject to appropriate contractual safeguards. The current list of such providers is available on our Subprocessors page.

Where we act as a processor on behalf of a business customer, our processing is governed by our Data Processing Addendum.

Do we transfer your personal data internationally?

Timbal AI may use service providers, cloud infrastructure providers and technology providers located outside the European Economic Area (“EEA”) or that may access personal data from outside the EEA in the course of providing their services.

Where such transfers occur, Timbal AI will ensure that appropriate safeguards are implemented in accordance with applicable data protection laws, including, where required, the use of Standard Contractual Clauses approved by the European Commission or reliance on other valid transfer mechanisms recognised under the GDPR.

How long do we store your personal data for?

Timbal AI will retain personal data only for as long as necessary to fulfil the purposes for which it was collected. Once those purposes have been fulfilled, the personal data will be deleted or, where necessary, retained in a duly restricted form (blocked) for the periods required under applicable law or for as long as liabilities may arise in connection with its processing.

Do you know your rights regarding your personal data?

• Right to access your personal data. You are entitled to obtain a copy of the personal data that we have about you and information about how we use it.

• Right to rectification. You may request that we update or correct the personal data we have about you.

• Right to erasure. You may ask us to delete your data. Please note that such action may mean that we will have to stop providing you with some services.

• Right to object. You may object to the processing of your personal data in the circumstances provided for under applicable data protection legislation.

• Right to restriction of processing. You may request that the processing of your personal data be restricted in the circumstances provided for under applicable data protection legislation.

• Right to data portability. Whenever the necessary requirements are complied with, you can ask for your personal data in a commonly used electronic format, and for it to be transmitted to another third party of your choice.

• Right not to be subject to automated decision-making. You are entitled not to be subject to a decision based solely on automated decision-making, including profiling.

• Right to withdraw consent. If you have provided your consent for any specific data processing, you can withdraw your consent at any time.

How to exercise your rights

You may exercise the rights described in the previous section by submitting a request to Timbal AI, together with the information necessary to verify your identity, through any of the following channels:

Email: privacy@timbal.ai

Postal address: Carrer de Pere IV, 105, 109, Sant Martí, 08018 Barcelona, Spain.

Timbal AI will process and respond to such requests within the timeframes and in accordance with the requirements established under applicable data protection legislation.

If you believe that the processing of your personal data infringes applicable data protection laws, or if you are not satisfied with the response received regarding the exercise of your rights, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) through its official website: www.aepd.es.

User responsibility

The user warrants that they are over eighteen (18) years of age and that the data provided to Timbal AI is true, accurate, complete and up to date. The user undertakes to keep the information provided duly updated and shall be responsible for its accuracy at all times. The user shall be liable for any false or inaccurate data provided through the Website or the enabled contact channels, as well as for any direct or indirect damage this may cause to Timbal AI and/or third parties.

Security measures

Timbal AI is committed to processing users’ personal data with the utmost confidentiality, observing the duty of secrecy at all times and acting in accordance with Article 32 of the GDPR. To this end, Timbal AI will implement the technical and organisational measures necessary to ensure the security of personal data and to prevent its alteration, loss, unauthorised processing or access, taking into account the state of the art, the nature of the data processed and the risks to which it may be exposed, including through an Information Security Management System (ISMS) implemented in accordance with the ISO/IEC 27001:2022 standard.

Third-party links, content and integrations

The Timbal AI Website may include links to third-party websites and, where applicable, third-party content or services integrated into the Website itself. Such sites, content or services are outside Timbal AI’s control and are governed by their own terms and privacy policies.

Timbal AI is not responsible for the privacy practices of such third parties, and we therefore recommend that users review the privacy and cookie policies applicable to those third-party websites, content or services before interacting with them.

Can changes be made to this Privacy Policy?

Yes, this privacy policy can be updated. We recommend that you read this privacy policy frequently. If any significant changes are made, we will notify you separately.

Cookie processing

You can find further information on how the Website’s cookies process certain personal data in our Cookie Policy.