1. GUIDING PRINCIPLES
At BuddyBeam, we are committed to the responsible development and deployment of artificial intelligence technologies. This document describes our principles, practices, and commitments regarding AI governance for BuddyBeam Avatars.
Transparency
- Users always know they are interacting with a digital avatar powered by artificial intelligence
- The avatar is clearly presented as an AI assistant, not a real person
- We provide clear information about the service's capabilities and limitations
Privacy and Data Protection
- We comply with the General Data Protection Regulation (GDPR) and Spanish legislation
- All processing takes place on our own servers located in Spain, with no cloud services or third-party providers
- We implement encryption in transit (TLS) and at rest for all information
Responsible Use
- Our technology is designed exclusively to enhance website visitor experience and business operations
- We actively prohibit any use that could result in discrimination or harm
- The avatar complements, never replaces, professional human attention
2. DATA AND STORAGE
What data we process
| Data type | Description | Retention |
|---|---|---|
| Conversations | Voice interactions between users and the avatar during an active session | Text transcripts are retained for as long as needed for quality and, with your consent, for training; audio is retained, with your consent, to train our models and is irreversibly anonymized after processing |
| Client data | Information about services, products, and configuration preferences provided by the client | For the duration of the contract |
| Website content | Information extracted from the client's website to enrich the avatar's knowledge | For the duration of the contract |
| Contact requests | Information submitted through the contact form (name, email, company, phone, message) | Encrypted at rest with AES-256-GCM. Retained for the purpose of responding to inquiries |
How we protect data
- Encryption in transit: All communications use HTTPS/TLS protocol
- Encryption at rest: Stored data is encrypted on our servers using AES-256-GCM
- Restricted access: Only authorized personnel can access the systems
- Own servers in Spain: All infrastructure is owned by BuddyBeam and located in Spain, with no cloud services or third parties
How we use data to improve
- We train our models with your consent: the audio and transcripts of conversations are used to improve and train (fine-tuning) our own artificial intelligence models. Where possible, they are irreversibly anonymized, ceasing to be personal data. You can withdraw your consent at any time
- 100% in-house processing: all speech recognition, transcription and response generation runs on our own infrastructure in Spain, without sending data to the cloud or to third parties
What we do NOT do with data
- We do not sell or transfer your data: it is never sold, transferred, or shared with third parties, except by legal obligation
- We do not use external AI providers: no third party or cloud service is involved in voice or language-model processing
- We do not create commercial profiles: we do not use data for advertising or targeted marketing
3. SHARED RESPONSIBILITY
BuddyBeam's Responsibilities (BuddyBeam S.L.)
- Develop and maintain the technology securely and responsibly
- Implement technical and organizational security measures
- Act as data processor in respect of providing the service, and as data controller in respect of training our own models with anonymized data, in accordance with the consent obtained
- Provide management and control tools to the client
- Notify security incidents as established in the contract
Client's Responsibilities
- Act as data controller for their website visitors' data
- Inform website visitors about the use of AI technology on their site
- Obtain necessary consents when applicable
- Provide truthful and updated information about their services
- Define the limits and scope of the avatar's service
4. SERVICE LIMITATIONS
What BuddyBeam Avatars is NOT
Our AI avatar is designed to assist, inform, and enhance website interactions. In no case does it constitute or replace:
- Medical, health, or emergency services
- Therapeutic or psychological care
- Legal or financial advice
- Health or security monitoring systems
- Human staff for critical situations
Nature of AI
- The service uses generative artificial intelligence
- Responses are generated in real time and may contain inaccuracies
- The system is designed to redirect to human support when it detects situations beyond its scope
5. OVERSIGHT AND CONTROL
Human oversight
- Clients can configure, limit, and deactivate the avatar at any time from their dashboard
- Escalation protocols exist for situations requiring human attention
- The administration dashboard allows configuring the service and reviewing usage metrics
Content moderation
- We implement filters to prevent inappropriate or harmful content
- The system is designed to reject requests that violate our usage policies
- We actively monitor to detect and prevent misuse
6. REGULATORY COMPLIANCE
EU Artificial Intelligence Act
BuddyBeam Avatars is designed to comply with EU Regulation 2024/1689 (AI Act). Our service, when used as intended, does not constitute a high-risk AI system. We implement transparency obligations including clear disclosure that users are interacting with an AI system.
GDPR and LOPDGDD
We comply with:
- Regulation (EU) 2016/679 (GDPR)
- Organic Law 3/2018 on Data Protection (LOPDGDD)
- Privacy by design and by default principles
7. CONTINUOUS IMPROVEMENT
We commit to:
- Periodically review and update our governance policies
- Stay current with regulatory advances in AI matters
- Incorporate industry best practices
- Listen to client and user feedback to improve our processes
8. CONTACT
For AI governance inquiries:
BUDDYBEAM, S.L.
Email: dpo@buddybeam.app
Address: Carrer del Pare Palau, N.º 5, Izquierda, Entresuelo 3, 43001 – Tarragona, Spain