Privacy policy

Who is responsible

Bellbolt is responsible (the "controller") for the data described here. To ask anything or exercise your rights, email us at support@bellbolt.com.

What we collect and why

• Your account: your name, email, phone, password (stored hashed, we cannot read it), business details, language and settings. We use it to create and run your account (legal basis: our contract with you).
• Billing: your plan, payment status and the billing details you give Stripe. Stripe processes your card; we never see the full number. We use it to charge your subscription and keep accounting records (legal basis: contract and legal obligation).
• Messages and setup requests: if you use the form on our home page, your name, business, contact, trade and country, to reply and help you get started (legal basis: steps you ask us to take before a contract).
• Security and technical data: IP address, browser and request logs, used for a short time to keep the service secure, stop abuse and fix errors (legal basis: our legitimate interest in a secure service).

Account and billing data are required to provide the service; without them we cannot open your account. We do not sell personal data, we do not use it for advertising and we do not send newsletters. We do not make decisions about you based only on automated processing.

Data we process for businesses

Businesses use Bellbolt to receive bookings and manage their customers. When you request a booking on a business’s website, that business is responsible for your data and Bellbolt processes it on its behalf, following its instructions and our data processing terms. Each business’s website has its own privacy page; to exercise your rights, contact the business. If you write to us, we will forward your request to it.

Cookies and similar technologies

Our home page does not use cookies. The Bellbolt app uses one strictly necessary cookie to keep you signed in, and stores your language and display preferences in your browser. We do not use analytics or advertising cookies, and we do not allow third parties to collect personal information about your activity over time and across websites through Bellbolt. Because we do not track you across sites, we treat browsers the same whether or not they send a "Do Not Track" signal.

Booking and sign-up forms use Cloudflare Turnstile to stop bots. It may set strictly necessary security cookies and processes technical signals from your browser; Cloudflare also uses those signals, as an independent controller, to improve its bot detection (Turnstile privacy policy). Because these cookies are strictly necessary for security, they do not require consent.

Who we share data with

Only with the providers we need to run Bellbolt, under contracts that protect the data:

• Cloudflare, Inc. (United States): hosting, database, file storage, content delivery and abuse protection, on our behalf.
• Stripe (Stripe Payments Europe, Limited, Ireland): subscription payments. Stripe processes billing data on our behalf, and as an independent controller for fraud prevention and its own legal obligations (Stripe privacy policy).
• Resend (United States): delivery of the emails the service sends, on our behalf.

Fonts are served from our own servers, so your browser does not contact Google or other font services.

We may also disclose data when the law requires it, or to protect our rights or someone’s safety.

International transfers

Cloudflare, Stripe and Resend may process data in the United States. All three are certified under the EU-US Data Privacy Framework (list of certified companies); where it does not apply, transfers rely on the European Commission’s standard contractual clauses. You can ask us for a copy of the safeguards that apply.

How long we keep data

• Account data: while your account is active and for 90 days after your subscription or unpaid trial ends, unless you ask us to delete it sooner.
• Billing records: at least 4 years under Spanish tax law and up to 6 years under the Commercial Code.
• Messages and setup requests: up to 12 months after our last contact, unless you become a customer.
• Security logs: a few days. Backups: up to 30 days.

Your rights

You can ask to access, correct or delete your data, to restrict or object to its processing, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. To do so, email us at support@bellbolt.com. We will answer within one month.

If you are in the European Union, you can also complain to a data protection authority; in Spain, the Agencia Española de Protección de Datos (aepd.es). If you are in California or another US state with a privacy law, you have the rights that law gives you, and we will not treat you differently for using them.

Security

We use encryption in transit, hashed passwords, separation between businesses, private storage for customer photos and protection against abuse. No system is completely secure; if a breach affects you, we will tell you as the law requires.

Minors

Bellbolt is a service for businesses and is only for people aged 18 or over. We do not knowingly collect data from minors.

Changes

If we change this policy, we will update the date at the top. If the change is important, we will tell account holders by email or in the app before it applies.