SaaS

Privacy policy

1. Data controller

  • Company: ONLINEVALLES SL
  • Tax ID (NIF): B66851593
  • Address: C/ Abat Escarré nº 7, entresuelo, 08206 Sabadell (Barcelona), Spain
  • Privacy contact email: martin@onlinevalles.com

This policy applies to the public website zaibel.com and to the application app.zaibel.com (together, "Zaibel").

2. Data we process

  • Account data: name, email and password (stored only as an irreversible hash), the organization you belong to and your role in it.
  • Billing data: your plan and subscription status. Payments are handled by Stripe; Zaibel does not store your card details.
  • Business data you enter: information about your clients and profiles (business name, website, industry, catalog, locations…) and the content you generate or edit in Zaibel.
  • WordPress connections: the site address and publishing credentials you provide, stored encrypted.
  • Google Search Console and Google Analytics 4 data: described in detail in section 3.
  • Contact form on zaibel.com: name, email and message.
  • Technical data: server logs (IP address, date and time, requested path and browser) required for the security and operation of the service.

3. Google user data

Zaibel lets you voluntarily connect, for each client profile, one Google Search Console property and one Google Analytics 4 property. This section explains how we access, use, store and share that data.

3.1 Permissions we request (read-only)

  • https://www.googleapis.com/auth/webmasters.readonly: view Search Console data for the sites your Google account has access to.
  • https://www.googleapis.com/auth/analytics.readonly: view Google Analytics data for the properties your Google account has access to.

Both permissions are read-only: Zaibel cannot create, change or delete anything in your Google account, Search Console or Google Analytics. Zaibel does not request access to your name, email, contacts or any other Google account data.

3.2 Data we obtain

  • Search Console: the list of sites you can access (so you can choose one) and, for the chosen site, aggregated daily metrics of clicks, impressions, CTR and average position, by search query, page, device and country.
  • Google Analytics 4: the list of accounts and properties you can access (so you can choose one) and, for the chosen property, its time zone, its list of key events and aggregated daily metrics: sessions, users, engaged sessions, page views, events and key events, by channel, source, medium, campaign, landing page, device, country and city.

This is aggregated statistical data about websites. We do not import revenue or e-commerce data, and we do not receive data that identifies individual visitors of those websites.

3.3 How we use it

We use Google data exclusively to provide the Zaibel features that display or analyze it:

  • the analytics dashboard of each profile;
  • the profile's SEO audits and content opportunities;
  • the query tools (MCP) used by the AI assistant you connect to Zaibel (ChatGPT or Claude), when you ask it about that profile.

We do not use Google data for advertising, we do not sell it, we do not use it to determine creditworthiness or for lending purposes, and we do not use it to train artificial intelligence models.

3.4 How we store and protect it

  • When you authorize the connection, Google gives us an access token. We store it encrypted; it is never sent to your browser and never written to logs. It is used only to import data.
  • Once a day we re-import the most recent days to keep the metrics up to date.
  • Data is stored on Microsoft Azure servers in the West Europe region (Netherlands, European Union), with access restricted to the staff who maintain the service.

3.5 Who we share it with

  • Users of your organization in Zaibel who have access to that profile.
  • The AI assistant you connect (OpenAI's ChatGPT or Anthropic's Claude): it only receives the data it requests when you ask it a question about the profile, and only if you have connected Zaibel to that assistant. That processing is also governed by the assistant provider's terms and privacy policy.
  • Microsoft Azure, as hosting provider acting as data processor.

We do not sell or transfer Google data to advertisers, advertising platforms, data brokers or information resellers. We may only disclose it where required by law.

3.6 Retention and deletion

  • We keep imported metrics while your organization has an account in Zaibel, so you can review their historical evolution.
  • If you disconnect a property in Zaibel, its access token is deleted immediately and we stop importing data from it. Metrics already imported are kept as the profile's history until you request their deletion or close your organization.
  • You can request at any time the deletion of the Google data of one or more profiles, or of your whole organization, by writing to martin@onlinevalles.com. We will handle the request within 30 days.

3.7 How to revoke access

You can disconnect Search Console or Google Analytics at any time from the profile's integrations section in Zaibel, or remove Zaibel's access from your Google account settings at https://myaccount.google.com/permissions.

3.8 Compliance with Google's policy

Zaibel's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Purposes and legal basis

  • Providing the contracted service (account, profiles, integrations, content generation and publishing): performance of the contract.
  • Charging the subscription and issuing invoices: performance of the contract and legal obligation.
  • Importing Google data: your express authorization on Google's screen, which you can withdraw at any time.
  • Answering contact form messages: your consent when you send it.
  • Security and fraud prevention: legitimate interest.

[PENDING legal review] Regarding your clients' data that you enter or connect in Zaibel, you act as data controller and ONLINEVALLES SL as data processor, under the data processing agreement signed with each customer.

5. Providers processing data on Zaibel's behalf

  • Microsoft Azure (hosting, database, file storage and content generation with Azure OpenAI): West Europe region. [PENDING: confirm Azure OpenAI region]
  • Stripe (payments and billing).
  • Mailjet (service emails).
  • Google (Search Console API and Google Analytics API, when you connect them).
  • Your WordPress site (only when you publish content to it).

6. International transfers

Data is hosted in the European Union. Some providers (such as Stripe, or the AI assistants you connect) may process data outside the European Economic Area; in that case they do so under the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses. [PENDING legal review]

7. Retention of other data

We keep account data while the account is active. After closure we delete it, except data we must keep by law (for example, billing data). Contact form messages are kept as long as needed to handle them. [PENDING: specify periods]

8. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to martin@onlinevalles.com. If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

9. Security

We apply technical and organizational measures to protect data: encrypted connections (HTTPS), encryption of third-party access tokens, passwords stored only as hashes, access control by organization and role, and activity logs.

10. Minors

Zaibel is a professional service and is not directed at minors.

11. Changes to this policy

If we change how we use data, we will update this policy and, when the change affects Google data or requires your consent, we will notify you and ask for it before applying the change.