Privacy policy

Data controller

The controller of your personal data is Iraia Errandonea Sistiaga eta beste bat, C.B., tax ID E75147843, with registered address at Arraskuelarre 4, 2.º, 20180 Oiartzun (Gipuzkoa).

Data protection contact email: datos@ombaia.com.

Scope of this policy

This policy explains how we process the personal data of users who register and use the Ombaia platform (including trial participants or testers), people who join our waitlist, and people who visit our website.

When a customer uses Ombaia to manage data about their own prospects, that customer acts as the controller of such data and Ombaia acts as processor on their behalf. The processing of those prospects is governed by the data processing agreement (DPA) signed with each customer and by the customer’s own privacy policy.

What data we process, for what purpose and on what legal basis

Platform users: name, job title, email and account configuration data (focus, market, sectors, language, role, modules), in order to create and manage your account, authenticate you, provide the service and offer support. Legal basis: performance of the service contract (Art. 6.1.b GDPR).

Waitlist: email address, to notify you of the launch and give you access to the service when available. Legal basis: your consent when signing up (Art. 6.1.a GDPR).

Browsing and cookies: cookie identifiers, IP address and browsing data, to measure use of the website and improve the service. Legal basis: your consent through the cookie banner (Art. 6.1.a GDPR). You can configure or withdraw your consent at any time from the banner; see our Cookie Policy for more information.

How long we keep your data

Account data: while your account is active and for up to 12 months after cancellation, unless legal obligations require a longer period. Waitlist: until you access the service or ask to be removed. Cookies: according to the duration of each cookie, indicated in the Cookie Policy.

Who we share your data with

To provide the service we rely on providers that process data on our behalf (processors), under contract and with security safeguards: Supabase (database hosting and authentication), Vercel (application hosting and function execution), Anthropic (AI-based content generation and personalisation), Brevo (sending service-related emails) and Google, via Google Tag Manager (measuring website use).

We do not sell your personal data, nor do we share it with third parties for purposes other than those described, except where legally required.

International data transfers

Some of our providers (for example, Vercel and Anthropic) process data in the United States. These transfers are carried out with the safeguards required by the GDPR, through adherence to the EU-US Data Privacy Framework or the signing of the European Commission’s Standard Contractual Clauses.

Your rights

You may exercise your rights of access, rectification, erasure, restriction, objection and portability at any time, and withdraw your consent (without affecting the lawfulness of prior processing), by writing to datos@ombaia.com.

If you believe we have not properly handled your rights, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

Security

We apply technical and organisational measures to protect your data, including encryption of communications and stored data, isolation of each customer’s data, access control and activity logging.

Changes to this policy

We may update this policy to reflect legal or service changes. We will publish the current version on the website and indicate the date of the last update.