Privacy Policy

Last updated: October 2026

At aiBrenda we take your privacy seriously. Here we explain, clearly, what data we process, what we use it for and what rights you have. We are a Spanish company and comply with the EU General Data Protection Regulation (GDPR) and Spain’s Organic Law 3/2018 on Data Protection (LOPDGDD).

1. Who is responsible for your data

Owner: Comercio Social Digital, S.L.
Tax ID (NIF): B86597390
Registered address: C/ Rufino González, 14, 28037 Madrid (Spain)
Email: info@aibrenda.co
Website: https://aibrenda.co

2. The most important points, in a nutshell

We do not keep your audio. Your voice is processed in the moment and is not recorded.
We keep a few extracts from both sides of your conversations, as text, so that Brenda remembers you, just as anyone you talk to often would.
You can ask Brenda to forget something and she will delete it from her memory.
We do not ask for or keep your postal address or bank details.
We do not ask for health, financial or legal information. If you talk about these subjects, Brenda will recommend that you consult a professional.
We do not sell your data or use it for advertising.

3. What data we process

Nickname and secret PIN

To protect your privacy, we recommend that you do not use your real name when you create an account, and certainly not your full name.

In the future we will add sign-in with an external account (for example, your Google account) or with an email address and password. At that point we will also receive the basic details that account shares, such as your name and email address.

Your voice, only while you are talking

When you use TALK mode, the microphone picks up your voice and sends it in real time to the artificial intelligence provider (currently Google Gemini) so that Brenda can understand you and reply. aiBrenda never records, stores or keeps the audio. Nor do we keep any biometric data from your voice (what is known as a “voiceprint”).

What you talk about, as text

What you and Brenda say is converted into text (“transcribed”). From those transcripts we keep:

Your recent history: roughly your last 20 exchanges, so that you can look back over them in the app.
Brenda’s memory: short text extracts from your chats (for example, your granddaughter’s name, or that you love musicals). That way Brenda remembers you and the conversation feels more natural, as it would with a friend or a neighbour.

Usage data

Information about how the service is used: when you connect, how long you talk, how many Brendys (tokens) you use, technical errors and the type of device. This information is essential for the system to work, for keeping track of your Brendy (token) balance and for improving aiBrenda.

What Brendys, or tokens, are

Tokens (which we call Brendys) are a unit of measurement used in computing, especially in artificial intelligence. A very common word (e.g. “December”) may count as a single token, while a rarely used one (e.g. "Unforgettably") would probably need three tokens. We cannot predict exactly how many tokens are used per minute of conversation; we only have an estimate. That is why aiBrenda’s services are used and paid for in tokens, not in time.

Your purchase data

Google Play tells us which plan or top-up you have bought and whether it is still active. We do not receive your payment details.

4. What we do NOT ask for or keep

Your postal address. Apart from usage time, aiBrenda does not sell you anything. It offers delightful conversation.
Bank or payment details: no accounts, no credit or debit cards, and no other electronic means of payment. Payments are handled by Google Play.
Audio or recordings of your voice. When you talk to Brenda your voice is sent directly to Google's AI (Gemini) that processes it and answers. We do not record your voice at all.
Health, financial or legal information. Brenda does not ask you for it. If you mention anything like this, she will suggest that you consult an expert (your doctor, a solicitor, an adviser…). Please do not share this kind of information with Brenda. If it does come up in a conversation, it may remain in your recent history; you can ask Brenda to forget it, or email us and we will delete it.

5. What we use your data for, and the legal basis

We use this data to provide the service That is, creating your account, chatting, remembering what you tell us, keeping track of your Brendys, etc.. The legal basis is the contract you accept when you use aiBrenda.
Managing your purchases and subscriptions with Google Play. Legal basis: the Google Play contract you accepted to download the app.
Security, abuse prevention and fixing faults. The legal basis is our legitimate interest in the service running securely.
Producing our own statistics to improve aiBrenda, using anonymised data whenever possible. The legal basis is our legitimate interest in understanding usage patterns in order to optimise existing processes and create new features.
Answering your questions and requests. The legal basis is being able to deal with your requests in order to improve our relationship with you.
Meeting legal obligations (for example, tax obligations). The legal basis is meeting the requirements of the various laws in force in Spain.

We do not take automated decisions that have legal effects on you, and we do not use your conversations for advertising.

6. How long we keep your data

While you have an account, we keep the data associated with it, your recent history and Brenda’s memory of your preferences, as well as a copy of your purchase history with Google Play.
Anything you ask Brenda to forget is deleted from her memory.
If you delete your account, we erase your personal data, your conversations and Brenda’s memory. We only keep anonymous statistical data (which cannot identify you) and, in restricted storage, any data the law requires us to keep for the legal period.
If your account goes unused for a long time, we may delete it. This period of inactivity is currently 24 months.

We do not sell your data. We only share it with the providers we need in order to deliver the service, who work on our behalf under contracts that protect your information:

Artificial intelligence providers (speech understanding, generating replies and synthetic voice): currently Google (Gemini). We may also work with others, such as OpenAI (ChatGPT), ElevenLabs and many more, which receive your voice and the text of the conversation only to generate the replies, under their business terms.
Servers and database: we currently use Render.com for the application servers, MongoDB Atlas for the database, and Google Cloud. The servers and database are hosted in the European Union, on Amazon Web Services (AWS) infrastructure.
Technical monitoring of the service: New Relic.
Network and web security: Cloudflare, when we use it to protect the website.
Website usage statistics: Umami, with no cookies and without identifying you personally.
Payments: Google Play, which handles payments as an independent controller under its own rules.
Public authorities, only when the law requires us to.

If we change our main providers, we will say so in this policy.

8. Data that leaves the European Union

Your data is stored in the European Union: the application servers are in Frankfurt (Germany) and the database is hosted in Paris (France). Gemini AI hosts their data in Madrid (Spain).

Even so, some providers (for example, artificial intelligence or technical monitoring providers) are US companies and may process data outside the European Economic Area. We only work with providers that offer appropriate safeguards: for example, being certified under the EU-US Data Privacy Framework, or signing the standard contractual clauses approved by the European Commission.

9. Your rights

You can ask us at any time for:

Access: to find out what data we hold about you.
Rectification: to correct inaccurate data.
Erasure: to delete your data or your whole account.
Objection and restriction: to stop using your data for a particular purpose, or to use it only for what is strictly necessary.
Portability: to receive your data in a format you can take to another service.

To exercise these rights, email us at support@aibrenda.co giving your nickname. We will reply within one month at the latest. And for specific things, remember that you can simply ask Brenda to forget them.

If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).

10. Security

We apply technical and organisational measures to protect your data (encrypted connections, restricted access, service monitoring). While sign-in is by nickname and PIN, we recommend that you choose a PIN you do not use anywhere else and do not share it with anyone.

11. Children

aiBrenda is not intended for anyone under 18. If we find out that a minor has created an account, we will delete it.

12. Changes to this policy

We may update this Privacy Policy. If the change is significant, we will let you know in the app or on the website before it takes effect.