Privacy (GDPR)

Who is responsible?

The data controller is Rob & The Young Holdings SL, Spain. For privacy questions or requests, email robain@robandtheyoung.com.

What we process

• Your WhatsApp phone number, language, timezone and reminder preferences, so we can recognise you and send reminders.
• The names and birth dates you save, including birth years when provided, and pending import or duplicate-review information.
• Your message history with the bot, including replies and voice-note transcripts, plus service events such as activation, imports and exports.
• Voice notes, sent to OpenAI for transcription. Birthdaybot processes the audio temporarily and does not save an audio copy in its own database; the transcript may remain in message history. Messaging and transcription providers may retain content under their own policies.
• Files you send for import. We process them to extract birthdays; text from PDF and Word documents is sent to OpenAI for interpretation. Birthdaybot does not archive the original import file in its own storage, but messaging providers may retain the attachment.
• Export files generated when you ask for a spreadsheet. These are kept in private storage and shared using a link valid for one hour. Expiry of the link does not delete the stored file.

Saved birthdays may be other people’s personal data. You are responsible for having an appropriate basis to store them. The GDPR household exemption typically covers purely personal or household use, but may not cover professional, commercial or public use.

Why we process it

We process data to perform the service you request: saving and managing birthdays, interpreting your messages, and sending reminders (Article 6(1)(b) GDPR).

We use service events and aggregate product analytics to understand usage and improve reliability, on the basis of our legitimate interests (Article 6(1)(f) GDPR). You can object to this processing by emailing us.

Who helps deliver the service?

• Twilio: WhatsApp messaging and media handling.
• Meta / WhatsApp: message delivery through WhatsApp.
• OpenAI: message interpretation, document-text interpretation and voice transcription.
• Lovable / Supabase: hosting, database and private file storage.

These providers receive the data needed for their role and may use their own sub-processors. Their roles and retention practices are also governed by their applicable service and privacy terms. We do not sell your data, use it for advertising, or share it for purposes beyond delivering and operating the service through these providers, unless disclosure is legally required.

Security and international processing

Birthday records and message logs are restricted to service-side access. Generated exports use private storage rather than public links. No online service can guarantee absolute security.

Some providers may process data outside the European Economic Area. Such transfers require an applicable GDPR safeguard, such as an adequacy decision or Standard Contractual Clauses. Contact us for information about applicable arrangements. This notice does not promise EU-only processing; the deployment region and each provider’s transfer arrangements need to be considered separately.

How long is data kept?

Data is kept while you use the service, unless you request erasure. The bot does not automatically purge inactive accounts, message history, service events or stored exports. Removing an individual birthday from the active list marks it as deleted; it is not permanent erasure.

Send “delete everything” and reply with the exact confirmation phrase requested by the bot for immediate permanent erasure of your account, all birthday records (including previously deleted ones), message history, service events and stored export files from Birthdaybot’s active systems. Anything other than that confirmation cancels. If erasure cannot complete, the bot tells you and you can retry or contact us. Messaging the bot again after erasure creates a new account.

You can alternatively request permanent erasure by emailing robain@robandtheyoung.com. Copies held by Twilio, Meta / WhatsApp and OpenAI are governed by their policies; the command does not erase their records or instantly purge backups. Contact us for further requests or information about provider records, backups and any legally required retention.

Your rights and practical options

You can request access, rectification, erasure, portability, restriction of processing, and object to processing based on legitimate interests.

• Export birthdays: send “export” to the bot for an Excel file of your active birthday records. It does not include your account details, message history or service events; request those by email.
• Correct a birthday: ask the bot to correct it, or email us for help.
• Erase your account and personal data: send “delete everything” to the bot and reply with the exact confirmation phrase it requests, or email robain@robandtheyoung.com as an alternative or for anything further. Confirmed erasure permanently removes your account, birthdays, message history, service events and stored exports from Birthdaybot’s active systems; provider copies remain governed by their policies.

We may need to verify that the request is yours without collecting unnecessary information. We normally respond within one month; if the GDPR permits more time, we will explain why.

You can complain to the Agencia Española de Protección de Datos (AEPD), Spain’s data protection authority, or your local supervisory authority.