Privacy Policy

Bai OS, Inc. — Delaware, USA
baios.ai · hey@baios.ai

The essentials in 30 seconds

• Bai is a company's memory. What the team tells Bai stays in that company's memory, and the company decides about it.
• If you are part of a team, what you tell Bai can be seen by your company's owners. What you see depends on how your company configured it.
• If you write to a company that uses Bai, Bai replies on behalf of that company, and your inquiry stays in that company's memory.
• If you use Bai Go, Bai's plan for one person, your memory is yours alone: no one else sees it.
• We never use the data to train AI models, nor for targeted advertising, and we never sell it.
• We work with the providers listed here (section 7), whose terms limit what they can do with the data.
• You have rights of access, rectification, erasure, portability, and objection. Write to us at hey@baios.ai.

Effective date. This version applies to anyone who starts using Bai on or after October 19, 2026, and from November 18, 2026 to anyone who was already using it.

1. Who we are and what role we play

Bai OS, Inc. is a corporation organized in Delaware (United States), reachable at hey@baios.ai. We operate the Bai service ("Service"), a company's living memory, used through WhatsApp, through Bai Space (Bai's official application, at app.baios.ai and in its official mobile apps), and through Bai MCP.

We play two different roles depending on the data:

• Controller of account, payment, website, and communications data, and of the memory of whoever uses Bai Go. We decide how and for what purpose it is processed.
• Processor of the content of each company's memory: what its team and its customers share. There, the controller is the company that contracted Bai ("Customer"), and we process that data on its behalf and according to its instructions, to provide the Service.

These roles correspond to controller and processor (GDPR, Colombia's Law 1581, Mexico's LFPDPPP), controlador and operador (Brazil's LGPD), and business and service provider (CCPA/CPRA), or their equivalent in each jurisdiction.

2. Who this Policy applies to

• Whoever contracts Bai for their company and the owners of that account.
• Whoever uses Bai Go, Bai's plan for one person. What this Policy says about a company's memory applies to their memory, which is theirs alone; what is specific to a team or to a company's customers does not apply.
• The members of the team of a company that uses Bai.
• A company's customers who write to that company's WhatsApp number when the company has turned on customer service with Bai.
• Visitors to baios.ai and its subdomains, and anyone who writes to us through our contact channels.

It does not apply to third-party websites, applications, or services linked from Bai, which are governed by their own policies.

3. What data we process

3.1 About whoever contracts and the owners

• Name, email address, WhatsApp number, language, time zone, company name, and its WhatsApp Business number.
• Billing data, processed by Stripe (section 7). We do not receive or store full card details.
• The source of the visit that led to creating the account, when it comes from an ad (section 11).

3.2 About team members

• Name, WhatsApp number, and role on the team.
• What each person shares with Bai: messages, audio and its transcriptions, images, files, links, contacts, dates, and to-dos. This forms the company's memory (section 5).
• What Bai derives from that content: notes, tags, to-dos, reminders, summaries, and technical representations used for search (embeddings).
• Information from the integrations each person authorizes (for example, Gmail, Google Calendar, or Google Drive), limited to what is necessary for the requested function.

3.3 About a company's customers

• The WhatsApp number (or the identifier Meta provides) and the WhatsApp profile name.
• The messages they send to the company, and the inquiries Bai relays to the team along with their answer.

3.4 Technical and website data

• IP address, device, browser, access and security logs, used to operate the Service, prevent fraud, and comply with legal obligations.
• Cookies and similar technologies on baios.ai, according to your consent (section 11).

4. What we use the data for

What we do NOT do, regardless of purpose:

• We do not use the data to train AI models, our own or third parties'.
• We do not sell it or share it for cross-context advertising.
• We do not use a company's memory for advertising or to commercially profile anyone.
• We do not use one company's memory to serve another.

5. The company's memory

5.1 Where it lives

The memory is stored on infrastructure controlled by Bai OS, Inc. in Google Cloud Platform, us-central region (United States). If you reside outside the United States, this involves an international transfer (section 8).

5.2 Who can see it

• The company's owners see the entire company's memory, including Bai's conversations with the company's customers.
• Each team member sees what their company allows according to its configuration: their own content and what is shared with the team, or the team's common memory. What an owner reserves for the owners is not visible to the rest of the team.
• The company's customers only receive what the company published for them. They never see the internal memory.
• Tools connected through Bai MCP (for example, Claude), read-only, when a team member connects them with their account: they read what that person can see.
• Bai OS, Inc.'s technical team, only when strictly necessary to resolve incidents, prevent abuse, or comply with legal obligations, subject to access controls and a duty of confidentiality.
• The AI Providers, when they process a message to answer it (section 7).

No other company can see a company's memory.

5.3 Who it belongs to

The memory belongs to the company. If a person leaves the team, they lose access and what they contributed stays in the company's memory, with their name and date. Their rights over that data are handled by the company as controller (section 10.2).

5.4 Continuity across technical changes

The memory is independent of the AI Provider we use at any given time: if we change providers, the content remains intact; the style of the answers may vary.

6. Sensitive data

Sensitive data is data defined as such by applicable law, including health, sex life or sexual orientation, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, biometric and genetic data, and financial or credit information. A company's team or customers may share it with Bai. It is processed exclusively to provide the Service to that company: storing it, organizing it, and returning it to those who can see it.

Bai OS, Inc. does not use sensitive data for:

• Training AI models, our own or third parties'.
• Commercial analysis, segmentation, or advertising profiles.
• Targeted advertising or commercial recommendations.
• Disclosure to third parties other than the necessary technical providers (section 7).

External Circular 002 of 2024 (SIC, Colombia): processing is governed by the principles of suitability, necessity, reasonableness, and proportionality.

7. Who we share data with (subprocessors)

To operate Bai we rely on technical providers ("Subprocessors"). Each processes the data only for the contracted function, under terms that do not allow them to use it to train their models or for other purposes.

7.1 Current subprocessors

When a team member connects a tool through Bai MCP, that tool (for example, Claude on claude.ai) is governed by its provider's terms with that person.

7.2 Changes to the list

Material changes to this list will be notified at least thirty (30) days in advance. You can request the most recent version by writing to hey@baios.ai.

7.3 Other recipients

• Professional advisors (lawyers, auditors, accountants) under a duty of confidentiality.
• Competent authorities when required by law. Unless legally prohibited, we will notify the Customer.
• In a corporate transaction (merger, acquisition): section 11.6 of the Terms of Service applies.

8. International transfers

Bai OS, Inc. is a Delaware company and its main infrastructure is in the United States, so most data is processed there. If you reside in another country (including those of the European Union, the United Kingdom, Colombia, Mexico, Brazil, Argentina, or Chile), this constitutes an international transfer, carried out with these safeguards:

• Standard Contractual Clauses of the European Commission (Decision 2021/914) where applicable.
• Each Subprocessor's data processing terms.
• The transfer requirements of each applicable law (Colombia's Law 1581 and Decree 1377, Mexico's LFPDPPP, Brazil's LGPD, Argentina's Law 25,326, among others).

You can request detailed information about these safeguards at hey@baios.ai.

9. How long we keep data

The Customer may request at any time the permanent deletion of its company's memory, or of specific content, by writing to hey@baios.ai. Retention of billing data prevails over the right to erasure when required by law (Article 17(3)(b) GDPR and equivalents).

10. Your rights

10.1 The rights we recognize

• Access: knowing what data about you is processed, how, and with whom.
• Rectification: correcting inaccurate data.
• Erasure: requesting the deletion of your data where applicable.
• Portability: receiving your data in a structured format where the law recognizes it.
• Objection and restriction of processing, including direct marketing.
• Withdrawal of consent at any time.
• Not being subject to automated decisions with significant legal effects: Bai does not make decisions of that kind.
• Lodging a complaint with the supervisory authority of your country (section 15).

10.2 Who to ask

• If you contracted Bai, use Bai Go, or are an owner of an account: us, at hey@baios.ai.
• If you are part of a company's team or wrote to a company that uses Bai: the controller of that data is that company, and it is the company's responsibility to handle your request. If you write to us, we will forward it and help the company respond.

State your request and your country of residence. We will verify your identity to prevent impersonation. We respond within the periods set by your law: one month under the GDPR (extendable to three), 10 business days for inquiries and 15 for claims in Colombia, 20 business days in Mexico, 15 days in Brazil, and 45 days in California (extendable to 90). Exercising your rights is free of charge, except for manifestly unfounded or excessive requests.

11. Cookies and ad measurement

When you arrive from a Google ad and create your company's account, we store the identifier of that click and inform Google Ads that an account was created, to measure the campaign. We do not send it the content of the memory.

When you visit baios.ai you will see a banner to accept, reject, or configure non-essential cookies, and you can change your choice from "Cookie settings" in the footer. You can also block them from your browser, use Global Privacy Control (GPC), which we honor when identifiable, or opt out of Google Analytics and Meta advertising.

12. Security

• Encryption in transit (TLS 1.2+) and at rest on Google Cloud Platform.
• Minimal internal access: only strictly necessary personnel access production, with strong authentication and access logging.
• Isolation between companies: one company's memory is never accessible from another, and within each company the rule of who sees what applies (section 5.2).
• Incident response: notification to the supervisory authority within 72 hours of becoming aware of a breach affecting personal data, and notice to the affected Customer without undue delay.

No measure is infallible. If you detect or suspect an incident, write to us immediately at hey@baios.ai.

13. Minors

The Service is not directed at anyone under 18 and we do not knowingly collect their data. If we learn that a minor is using the Service, we will remove their access and, together with the responsible company, the deletion of their data. If you are a parent or guardian, write to hey@baios.ai.

14. Communications we send

• Operational (onboarding, account and payment notices, security, changes to these documents): part of the Service while the account is active.
• Product and promotional, to whoever contracts: on the basis of legitimate interest, with unsubscribe available at any time from the link in each email or by writing to hey@baios.ai. Unsubscribing does not affect operational communications.

The messages Bai sends to a company's customers are communications of that company.

15. Supervisory authorities

We encourage you to write to us first at hey@baios.ai. If you are not satisfied, you can lodge a complaint with the authority of your country:

• Colombia: Superintendencia de Industria y Comercio (SIC) — sic.gov.co
• Mexico: the competent personal data protection authority — inai.org.mx
• Brazil: Autoridade Nacional de Proteção de Dados (ANPD) — gov.br/anpd
• Argentina: Agencia de Acceso a la Información Pública (AAIP) — argentina.gob.ar/aaip
• Chile: Consejo para la Transparencia, or the authority established by Law 21,719 where applicable — consejotransparencia.cl
• Spain: Agencia Española de Protección de Datos (AEPD) — aepd.es
• Other EU/EEA countries: their national authority — edpb.europa.eu
• United Kingdom: Information Commissioner's Office (ICO) — ico.org.uk
• California: California Privacy Protection Agency (CPPA) — cppa.ca.gov

16. Changes to this Policy

Non-material changes take effect upon publication at baios.ai/privacy. Material changes (new purposes, new subprocessors, changes to your rights) are notified at least 30 days in advance by email, WhatsApp, or Bai Space; if you do not agree, you may cancel before they take effect. Previous versions are available on request.

17. Contact

• Privacy and support: hey@baios.ai
• Company: Bai OS, Inc., Delaware, United States
• Website: baios.ai