Privacy policy

This policy explains what we do with your personal data, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

In two minutes

• Bellioo is operated by Peacock Digital LLC, which is the controller of your data. The apps are published on the stores through Proppi Services LLC, which does not process your data.
• We process the minimum needed for you to book: name, email, phone number, your bookings and, if you write any, your reviews. Your location only if you give permission, and only to sort businesses by distance.
• We share with each business what it needs to serve your appointment. We do not sell data and there is no third-party advertising on Bellioo.
• Data is hosted in the European Union. Some providers are in the United States and work with us under the safeguards the GDPR requires.
• You can delete your account at any time from the app or from bellioo.com/en/eliminar-cuenta, request a copy of your data and exercise your rights by writing to privacy@bellioo.com.

1. Who the controller is

Representative in the European Union. We are appointing a representative in the European Union under article 27 of the GDPR. We will publish their name and address here as soon as the appointment is made. In the meantime, you can write to privacy@bellioo.com.

Why the GDPR applies to you even though the company is in the United States. Because article 3.2 of the GDPR reaches anyone who offers services to people in the European Union, regardless of where the company is. Bellioo is directed at clients and businesses in Spain, in Spanish and in euros, so the Regulation applies in full: you have the same rights as if the company were here, and you can complain to the authority in your country.

The apps. Bellioo and Bellioo Business are distributed on the App Store and Google Play from the developer account of Proppi Services LLC, which publishes them on behalf of Peacock Digital LLC under a licence agreement. Proppi Services LLC does not provide the service, does not access your data and makes no decisions about it.

2. Who this policy applies to and what our role is

This policy applies to the bellioo.com website, the Bellioo and Bellioo Business apps, business websites published with Bellioo on bellioo.com subdomains or on their own domains, and the communications we send you. It covers these people:

• Clients, with or without an account, who search for businesses and book appointments.
• People who work at a business that uses Bellioo: owners, managers and staff.
• Visitors to bellioo.com and to websites published by businesses.
• A business's clients whose data that business keeps in Bellioo, for example when the business adds you manually, creates an appointment for you or writes notes about your visits. In that case the business is the controller of your data and Bellioo acts as a processor on the business's behalf, under the Data processing agreement every business accepts when signing up. To exercise your rights over that data, contact the business; if you write to us, we will pass your request on and let you know.
• Industry professionals we contact to introduce Bellioo.
• Participants in the invitation, recommendation and affiliate programmes, and anyone who writes to support or reports content to us.

3. What data we process

If you are a client. First name and surname, email address, phone number and, if you upload one, profile photo. Language. If you sign in with Google or Apple, the identifier and email those services give us. Your bookings: business, service, professional, date, price stated by the business, the notes you write when booking and the status of the appointment (confirmed, cancelled, completed or no-show). Your reviews: rating and text. Favourites, loyalty cards and stamps, waiting lists and invitations you send. Your communication preferences per channel (email and WhatsApp), with the history of when and from where you changed them. If you book as a guest, the same contact and booking details, linked to the management link we send you.

If you work at a business. The same account data, plus your role in the business, the invitations you receive or send, your photo if the business uploads it, and the actions you take in the calendar (who created, moved, cancelled or blocked), which are logged for the business and to resolve disputes.

Location. Only if you grant permission to the device or the browser, your position at the moment you search. We keep the last position you send us, with its source and date, to sort results and avoid asking you again on every search. Without permission, we may estimate your city from your IP address to show you businesses in your area; that estimate is not stored in your profile.

Technical data. IP address, device and browser type, operating system, language and pages visited. They are logged when you sign in, when you accept the legal texts, when you change your communication preferences, and in the technical and audit logs we use for security and to fix faults.

Data a business provides about you. A business may keep in Bellioo your name, contact details, appointment history and internal notes about your visits. We contractually require businesses not to store health data or other special categories unless strictly necessary to provide the service and with your explicit consent. If you think a business is keeping something about you that it should not, write to us.

If we contact you as a professional. The name of the business and of the contact person, phone number, email, address and activity, obtained from public directories, the business's own website or public industry sources. We process this data for the sole purpose of introducing Bellioo to you, and you can object at any time.

Programmes and support. Invitation codes, who invited whom and the data needed to recognise a reward or commission. In the affiliate programme, also tax and payment details under its own conditions. If you write to support or report content to us, the content of your message and the details you include.

BellIA. When the artificial intelligence assistant is available in your app, the text of your conversations and the account or business data it accesses to answer you.

Application errors. When something fails, we store the error to fix it. The text of an error may carry data about whoever was using the application at that moment, for example an email or an identifier, because it describes what was being attempted.

We do not process clients' payment data: services are paid for at the business itself. Businesses pay their Bellioo subscription through Stripe, which processes the card; we only receive the last digits, the expiry date and the result of the charge.

4. What we use the data for and on what basis

Where we rely on legitimate interest we have assessed that the processing is expected and low-impact. You can object and we will assess it case by case. Where the basis is consent, you can withdraw it at any time without giving reasons; withdrawing it does not affect earlier processing, and it is as easy as giving it: a link in every marketing email or the settings in your profile.

5. Location, in detail

The client app asks for "while using" location permission only when you search for businesses near you. The website asks through the browser. You can use all of Bellioo without granting it, by searching by name or by city. The last position you send us is kept in your profile until the next one replaces it, until you delete your account or until you ask us to remove it. We do not build a history of positions, we do not use it for advertising and we do not pass it to anyone. Businesses do not see your position.

6. BellIA and error diagnosis with artificial intelligence

BellIA is an artificial intelligence system, not a person. When it is available and you use it, we send the text of your message and the data strictly necessary to answer you to our model provider, Anthropic PBC (United States), which does not use that data to train its models. We keep the conversation so you can consult it and so we can review errors. BellIA cannot see other businesses' or other users' data, and it makes no decision affecting you on its own: actions that change anything always require your express confirmation.

Errors. The first time a new error appears we ask the same provider for a first explanation of what may have happened. Before sending it we remove personal data: emails, phone numbers, identifiers, keys and the specific values appearing in the message are replaced with generic markers, so that the shape of the error is sent and nobody's data. It is sent only once per type of error. The full text stays on our servers and is deleted according to the periods in section 10.

7. Communications

Necessary for the service. Access codes, confirmations, appointment reminders, changes and cancellations, waiting list alerts, replies to your reviews and notices about your account or about changes to these texts. They are sent by email and, if you turned the channel on, by WhatsApp. They do not require marketing consent because they are part of the booking, but you can turn off WhatsApp reminders from your profile.

Marketing. News and promotions from Bellioo or campaigns from businesses you have booked with. Only if you have turned on consent for that channel in your profile, which is never pre-ticked. Every email carries an unsubscribe link that works instantly, and you can also change it in Profile, reply STOP to a WhatsApp message or write to us. We keep a record of when and from where you gave or withdrew each consent so we can demonstrate it.

WhatsApp. Messages are sent through Meta's WhatsApp Business platform via our provider Zernio, established in Spain. Meta processes your number under its own privacy policy. If you reply to a WhatsApp message, the business may see that reply.

8. Who we share data with

With businesses. When you book, the business receives your name, email, phone number, the appointment details and, if you write them, your booking notes and reviews. The business is responsible for what it does with that data outside Bellioo, for example if it calls you to confirm. We do not share with a business your bookings at other businesses.

With providers that work for us (processors), which may only use the data on our instructions:

With authorities when a law or a court order requires it, and with a buyer if Bellioo changes hands, in which case we will notify you.

We do not sell personal data or pass it to advertisers.

9. International transfers

Peacock Digital LLC is a United States company and our team accesses data from the United States and from Spain. Data is stored in the European Union. When a provider processes data outside the European Economic Area it does so under an adequacy decision, such as the EU-US Data Privacy Framework for certified companies, or under the European Commission's standard contractual clauses (Decision 2021/914) together with supplementary measures. You can ask us for a copy of those safeguards at privacy@bellioo.com.

10. How long we keep data

When the period ends, we delete or anonymise the data. Anonymised data no longer identifies you, not even to us.

11. Your rights

You can ask us for access to your data, to rectify or erase it, to restrict or object to its processing, to withdraw a consent and to receive your data in a commonly used format. Write to privacy@bellioo.com from your account's email. We reply within one month, extendable in complex cases. If we have doubts about your identity, we will ask you to verify the email with a code.

• A copy of your data. You can request a copy in machine-readable JSON format from your account when the "Download my data" option is available in your app, or by writing to privacy@bellioo.com. We email you a link that expires after 48 hours. It includes your account, profile, bookings, reviews, loyalty, waiting lists, favourites, communication preferences with their history, businesses, conversations with BellIA and legal acceptances. It does not include notes a business has written about you: the business is the controller of those, and you should ask the business for them.
• Deleting your account. There is no need to write to us: you can do it from Profile in either app or from bellioo.com/en/eliminar-cuenta, where we explain what is deleted and what is kept.
• Complaining. If you think we have not handled your request properly you can complain to the Spanish Data Protection Agency (aepd.es) or to the authority in your country of residence. The company being outside the Union does not oblige you to complain outside it. We would rather you wrote to us first so we can resolve it.

12. Security

No passwords: access is verified with one-time codes sent to your email, or with Google and Apple. Connections are encrypted, internal access is limited by role and logged, each business's data is isolated from the others, backups are encrypted and our providers meet recognised standards. We keep a record of security incidents. If we suffered a breach affecting your data, we would notify you and the authority where the law requires it.

13. Minors

Bellioo is not aimed at children under 14 and we do not allow accounts at that age. If we detect one, we delete it. If you are under 14, ask your parent or guardian to book for you with their account.

14. Cookies and analytics

We do not use advertising or tracking cookies. We store in your browser what is needed for the website to work, we measure usage with a cookieless tool, and the payment pages load Stripe components. All the details, including measurement on business websites and the apps' permissions, are in the Cookie policy.

15. Automated decisions

We make no automated decisions with legal effects on you. Businesses are sorted by distance and rating, as explained in the Business terms. In the invitation and affiliate programmes we apply automatic anti-fraud checks that a person reviews before refusing a reward.

16. Changes to this policy

If we change anything material we will notify you by email or in the app before it takes effect. Each version carries its number and publication date, we keep the previous ones and you can ask us for them.