Privacy policy
Effective date: 1 November 2026 · Version 1.0
This policy explains how personal data is processed when you visit baaito.app, request access, contact us or use the Baaito workspace. Baaito is offered to businesses and public bodies only.
1. Who we are
Baaito is operated by DATATIP CZ, s.r.o., Pelušková 1443, 198 00 Praha 14, Czech Republic, ID No. (IČ) 24853577, VAT No. (DIČ) CZ24853577, registered in the Commercial Register kept by the Municipal Court in Prague, file C 201544 (“Datatip”, “we”).
We have not appointed a data protection officer. For any privacy question, write to info@baaito.app or call +420 773 926 377.
2. Our two roles
We are the controller for personal data about website visitors, access requests, contact enquiries, user accounts (sign-in identity including the Microsoft Entra tenant and object ID, profile, organisation membership and roles), billing, and security and audit logs.
We are a processor for the content of customer workspaces — conversations, documents, projects, uploaded sources and generation inputs and outputs — which we process on behalf of the customer organisation under the Data Processing Agreement. Questions about that content should go first to your organisation’s administrator, who decides how it is used.
3. Purposes, data, legal bases and retention
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Access requests and enquiries | Name, work e-mail, company, message | Art. 6(1)(b) and (f) GDPR | 24 months after the last contact |
| Accounts and sign-in | Sign-in identity (incl. Microsoft Entra tenant/object ID), profile, organisation membership, roles | Art. 6(1)(b) and (f) GDPR | For the life of the account plus 90 days |
| Running the service | Workspace content: conversations, documents, projects, sources, generation inputs and outputs | Customer’s documented instructions (Art. 28 GDPR) | According to the customer’s settings and the DPA |
| Security, abuse prevention and audit | IP address, device and browser data, audit events | Art. 6(1)(f) and (c) GDPR | 12 months; backups 35 days |
| Service e-mails | Name, e-mail address, message content | Art. 6(1)(b) GDPR | As for the account |
| Billing | Customer and contact details, invoices, payments | Art. 6(1)(b) and (c) GDPR | 10 years (Czech accounting and VAT law) |
| Product improvement | Pseudonymised usage events | Art. 6(1)(f) GDPR | 24 months |
Our legitimate interests are operating a secure business service, answering enquiries, preventing misuse and improving the product. We do not use customer content to train AI models, and we require our AI providers not to train on it.
4. AI processing
When you ask Baaito to prepare a document, your prompt, the chosen template and the sources you selected are sent to the AI model enabled for your organisation. Each AI model in Baaito is labelled with its data location. EU models (Microsoft Azure AI Foundry and Private Azure deployments) process data in the EU (Data Zone EU, data stored in Sweden Central). USA / global models (through the Lovable AI Gateway or OpenRouter) process data outside the EU under SCC / the EU–US Data Privacy Framework; they are available to every organisation and may be the default model. Indexing and search in uploaded sources currently use OpenAI embeddings through the Lovable AI Gateway outside the EU (see Sub-processors).
Current platform defaults: …
Outputs are generated automatically and must be reviewed by a person before use. Baaito does not make decisions with legal or similarly significant effects on individuals (Art. 22 GDPR). More detail is in How Baaito uses AI.
5. Recipients and where data is stored
We use the sub-processors listed on the Sub-processors page. Integrations that your organisation connects (for example Microsoft 365 or knowledge sources) act on behalf of your organisation. We disclose data to authorities only where the law requires it.
- Database, files and backups: EU (Ireland).
- Microsoft 365 connector: Microsoft Azure, Poland Central.
- EU AI models: Microsoft Azure, Sweden Central; USA / global AI models: Lovable AI Gateway, OpenRouter.
- E-mail delivery: Slovakia.
- Website delivery: Cloudflare global network – pages are delivered from the location nearest to you.
6. Transfers outside the EU/EEA
Where personal data is transferred outside the EU/EEA, we rely on an adequacy decision of the European Commission (including the EU–US Data Privacy Framework for certified recipients) or on the Standard Contractual Clauses together with supplementary measures where needed.
7. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time where processing is based on consent. Send your request to info@baaito.app; we answer within one month.
You may lodge a complaint with the Czech Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz, or with the supervisory authority in your EU country.
9. Security
We protect data with encryption in transit, per-organisation separation of access and roles, audit logging and encrypted storage of secrets such as connector credentials. More in Security.
10. Changes
We publish changes to this policy on this page with a new effective date. Material changes are announced to organisation administrators in advance.