Privacy policy
This policy explains the personal data processed by the BuenaIA insurance comparer (website, API, and ChatGPT plugin): categories collected, purposes, recipients, retention, and the controls available to you.
1. Controller
Controller: BuenaIA, Spain. Activity: AI services for mid-sized companies. Corporate site: https://buenaia.ai. Contact: https://buenaia.ai/contacto/.
This policy covers the comparer at https://seguros.buenaia.ai, its API (/api), and the ChatGPT plugin MCP server (/mcp).
2. Data we do not collect
This prototype does not request or store:
- name, email, phone number, or lead/contact forms;
- user accounts, passwords, or first-party session identifiers;
- government IDs, IMEI, payment data, live policies, or insurance claims;
- the full ChatGPT conversation log.
The product catalogue (coverages and indicative prices) is reconstructed from public commercial pages. It is not personal data.
3. Categories of data we may process
We process only what is needed to answer a query or run the service:
- Technical HTTP metadata: IP address, timestamp, URL or path, status code, User-Agent, and technical headers.
- Catalogue query parameters: line of business, segment, coverage need, optional free-text name query, device type, or other filters you send (or that ChatGPT sends when it calls a tool).
- Eligibility profile, if you provide it: consumer vs business, whether you say you are a Movistar customer, device type, and new vs refurbished. This is not used to identify you; it only selects matching reconstructed product sheets.
-
Catalogue product IDs (for example
MOVIL-TODO), which are not personal data.
We do not solicit health data, biometrics, credentials, MFA codes, financial account numbers, or government IDs. Do not send them; the tools are not designed to use them.
4. Purposes and legal bases
- Providing the comparer and plugin (search, product details, coverage comparison, eligibility fit): legitimate interests and performing the request you just made (GDPR art. 6.1.b and 6.1.f).
- Security, error diagnosis, and availability of the infrastructure: legitimate interests (art. 6.1.f).
- Legal obligations and responding to data-subject requests: art. 6.1.c.
We do not use this data for advertising, credit scoring, selling contact lists, or commercial profiling.
5. Recipients
-
Amazon Web Services EMEA (hosting in
eu-south-2, Spain): application logs and, where enabled, load-balancer logs. - OpenAI, only if you use the plugin inside ChatGPT. OpenAI is an independent controller of the chat. We receive only the tool invocation (tool name and arguments), not the full conversation. See openai.com/policies/privacy-policy.
-
Google Fonts (Google Ireland / Google LLC): the site loads
fonts from
fonts.googleapis.com; Google may see your IP address. - If you follow an official quote link, you leave BuenaIA. That destination has its own policy; we do not transmit your profile to them from our servers.
We do not sell personal data or share it for third-party marketing.
6. International transfers
The comparer is hosted in the EU (AWS eu-south-2). If you use ChatGPT, OpenAI may process the tool call from outside the EEA under its own controller role and published safeguards. Google Fonts may involve a transfer to the United States.
7. Retention
- There is no user database and no search history tied to an identity. The request is answered and no profile is stored.
- Technical application logs (CloudWatch) are kept for 14 days and then deleted.
- The SQLite catalogue is product seed data, not a customer file.
8. Controls and rights
You can:
- use the comparer and plugin without creating an account;
- stop using or uninstall the ChatGPT plugin at any time;
- omit an eligibility profile; catalogue tools still work;
- request access, rectification, erasure, objection, restriction, or portability, and lodge a complaint with the Spanish Data Protection Agency (AEPD).
To exercise rights, use buenaia.ai/contacto and mention the insurance comparer. Because we do not keep an account for you, an IP address and timestamp help us locate a technical log within those 14 days.
9. Children
The service is not directed at children under 16 and is not designed to collect their data.
10. Changes
If processing changes, we will update this page and the date above. The current version is always seguros.buenaia.ai/privacy.