Privacy policy
Last updated: 08/10/2026
This is an English translation for information only. The Spanish version is the one that applies.
Here is everything the law requires us to tell you when you give us your data: who processes it, why, on what legal basis, who it is shared with, how long it is kept and what rights you have. It applies to the website (including the «Book a demo» form), the demo and the panel.
Law: article 13 of the General Data Protection Regulation (EU) 2016/679 (GDPR) and article 11 of Spanish Organic Law 3/2018 (LOPDGDD), which allows the information to be given in two layers: a summary next to the form and this page.
1. Who processes your data
Unai España Tejero (Bildeit), tax ID 47742127S, Calle Sant Salvador 13, 08191 Rubí (Barcelona), Spain. For anything to do with your data: privacidad@bildeit.com.
Bildeit processes data in two different roles:
- Controller of the data of people who book a demo and of the login accounts (the people who use the panel).
- Processor of the personal data each client company puts into Bildeit: its clients, suppliers, jobs, invoices and team members. There the controller is the client company, and Bildeit only processes that data to provide the service and on its instructions, under the data processing agreement.
This policy covers the first case. The second is governed by that agreement.
Laws: articles 4, 13.1.a and 28 of the GDPR; article 33 of the LOPDGDD (processor).
2. What data we process, why and on what legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| From the «Book a demo» form: name, email, phone (if you give it), company, number of jobs and what you tell us | Replying to you and showing you the product. It is stored in the database. We do not send you advertising | Your consent, given by ticking the box and sending (art. 6.1.a). You can withdraw it at any time, without affecting what was done before |
| From the account: email, name and password (stored encrypted) | Creating and protecting your login, letting you in and sending you account emails (confirm your email, the sign-in link, change your password) | The service contract (art. 6.1.b) |
| From the client company: company name, tax ID, province of the tax address, address and what it enters in the panel | Providing the service: jobs, budgets, progress certificates, invoices, record books and forms | The contract (art. 6.1.b); for invoicing records, also a legal obligation (art. 6.1.c) |
| Messages you write to us | Answering your questions | The contract (art. 6.1.b) or, if you are not a client yet, your consent when you write (art. 6.1.a) |
| Technical access logs (date, time, IP address) | Protecting the service and detecting abuse | Legitimate interest in the security of the service (art. 6.1.f) |
The form fields marked as required (name and email) are needed to reply to you; without them, we cannot. We do not make automated decisions with legal effects on you, we do not sell data and we do not use it for advertising.
Laws: articles 6.1 and 13.1.c, 13.2.e and 13.2.f of the GDPR; article 6 of the LOPDGDD (consent).
3. How long we keep it
- Demo requests: as long as needed to reply and, at most, 12 months from the last time we spoke, unless you become a client. Basis: the storage limitation principle (art. 5.1.e GDPR).
- Account data: while the account is active.
- Invoices, record books and invoicing records: six years for business books and supporting documents (art. 30 of the Spanish Commercial Code) and, in any case, while the Tax Agency can review them, which is four years (art. 66 of the General Tax Law); invoices, for that period (art. 19 of Royal Decree 1619/2012). A Verifactu record cannot be deleted or changed (Royal Decree 1007/2023).
- At the end: what the law requires us to keep is blocked (accessible only to courts and public authorities) until liabilities expire, and then deleted (art. 32 LOPDGDD).
- The panel demo creates a sample company with made-up data, which deletes itself after 24 hours.
Laws: articles 5.1.e and 13.2.a of the GDPR; article 32 of the LOPDGDD; article 30 of the Spanish Commercial Code; article 66 of Law 58/2003, General Tax Law; article 19 of Royal Decree 1619/2012 and Royal Decree 1007/2023.
4. Who else sees it (providers)
We do not pass your data on to anyone. We do use providers that process it on our behalf. Today there are these two, and the full list, with what has been checked for each, is in Subprocessors:
| Provider | What it does | What data it sees |
|---|---|---|
| Supabase | The database and the login accounts | Everything in the panel and the demo requests |
| Cloudflare | Hosts and serves the website and the panel | Requests to the website, with the IP address |
If another service that processes data is ever switched on (for example, sending email from bildeit.com, or reading invoices with artificial intelligence, which today works in test mode and sends nothing), we will add it here and in Subprocessors before switching it on.
Laws: articles 13.1.e, 13.1.f, 28 and 44 to 46 of the GDPR.
5. Your rights
You can ask for access to your data, its correction or deletion, restriction of processing and portability, object to processing, and withdraw your consent at any time. Write to privacidad@bildeit.com; we reply within one month at most. Exercising them is free.
If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (AEPD).
Laws: articles 12, 13.2.b, 13.2.c, 13.2.d, 15 to 22 and 77 of the GDPR; articles 12 to 18 of the LOPDGDD.
6. Security
Each company can only read its own data, and the database enforces this row by row (row-level security), not just the screen. Passwords are not stored in plain text. Connections are encrypted. Keys and secrets are kept out of the code. If a breach affected your data, we would notify the Spanish Data Protection Agency within 72 hours when the law requires it, and you if there is a high risk.
Laws: articles 32 to 34 of the GDPR (security and breaches).
7. Changes
If we change this policy in a relevant way, we will say so here with the date and, if you have an account, email you before it applies.