Privacy Policy

We at BUENCOCO S.L.U. (“BUENCOCO”, “Controller” or “we”) value your privacy and are fully committed to safeguarding any information we collect from you or about you. This privacy policy describes how we process the personal data that we collect from or about you when you use Clary (“AI Companion”), an AI-powered chatbot designed to support emotional wellbeing and personal growth. The AI Companion is a safe space where you can share what’s on your mind, explore your feelings, and feel heard. For further information on how the AI Companion works and how you should (and should not) use it, see our Terms and Conditions here (if you reside in the European Economic Area, Switzerland, or the UK) or here (if you reside outside the European Economic Area, Switzerland, or the UK).

We developed the AI Companion starting from reliable third-party general-purpose AI models available on the market, such as GPT and Gemini (“GPAI models”). Because of this, we do not qualify as data controller with regard to the data processing carried out for initial training purposes of the underlying GPAI models, and you should consult the relevant providers’ information notices to understand how the initial data processing took place. You can find here an updated list of the GPAI models’ providers we rely on.

To develop the AI Companion in a meaningful way, we used – prior to its launch – prompt engineering techniques, without processing any personal data, to sculpt the AI Companion’s behaviour and guide it to provide adequate and useful responses.

‍California and Certain US Residents: This Privacy Policy describes how we collect, use, disclose, and retain your personal information. For additional information relating to your rights and our processing of your personal information collected both online and offline, please navigate to Section 12 below.

Latest update: 30 September, 2025

Data controller

The data controller is BUENCOCO S.L.U., Plaza Catalunya 1, Edificio El Tringle, Planta 4, 08022, Barcelona (Spain), Tax code B-13.997.267 and registered in the Commercial Registry of Barcelona as Volume 48873, folio 177, sheet 599319, book 0, section 8 and entry I/A 1.

DPO and how can you contact us

You can contact our DPO by email at DPO@unobravo.com for matters related to personal data processing. Alternatively, for any questions, you can write to us at support@heyclary.ai or the address above under Section 1.

Which personal data we process

We process the following categories of personal data (collectively, “Personal Data”) collected directly from you or, regarding Technical Information (as defined below), your device or browser:

Account Information: when you create an account to use the AI Companion during the onboarding stage, we will collect the information associated with it, such as your name and surname, age, pronouns, Contact Information (as defined below), gender (if you wish to share this information with us), date of birth (collectively, “Account Information”).
Contact Information: email address, phone number and other contact information you provide us while registering on the AI Companion or communicating with us (collectively, “Contact Information”).
Interaction Records: when you complete the set-up of your account, as well as when you use the AI Companion, we will collect data about your interactions with it, including your conversation history, your prompts (including your image or voice, as applicable) and the responses provided to the AI Companion (collectively, “Interaction Records”).
Sensitive Data: even though we do not intentionally collect or seek to process special categories of Personal Data (such as health data), if you consent and decide to provide us this information, we will process it. It is also possible that such information (e.g., relating to your health, beliefs, sex life or sexual orientation or other sensitive aspects) may be inferred from your Interaction Records and from Other Information You Provide (collectively, “Sensitive Data”).
Communication Data: if you send us support requests on how to use the AI Companion or other information request, we may collect your Contact Information, and the content of the communications between us (collectively, “Communication Data”).
Technical Information: when you use the AI Companion we will collect – also through cookies and other tracking tools – technical information related to your browser or device (such as name of the device, language selected, operating system, device identifiers); log data (such as IP address, browser type and settings, the date and time of your request, session duration); your activity (e.g., the features you use); the dates, times and location of access (collectively, “Technical Information”). For details about our use of cookies, please read our Cookie Policy.
Other Information You Provide: We collect other information that you may provide to us, such as when you participate in our surveys (collectively, “Other Information You Provide”).

Please avoid providing any personal data related to third parties and only provide information about yourself.

How we process your Personal Data

We will process your Personal Data for the purposes provided below when necessary to provide you with the requested services, when we have your consent, when we must comply with a legal obligation, or to fulfil our legitimate interests.

When we process your Personal Data under the contractual basis (Article 6(1)(b) GDPR) and/or the legal compliance basis (Article 6(1)(c) GDPR), providing your Personal Data is required. If you do not provide the required Personal Data, you will not be able to use the AI Companion.

When we process your Personal Data based on your consent (Article 6(1)(a) GDPR) you are free to provide us with your consent and to withdraw it at any time. Depending on the processing activities for which you do not grant your consent, or for which you later withdraw it, we may not be able to process your Personal Data for certain purposes, such as improving the AI Companion or sending marketing communications. However, this will not affect your ability to use the AI Companion.

When we process your Personal Data to pursue our legitimate interests (Article 6(1)(f) GDPR) other than for direct marketing purposes – for which you can always object or, as the case may be, withdraw your consent – you have the right to object at any time, on grounds relating to your particular situation. We have carried out a legitimate interest balancing test, which is available upon request, to ensure that our interest is not overridden by your rights and freedoms. We will no longer process your Personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

As mentioned above, we do not intentionally collect or seek to process Sensitive Data. We will only process such data if you have granted us your prior consent or, otherwise, when we can ultimately rely on a law permitting us such processing as detailed below.

For further information on your rights, see Section 9.

Purpose of processing	Legal basis	Personal Data
To provide the service and maintain the AI Companion, for example to allow you to create the account, use the AI Companion (and provide you with all its functionalities, including crisis detection and other features), respond to your questions for the AI Companion (including support request), as well as to personalize your interactions with the AI Companion (taking into account your previous interactions and your needs), and send you information about the AI Companion (such as changes notices).	Performance of a contract pursuant to Article 6(1)(b) GDPR and, additionally and limited to the processing of Sensitive Data, consent pursuant to Article 9(2)(a) GDPR. If you do not provide consent, please avoid entering Sensitive Data. We remind you that if you purposely and voluntarily do provide such information after not initially consenting (that is, without flagging the relevant checkbox), we understand you have changed your preference and will treat this as your explicit consent to process Sensitive Data.	Account Information Interaction Records Communication Data Technical Information Other Information You Provide Sensitive Data (where consented)
To improve the AI Companion, for example to optimize user experience, and develop new features. Note that this is done by previously de-identifying Personal Data. See Section 10 for further information (including information on the fine-tuning activities we may perform).	Consent pursuant to Article 6(1)(a) GDPR and, additionally and limited to the processing of Sensitive Data, consent pursuant to Article 9(2)(a) GDPR.	Interaction Records which is later de-identified Account Information which is later de-identified Interaction Records which is later de-identified.
To send you marketing communications (including market research, interview and surveys as further detailed in the Terms and Conditions of the AI Companion available here (if you reside in the European Economic Area, Switzerland, or the UK) or here (if you reside outside the European Economic Area, Switzerland, or the UK).	Consent pursuant to Article 6(1)(a) GDPR.	Contact Information Other Information You Provide
To carry out “segmentation” activities (i.e., creating categories and/or groups based on objective characteristics and/or behaviours) and aggregated analysis to guide commercial strategies.	Legitimate interest pursuant to Article 6(1)(f) GDPR. Our legitimate interest consists of obtaining knowledge about our service to inform our business activity.	Account Information Interaction Records Technical Information Other Information You Provide
To create user profiles by analysing preferences, behaviours, interests, and choices expressed through the use of the AI Companion, also with the purpose of making our marketing communications more relevant to you.	Consent pursuant to Article 6(1)(a) GDPR.	Contact Information Technical Information
To prevent fraud, illegal activity, or misuses of the AI Companion, and to protect the security and integrity of our systems (including for consolidated reporting and business continuity purposes).	Legitimate interest pursuant to Article 6(1)(f) GDPR. Our legitimate interest consists of the need to protect our product, your experience when using the service, and to avoid any harm to both the company and you.	Interaction Records Technical Information Other Information You Provide
To carry out internal, administrative and management activities, ensuring compliance with internal policies and auditing requirements, this includes sharing data as described below in Section 6.	Legitimate interest pursuant to Article 6(1)(f) GDPR. Our legitimate interest consists of the need to protect ourselves and our service / product and to comply with internal policies, and due and centralised operation of the company and group.	All the Personal Data – excluding Sensitive Data – that may be necessary for such purpose.
To comply with legal obligations (laws on tax, commercial, privacy, etc.), including sharing data with competent public authorities where mandatory.	Compliance with a legal obligation pursuant to Article 6(1)(c) GDPR and Article 9(2)(g) GDPR if Sensitive Data are processed.	All the Personal Data, including Sensitive Data, that may be necessary for such purpose.
To establish, exercise, or defend legal claims including sharing data with competent public authorities / courts for this reason.	Legitimate interest pursuant to Article 6(1)(f) GDPR. The establishment, exercise or defence of legal claims pursuant to Article 9(2)(f) GDPR if Sensitive Data are processed. Our legitimate interest consists of the need to protect ourselves and our service / product, and to avoid any harm to both us and you being able to face / file legal actions.	All the Personal Data, including Sensitive Data, that may be necessary for such purpose.

How long we store your Personal Data

We will process and store your Personal Data for only as long as your account is active, and we provide the AI Companion service. Nevertheless, we will process certain personal data for shorter periods if you withdraw your consent (when requested) or object to the processing as explained above (i.e., we will stop when you require us to do so).

After that, we may process your data for other legitimate business purposes such as resolving disputes, safety and security reasons, or to comply with our legal obligations (e.g., some laws require us to retain data for certain periods of time).

When none of the above apply, we will maintain your data blocked (i.e., reserved and only available if legal actions / proceedings arise) for the statute of limitations related to legal actions that may arise from the processing of your personal data.

For further information on how long we store your personal data, please contact us at contact details mentioned in Section 2.

To whom we share your personal data

Your personal data will be processed by BUENCOCO authorized personnel.

We may disclose your Personal Data to the following categories of recipients, which will process your Personal Data as autonomous data controllers and/or data processors (in the latter case, exclusively in accordance with our documented instructions):

Categories of recipients	Reasons for sharing the Personal Data	Personal Data shared
Affiliates, namely UNOBRAVO s.r.l. Società Benefit.	To support the provision and improvement of the AI Companion and related services. To carry out internal, administrative and management activities, ensuring compliance with internal policies and auditing requirements.	Account Information Interaction Records Technical Information Communication Data Other Information You Provide If our affiliate acts as data processors, it will process the Personal Data based on a data processing agreement entered with it.
Service providers, including: • providers of hosting services • customer service vendors • support and safety monitoring services providers • web analytics, marketing and advertisers’ providers • market research service providers • providers of large language models • other information technology providers	To provide the service, maintain and improve the AI Companion To conduct analytics To carry out marketing activities (including market research and interviews)	Account Information Contact Information Interaction Records Communication Data Technical Information Other Information You Provide If such service providers act as data processors, they will process the Personal Data based on a data processing agreement entered with them.
Public authorities, including: • government authorities • law enforcement authorities • and other authorities	To comply with legal obligations, respond to requests, and protect our rights and the rights of our users.	All the Personal Data, including Sensitive Data, that may be necessary for such purpose.
External consultants	To obtain professional advice and support relating to the purposes set out above in Section 4, for instance, in managing the AI Companion, ensuring legal compliance, and defending our rights.	All the Personal Data, including Sensitive Data, that may be necessary for such purpose.

Minors

The AI Companion is not directed to, or intended for, users under 18 or, if higher, the minimum age required in your country to consent to use the AI Companion. BUENCOCO does not knowingly collect Personal Data from children. If you have reason to believe that a child under the age of 18 or, if higher, the minimum age required in your country to consent to use the AI Companion has provided Personal Data to BUENCOCO through the AI Companion, please email us at support@heyclary.ai. We will investigate the matter and if appropriate, delete the Personal Data.

How we handle data transfer

BUENCOCO processes your Personal Data on servers located outside of the EEA, Switzerland and the UK for the purposes described in this privacy policy. When transferring Personal Data outside of the EEA, Switzerland or the UK, we rely on the following transfer mechanisms to comply with applicable data protection law:

We rely on the European Commission’s adequacy decisions pursuant to Article 45(1) GDPR when transferring your Personal Data to any country that has been considered to provide an adequate level of protection.
For other jurisdictions, we rely on the Standard Contractual Clauses as approved by the European Commission or the UK Data Transfer Addendum.

For more information or to obtain a copy of the appropriate safeguards we have in place when transferring Personal Data, please contact us at contact details mentioned in Section 2.

What rights you can exercise

You have the following statutory rights in relation to your Personal Data:

Right of access your Personal Data – you have the right to obtain confirmation as to whether or not your Personal Data is being processed and receive any information regarding the processing should this be the case, including a copy of the Personal Data undergoing processing.
Right to rectification – you have the right to have your Personal Data rectified and/or completed, should it be inaccurate and/or incomplete.
Right to erasure – in certain circumstances, you have the right to have your Personal Data erased without undue delay. In this regard, you can delete your account anytime under “Account & Data”. If you decide to close your account, we will delete the personal data tied to that account from our systems as part of the account-closure process.
Right to restriction of processing – under certain conditions, you have the right to restrict the processing of your Personal Data.
Right to data portability – you have the right to receive your Personal Data, which you have provided to BUENCOCO, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from us. Where technically feasible, you have the right to have the Personal Data transmitted directly from one controller to another.
Right to object – you have the right to object, on grounds relating to your particular situation, at any time to processing of your Personal Data. We will no longer process the Personal Data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims. Where Personal Data are processed for direct marketing purposes, you have the right to object at any time to the processing of Personal Data for such purpose, which includes profiling to the extent that it is related to such direct marketing.
Right to automated individual decision-making, including profiling – you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. In the event that automated individual decision-making processing are carried out, you have right to obtain human intervention, to express your point of view and to contest the decision.
Right to withdraw your consent – you have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
Right to lodge a complaint with a supervisory Authority – you have right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing infringes the GDPR and any applicable data protection law. A full list of EU supervisory authorities’ contact details is available here. If you live or work in the UK, you have the right to lodge a complaint with the UK Information Commissioner’s Office.
Right to an effective judicial / administrative remedies.

As indicated in this Section, you can exercise some of these rights through your account. If you are unable to exercise your rights through your account, please contact us at the contact details mentioned in Section 2.

How your data is used to improve model performance as well as for the fine-tuning of future models

To make our AI Companion more helpful for you and other users, we need to constantly improve it. This process helps us better understand user needs and preferences, as well as improve the reliability of our crisis detection systems, enhancing its performance over time.

Furthermore, to further develop our AI’s capabilities, we may also process de-identified Personal Data, as well as internally generated synthetic data (e.g. written by clinicians), and synthetic data generated using an LLM and evaluated by clinicians to fine-tune the LLM that powers our AI Companion, as well as to fine-tune future models or integrate the data into a Retrieval-Augmented Generation (“RAG”) system.

By default, your Personal Data (including, inputs and outputs) are not used for improving model performance and for fine-tuning future models: you will always have full control over your Personal Data and can decide whether such data can be processed for these purposes.

Indeed, you may choose to give – and withdraw at any time – your consent at any time through the AI Companion Settings, by selecting the relevant option (“Help Clary learn from interactions”), as well by contacting us using the details provided in Section 2. If you do not provide your consent (or later withdraw it), your Personal Data will not be used to improve the AI Companion or fine-tune it (or to fine-tune future models), but you will still be able to use the AI Companion (and, eventually, to fine-tune the LLM that powers it).

Where you provide your consent, we will take appropriate steps to exclude Personal Data to achieve these purposes. More in detail, we have built key “privacy by design” safeguards into the development of the AI Companion: hence, if you provide your consent, we will replace any Personal Data with a generic placeholder (e.g., [NAME], [LOCATION]) and we will store the Personal Data in a secure database to maintain conversational context. In any event, we will process only redacted messages to improve the AI Companion. Once your data has been de-identified, we may also transform the data for fine-tuning future models or for integration into a RAG system, by (i) relying on third-party providers LLM to programmatically alter potentially identifying details that are not Personal Data but could, in combination with other information, identify our users, and (ii) rewriting de-identified excerpts with the support of human reviewers (e.g., a clinical psychologist).

Changes to this privacy policy

We may occasionally make changes to this privacy policy. If we make material changes to this privacy policy, we'll provide you with prominent notice as appropriate under the circumstances. For example, we may display a prominent notice within the AI-Companion’s homepage or send you an email.

United States residents

You may have certain rights regarding our processing of your personal data under applicable local state law, including, for example, if you are a consumer in California or Virginia. If our processing of your personal data is governed by such laws, the following provisions apply to our processing of your personal data, whether collected online or offline. These provisions supplement the other sections of the Privacy Policy. If you are a resident of Washington, please refer to our Washington Health Data Privacy Policy regarding our processing of your health data.

We do not “sell” or “share” for cross-contextual behavioural advertising (as those terms are defined under applicable local law) the categories of personal data described below. Instead, where we may use cookies for marketing purposes, for example, we do so at your instruction based on your permission to use cookies associated with this processing. Where you direct us to do so, we and certain third-party business partners, such as our advertising partners, may collect health data (defined below) using cookies and other similar technologies when you visit or interact with AI-Companion. These partners also may use cookies and other similar technologies to collect your health data over time across different websites and applications depending on the associated permissions you set. We do not use or disclose sensitive personal data for purposes other than permitted under applicable local law.

CATEGORIES OF PERSONAL DATA THAT WE COLLECT AND DISCLOSE

As may be required under applicable local law, the chart below provides the categories of personal data that we: (1) collect and have collected in the preceding 12 months; and (2) disclose for a business purpose and have disclosed for a business purpose in the preceding 12 months. For more information about how we disclose your personal data, refer to Section 6 above.

CATEGORIES OF PERSONAL DATA WE COLLECT AND DISCLOSE	DISCLOSED TO WHICH CATEGORIES OF THIRD PARTIES
A. NAME, CONTACT INFORMATION AND IDENTIFIERS: Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, username, or other similar identifiers.	Affiliates; Public Authorities; External Consultants
B. CUSTOMER AND OTHER RECORDS: paper and electronic customer records containing personal data, such as name, signature, physical characteristics or description, address, or telephone number	Affiliates; Public Authorities; External Consultants
C. PROTECTED CLASSIFICATIONS: characteristics of protected classifications under applicable state or federal law such as race, color, sex, gender, age, national origin, disability, and citizenship status.	Affiliates; Public Authorities; External Consultants
D. USAGE DATA: internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a resident’s interaction with an internet website, application, or advertisement.	Affiliates; Public Authorities; External Consultants
E. SENSITIVE INFORMATION: as defined under applicable local law, such as certain characteristics of protected classifications, account login credential and passwords, and health information (including health data, as defined below).	Affiliates; Public Authorities; External Consultants
F. PROFILES AND INFERENCES: inferences drawn from any of the information identified above to create a profile about a resident reflecting the resident’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.	Affiliates; Public Authorities; External Consultants

Depending on the specific service or product offering that you use or receive and your interaction with us, we may use certain personal information about you to identify your past, present, or future physical or mental health status (“health data”). Examples of health data we might collect include data that could identify you as an individual seeking health care services; and inferences about your health that we may infer or derive from non-health related information.

For more information about how we use your personal information, please see Section 4 above. You can also find more information about our retention practices in Section 5 above.

We may also de-identify your personal information in such a way that you may not reasonably be re-identified and may use this/de-identified information for any other purpose. To the extent we deidentify any data originally based on personal information, we will maintain and use such data only in de-identified form and will not attempt to reidentify the data except as permitted under applicable law.

INDIVIDUAL RIGHTS

Depending on where you live and subject to certain exceptions, you may also have the following rights in addition to those described in Section 9:

The right to opt out of processing considered targeted advertising;
The right to appeal our decision(s) regarding the handling of your request to exercising your rights; and
The right to be free from unlawful discrimination for exercising your rights under applicable state law.

In addition to exercising some of these rights through your account, you may submit requests to exercise your rights by accessing our webform at https://unobravo.typeform.com/to/PaItWFZd. You will be asked to provide certain personal information when submitting your request including your relationship with us, first and last name, email address, telephone number and postal address in order for us to determine if your information is in our systems.

We will further verify and respond to your request consistent with applicable law, taking into account the type and sensitivity of the personal information subject to the request. We may need to request additional personal information from you, such as your date of birth or government identifier, in order to protect against fraudulent or spoofed requests. If you want to make a request as an authorized agent on behalf of an individual under applicable local law, you may use the submission methods noted above. As part of our verification process, we may request that you provide us with proof that you have been authorized by the individual on whose behalf you are making the request under applicable local law, which may include signed permission provided by such individual.

NOTICE OF FINANCIAL INCENTIVES

We, including our service providers, may offer you financial incentives for sharing personal information through programs that we may provide from time to time (collectively, our “Programs”). For example, you may be offered the opportunity to participate in a survey or interview. Participation in a survey or interview may result in us collecting information from you, including your name, email, phone number, address, opinions, and/or responses to the survey/interview questions. In exchange for your participation in the survey or interview, you may be offered a financial incentive, such as a voucher.

We believe in good faith that the value received from the financial incentive offered for participation in a Program is greater than the value we receive from the use of the personal information collected in connection with the Program. While we do not assign a monetary value to the data that we collect in connection with the Programs, our method for calculating the value of would include the value of anticipated revenue from the Program; costs associated with facilitating and managing the Program or associated financial incentives; expenses incurred in the storage, retention and use of the information obtained through the Program; and all other costs reasonably related to the Program or associated financial incentives.

Your participation in these Programs is completely optional. You may withdraw from participation in any Program at any time by contacting us at contact details mentioned in Section 2. Please note that if you withdraw from a Program, your participation in that Program will be terminated, which means, generally, that you will no longer be eligible to earn any associated financial incentives.