Privacy Policy

Last updated: July 28, 2026

Baldo ("we", "us", "our") operates an AI-powered personal assistant accessible through the messaging apps you already use — WhatsApp, SMS, Instagram Direct Messages, Facebook Messenger, Telegram, LINE, and email — and at baldo.ai (the "Service"). This Privacy Policy explains how we collect, use, store, and protect your information.

1. Information We Collect

Information you provide directly:

Messages: Text messages (and any images, voice notes, or files you choose to send) that you send to Baldo on any supported messaging app, including WhatsApp, SMS, Instagram Direct Messages, Facebook Messenger, Telegram, LINE, and email.
Account identifier: The identifier the messaging app gives us for you — your phone number on WhatsApp or SMS, or the platform-scoped account ID the platform assigns (for example an Instagram-scoped user ID or a Messenger page-scoped ID) — used to identify your account and route replies back to the conversation you wrote from.
Display name: Your profile name on the messaging app you write from.
Contact form submissions: Email address and message content if you use the contact form on our website.

Information from connected services (with your explicit consent):

Google account data: If you choose to connect your Google account, we access your Gmail messages, Google Calendar events, and Google Drive files (read-only) to provide assistant features. We store OAuth tokens to maintain this connection.
Health & fitness data (optional): If you choose to connect a fitness tracker (such as Fitbit, via the Google Health API), we read your activity (steps, distance, calories, active minutes, workouts), sleep, health metrics (such as resting heart rate, heart-rate variability, blood oxygen, breathing rate, weight, and body fat), and nutrition logs (meals and water) — read-only, fetched on demand — solely to answer your questions and provide the summaries and coaching you request. We store OAuth tokens to maintain this connection. Health data is shown only to you, is never used for advertising, is never sold or shared with third parties, and is never used to train AI models. You can disconnect your tracker at any time, which stops further access.
Microsoft account data: If you choose to connect your Outlook account, similar email and calendar access applies.

Information collected automatically:

Usage data: Message counts, timestamps of interactions, and onboarding progress.
Subscription data: Payment status and subscription period (payment details are processed by Stripe and never stored on our servers).

2. How We Use Your Information

To provide, maintain, and improve the AI assistant Service.
To process and respond to your messages using AI (Anthropic Claude).
To manage your Google or Microsoft account integration at your request.
To process subscription payments through Stripe.
To learn from your messages and the accounts and content you connect, and to build and maintain a durable, personalized memory, so the Service can understand your context and assist you better over time.
To respond to your contact form inquiries.

3. Personalized Memory, Learning, and Google Workspace API Data Use

Personalization is a core function of the Service. By using Baldo, you agree that Baldo reads, processes, and learns from the information you provide and the accounts and content you connect — including your messages and, where you connect them, your email, calendar, and photos — and that it builds and maintains a durable, personalized memory about you so it can understand your context and assist you better over time. This learning and memory is part of how the Service operates; it is a core feature, not an optional add-on.

Face recognition (face signatures). If you tell Baldo who someone is in a photo you share (for example, “this is my friend Ana” or “this is me”), Baldo creates a numeric face signature for that person — a “face model,” which is considered biometric data in some jurisdictions — so it can recognize them in photos and videos you share later. Face signatures are created only when you name someone; Baldo never builds signatures for people you have not identified. They are stored only within your account, are never shared with third parties, sold, or used to identify strangers, and are permanently deleted when you ask Baldo to forget that person (“forget [name]”), turn face memory off (“stop recognizing people”), or delete your account.

You remain in control of specific information: you can ask Baldo to forget particular things at any time, and you can disconnect any linked account (such as your Google account) at any time through that provider's settings, which stops further processing of that account's data.

AI/ML disclosure. Baldo does not use any Google Workspace API data or Google Health API data — or any other personal data it processes — to develop, improve, or train generalized or non-personalized AI models. Memory and personalization are used solely to operate and personalize the Service for you.

Limited Use. Baldo's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Concretely: data obtained from Google Workspace APIs (Gmail, Calendar, Drive, Docs, Sheets, Slides, Forms, Tasks, Contacts) and from the Google Health API is used only to provide and improve the user-facing features you see in Baldo; it is never sold, never transferred to data brokers, advertisers, or other information resellers; never used for advertising, credit, or lending purposes; and never used to develop, improve, or train generalized or non-personalized AI/ML models. Where Baldo passes your data to a third-party AI provider in order to generate your reply (see Section 5), that provider does not use it to train its models.

4. Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA), we process your data under the following legal bases:

Contract performance: Processing necessary to provide the Service you have subscribed to, including the personalized learning and durable memory that are core functions of the Service. You can stop this processing by ending your use of the Service or disconnecting a linked account.
Consent: Where we rely on consent (for example, connecting an optional account), you may withdraw it at any time, which stops the related processing going forward.
Explicit consent (biometric data): Face signatures are processed only on the basis of your explicit consent, which you give by naming a person in a photo you share. You can withdraw it at any time by asking Baldo to forget a person or by turning face memory off, which deletes the related signatures.
Legitimate interest: Improving the Service, preventing abuse, and ensuring security.

5. Third-Party Services

We share data with the following third parties only as necessary to provide the Service:

Anthropic (Claude AI): Your messages are sent to Anthropic's API for AI processing. Anthropic's privacy policy applies to their processing. Messages sent via the API are not used to train Anthropic's models.
Meta (WhatsApp, Instagram, Messenger): Message delivery and receipt via the WhatsApp Cloud API and the Messenger Platform (which also serves Instagram Direct Messages), subject to Meta's privacy policy. When you message Baldo on Instagram or Messenger, Meta provides us the message content and a platform-scoped account ID so Baldo can reply to you in that conversation; we use it only to provide the assistant service you asked for, and never for advertising.
Google: Gmail, Calendar, and Drive access when you connect your Google account, subject to Google's privacy policy.
Google Health API: Fitbit activity, sleep, health-metric, and nutrition data when you connect your fitness tracker, subject to Google's privacy policy. Read-only; Baldo never writes to or modifies your health data.
Stripe: Payment processing, subject to Stripe's privacy policy. We do not store your credit card details.
Google Cloud Platform: Infrastructure hosting (Firestore database, Cloud Run compute) in the United States (us-central1 region).

6. Data Storage and Retention

Messages: Recent conversation history is cached for up to 24 hours to maintain context. Older sessions are consolidated into summarized memories.
Memories: Long-term memories are subject to automatic salience decay. Frequently accessed memories are retained; unused memories fade and are eventually deleted. Memories Baldo builds from your messages and the sources you connect (such as calendar, email, or photos) are stored alongside the rest of your memory and tagged with their origin. You can ask Baldo to forget specific things at any time, and disconnecting a linked account stops further memories being built from it.
Face signatures: Numeric face signatures (no face images) for people you have named are kept only while that person remains in your face memory, capped in number, and are permanently deleted when you ask Baldo to forget the person, turn face memory off, or delete your account.
Account data: Retained for the duration of your active account. Upon cancellation, data is retained for up to 30 days before deletion.
Contact submissions: Retained as long as necessary to respond to your inquiry.
Google/Microsoft tokens: Stored encrypted and retained while the integration is active. Revoke access at any time through your Google or Microsoft account settings.

7. International Data Transfers

Your data is processed and stored in the United States on Google Cloud Platform. If you are located outside the United States, your data will be transferred to and processed in the US. By using the Service, you consent to this transfer. For EEA users, we rely on Standard Contractual Clauses and adequacy decisions where applicable.

8. Your Rights

For all users:

Access the personal data we hold about you.
Request correction of inaccurate data.
Request deletion of your data.
Disconnect your Google or Microsoft account at any time.

Additional rights for EEA residents (GDPR):

Right to data portability.
Right to restrict processing.
Right to object to processing based on legitimate interest.
Right to withdraw consent at any time.
Right to lodge a complaint with your local data protection authority.

Additional rights for California residents (CCPA):

Right to know what personal information is collected and how it is used.
Right to delete personal information.
Right to opt-out of the sale or sharing of your personal information.
Right to non-discrimination for exercising your privacy rights.

To exercise any of these rights, contact us using the contact form on our website.

9. Data Security

We implement appropriate technical and organizational measures to protect your data, including encryption in transit (TLS), secure cloud infrastructure, and access controls. However, no method of electronic transmission or storage is 100% secure.

10. Children's Privacy

The Service is not intended for use by anyone under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

11. Cookies

Our website does not use cookies or tracking technologies. No analytics or advertising scripts are loaded.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the Service after changes constitutes acceptance of the revised policy.

13. Contact

For privacy-related inquiries or to exercise your rights, please use the contact form on our website.