This policy explains what personal data BajaWell Dev collects, why, who sees it, and the choices you have. In short: we collect what we need to run your account and build your sites, we use trusted providers to do it, we do not sell your data, and you can ask us to access or delete it at any time.
1. Who is responsible for your data
The controller of personal data processed through BajaWell Dev is Luis Pulido Díaz, operating under the bajawell name (we, us). For anything in this policy, including exercising your rights, write to privacy@bajawell.com.
This policy covers the BajaWell Dev website and application. It does not cover the websites you build with the Service: for those, you are responsible for your own visitors' data and for your own privacy notice.
2. What we collect
Information you give us
- Account data: your name, email address and a hashed password (we never store your password in readable form).
- Project content: the messages you send to the agent, the instructions and materials you include, and the website files the agent creates for each of your projects.
- Billing data: what you purchase and your credit balance and history. Card details are entered with Stripe and are never stored by us; we receive only limited details such as the card brand and last four digits, your Stripe customer and subscription identifiers, and payment status.
- Communications: anything you send to our support or privacy addresses.
Information from sign-in providers
If you choose “Continue with Google”, Google shares your name, email address, profile picture and a Google account identifier with us. We do not receive your Google password and do not access your Gmail, Drive or other Google data.
Information collected automatically
- Session data: when you sign in we record a session, including a session token, its expiry, and your IP address and browser user-agent, to keep you signed in and protect your account.
- Usage and service data: actions such as creating projects, agent runs and the credits they consume, plus technical logs (IP address, requests, errors, timestamps) produced by our hosting platform.
- Analytics: aggregated, privacy-focused page-view statistics through Vercel Web Analytics, which does not use cookies or track you across sites.
We do not knowingly collect sensitive categories of data, and ask you not to put such data in your prompts.
3. How and why we use it (legal bases)
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Create and secure your account, authenticate you, keep you signed in | Performance of a contract; legitimate interests (security) |
| Run the agent on your prompts, store and preview your projects, provide export | Performance of a contract |
| Process payments, grant and deduct credits, keep accounting records | Performance of a contract; legal obligation |
| Prevent fraud, abuse and violations of the Terms; investigate incidents | Legitimate interests; legal obligation |
| Keep the Service reliable, diagnose errors, improve features, measure usage | Legitimate interests |
| Service and account emails (receipts, security notices, changes to terms) | Performance of a contract; legitimate interests |
| Respond to your requests and comply with law or legal process | Legal obligation; legitimate interests |
| Anything else you specifically agree to | Consent, which you can withdraw at any time |
We do not sell your personal data, we do not share it for cross-context behavioral advertising, and we do not use it to make decisions about you that have legal or similarly significant effects.
4. AI processing
To build your site, your messages, the project's file list and file contents are sent to a third-party large language model through our AI infrastructure provider (currently Anthropic models, routed via the Vercel AI Gateway). The model returns text and code that we save to your project.
- We use this processing only to deliver the Service to you. We do not use your content to train our own models.
- Our providers process the data under their own terms, which can change; see their policies linked under Sharing. We use the provider settings available to us to limit retention and secondary use of your prompts and outputs.
- Do not enter secrets or other people's personal data (passwords, API keys, health or financial data, government IDs) into prompts or project files. Anything you put there will be processed as described here.
- Output is generated by software, not reviewed by a person, and can be wrong. See the Terms.
6. International transfers
Luis Pulido Díaz and our providers operate in several countries, including the United States, so your data may be processed outside your country. Where required, we rely on appropriate safeguards for transfers from the EEA, UK or Switzerland, such as the European Commission's Standard Contractual Clauses, the UK Addendum, or the EU–US Data Privacy Framework where a provider is certified. Contact privacy@bajawell.com for details.
7. How long we keep it
- Account, projects and files: for as long as your account is open. When you delete a project, its files are removed from our database.
- Sessions: sign-in sessions last up to 7 days and are refreshed while you are active; expired sessions are no longer valid.
- Billing and ledger records: kept for as long as the law requires for tax and accounting (typically several years), even after account deletion, in a form that is minimized where possible.
- Security and operational logs: kept for a limited period set by our hosting provider, then deleted or aggregated.
- Support communications: as long as needed to handle the request and for a reasonable period afterward.
When you ask us to delete your account we delete or anonymize your personal data, except what we must keep for legal reasons or to protect against fraud and abuse. Copies in backups are overwritten in the ordinary course.
9. Your rights and choices
Depending on where you live (for example the EEA, UK, Switzerland, California and other US states, Brazil, Canada, and Mexico), you may have the right to:
- access the personal data we hold about you and receive a copy;
- correct inaccurate or incomplete data;
- delete your data (“right to be forgotten”), subject to legal exceptions;
- restrict or object to certain processing, including processing based on legitimate interests;
- data portability: receive data you provided in a structured, commonly used format;
- withdraw consent at any time, without affecting earlier processing;
- not be discriminated against for exercising your rights, and opt out of the sale or sharing of personal data (we do neither);
- lodge a complaint with your data protection authority.
To exercise a right, email privacy@bajawell.com from the address on your account. We may ask you to verify your identity and will respond within one month (or the shorter period your law requires), extending where permitted for complex requests. There is normally no charge, unless a request is manifestly unfounded or excessive.
You can also export your project code yourself at any time with the ZIP export. You can authorize an agent to make a request for you where local law allows, subject to verification.
10. Security
We use measures appropriate to the risk: encrypted connections (HTTPS), hashed passwords, access-controlled databases, per-user project isolation checked on the server, signature-verified payment webhooks, and limited access to production systems. No system is perfectly secure, and we cannot guarantee absolute security. Use a strong, unique password.
If a breach affects your personal data, we will notify you and the authorities as required by law. To report a vulnerability, email privacy@bajawell.com or see our security.txt.
11. Children
The Service is not directed to children and is not intended for anyone under 16. We do not knowingly collect personal data from them. If you believe a child has given us data, contact privacy@bajawell.com and we will delete it.
12. Changes to this policy
We may update this policy, for example when we add a provider or feature. The date at the top shows the latest version. For material changes we will notify you by email or in the Service before they take effect where practical.
13. Contact
Questions or requests: privacy@bajawell.com. Other legal matters: legal@bajawell.com. Data controller: Luis Pulido Díaz.