Your privacy, in plain words
Isabell is a personal assistant: she works precisely because she remembers what you tell her. That obliges us to be very clear about where that information lives and who can see it. No fine print.
Your Isabell lives in the EU, in a space of her own
Every customer gets their own Isabell in an isolated container, on servers in the European Union (Helsinki, Finland). Her memory, her notes about you and her conversations stay inside that container. There is no shared database of everyone’s conversations, and the Isabell.io team does not read them.
We don’t train models on your data
Not us, and nobody through us. Your conversations are never used to train any AI. Period.
The brain you choose
To think, your Isabell sends each message to the AI provider YOU configured (for example your own ChatGPT account or your own API key). That leg is governed by that provider’s terms — same as when you use it directly. We only act as a bridge and count tokens to run the service.
When you send her to the internet
If you ask her to search or open a link, her browser visits that site just like yours would. Weather comes from open, account-free services (Open-Meteo).
What we store on the platform (outside your container)
The minimum to operate: your email, your configuration (channels, skills, connectors) and usage counters. Secrets (channel or connector tokens) are stored encrypted with AES-256-GCM. Cookies: technical ones (session and language) always, and analytics cookies (Google) ONLY if you accept them in the banner — say no and none are set, no hard feelings.
Your rights, in two buttons
From your dashboard you can export everything Isabell.io knows about you in one click (a JSON with your profile, configuration, routines and your Isabell’s memory) and delete your account entirely: your container is destroyed with all its contents and your platform data is removed. No begging emails, no hidden retention.
Questions?
Write to hola@isabell.io and a human will answer.
(both buttons live in your dashboard, under Settings)
The formal part (GDPR)
The section above is the honest explanation; this is the same in regulation language. If the two ever conflict, this part prevails.
Data controller
Sergio Rico, tax ID ES71164693W, Calle Santa Ana 2A, 47195 Arroyo de la Encomienda (Valladolid), España. Contact for anything data-related: hola@isabell.io.
What data we process and why (legal bases)
a) Account data (email, optional name, encrypted password) and configuration: to provide the Service — performance of contract, art. 6.1.b GDPR. b) Billing and payment data (handled by Stripe; we do not store your card): performance of contract and legal tax obligation, art. 6.1.b and 6.1.c. c) Your assistant’s content (conversations, memory, files you send her): processed inside your isolated container exclusively to provide the Service — art. 6.1.b; never used for any other purpose nor to train models. d) Technical logs and usage counters: security, fraud prevention and operating the Service — legitimate interest, art. 6.1.f. e) Communications you send us: to assist you — art. 6.1.b.
Recipients and processors
We do not sell or share your data. We use processors under art. 28 GDPR agreements: Hetzner Online GmbH (hosting, EU data centres — Germany/Finland), Stripe (payment processing), Mailrelay (transactional email, Spain), Zoho (support mailboxes, EU data centres) and Google (web analytics — only if you accept its cookies in the banner). Additionally, your Isabell sends messages to the AI provider YOU linked (e.g. your ChatGPT account): on that leg the provider acts under your own contractual relationship with it.
International transfers
Your data and your container live in the EU. Stripe may involve transfers to the US covered by the EU-US Data Privacy Framework and standard contractual clauses. If you link an AI provider from outside the EU (your ChatGPT, your API key), that transfer is governed by your relationship with that provider and its safeguards.
Retention
For as long as your account is active. When you delete your account, your container is destroyed with all its contents and your platform data is removed within a maximum of 30 days. Billing data is kept for the years required by tax and commercial law (for that sole purpose).
Your rights
You can exercise access, rectification, erasure, objection, restriction and portability from your dashboard (one-click export/delete) or by writing to hola@isabell.io. If you believe we handled it poorly, you can complain to the Spanish Data Protection Agency (aepd.es).
Minors
The Service is intended for adults (18+). We do not knowingly process minors’ data; if we detect a minor’s account, we will delete it.
Cookies
Strictly necessary technical cookies (exempt from consent): session, language, your cookie choice (isabell-consent, 180 days) and the referral cookie if you arrive via an invitation. Analytics and measurement cookies (Google Analytics via Google Tag Manager, with Consent Mode v2): they are ONLY set if you accept them in the banner — legal basis: your consent, art. 6.1.a GDPR, revocable at any time by clearing the site cookies (the banner will ask you again). If you reject them, Google sets no cookies and receives no identifiers about you.