SaaS

Privacy policy

How we process and protect your personal data.

Document language / Idioma

Last updated: 5 November 2026

1. Who is responsible for your data

ZAIBEL BUTTERFLI, S.L., with registered address at Avinguda Francesc Macià 60, 7th floor, No. 3, 08208 Sabadell (Barcelona), Spain, and Spanish tax identification number (NIF) B19944578 (hereinafter, "Zaibel"), is the controller of the personal data described in this policy. For any privacy-related questions, you can contact us at informacion@zaibel.com.

2. What Zaibel is

Zaibel is a digital marketing platform for agencies and businesses. It enables users to manage clients and business profiles, analyze organic performance, prepare SEO audits and marketing plans, and create and publish content (blog posts and landing pages) on WordPress websites.

3. Data we process

  • Account: name, email address, and organization. We use two technical cookies that are necessary to keep you signed in.
  • Sign in with Google (optional): if you sign in with your Google account, we receive and store a stable Google identifier, your email address, and your name (the openid, email, and profile permissions). This is separate from connecting Google Search Console and Google Analytics 4, and we use this information only to identify you.
  • Data you enter: information about your clients and profiles (for example, business name, website, products, or locations) and the content you save in Zaibel (blog posts, landing pages, plans, and SEO audits).
  • WordPress connection: if you connect a WordPress website, we store the credentials you provide in encrypted form and read the website’s public content to prepare audits. We publish only when you request it.
  • Billing (when enabled): subscription data. Payments will be processed by Stripe; Zaibel will not store card numbers. Zaibel currently does not charge or process payments.
  • Technical data: technical logs necessary for the service to operate, which we retain for 30 days, and security-event logs (for example, login attempts and blocks), which we retain for 180 days.
  • Google data you authorize when connecting Google Search Console and Google Analytics 4:
    • Search Console: organic search metrics for the properties you choose (queries, pages, countries, devices, clicks, impressions, CTR, and position).
    • Google Analytics 4: traffic metrics for the properties you choose (users, sessions, channels, landing pages, events, and key events).
    • From your Google account, we store only a stable identifier and your email address (the openid and email permissions) so that we know which account the connection belongs to.
  • Google Ads (Zaibel’s own account): to estimate search volume for the keywords you research, we send those keywords to the Google Ads API from Zaibel’s account and receive their metrics (monthly searches and competition). We do not send Search Console or Google Analytics data, and we do not access our users’ or their clients’ Google Ads accounts.

4. How we use Google data

We use Google data solely to provide the visible features of Zaibel: performance dashboards, period comparisons, content opportunities, and SEO audits for the profiles you connect.

Zaibel:

  • does not sell Google data;
  • does not use it for advertising, including interest-based advertising;
  • does not use it to develop, improve, or train general-purpose artificial intelligence or machine-learning models;
  • does not transfer it to third parties except when necessary to provide the service you request, for security reasons, to comply with the law, or in aggregated and anonymized form;
  • does not allow any person to read your Google data except with your express consent, for security reasons, to comply with the law, or when the data is aggregated and anonymized.

Zaibel does not run its own artificial intelligence models on your Google data. Zaibel offers a connection through the MCP protocol so that, if you choose to do so, an AI assistant that you select and authorize can query your data in Zaibel. Data is supplied only when you request it through that assistant and only for the task you ask it to perform (for example, analyzing your performance or preparing content). That assistant is provided by a third party, and its processing of the data is governed by the terms you have with that provider. You can disconnect it at any time.

Google Limited Use disclosure. The use and transfer of information received from Google APIs to any other application will comply with the Google API Services User Data Policy, including the Limited Use requirements.

5. Legal basis for processing

  • Performance of a contract or service relationship: account data, data you enter, WordPress connection, and billing when available.
  • Consent: Google data, which we process only when you authorize the connection and for which you can withdraw consent at any time by disconnecting it.
  • Legitimate interests: technical logs, to ensure service security.
  • Legal obligation: retention of data required by applicable laws, such as tax laws.

6. Google permissions we request

PermissionPurpose
.../auth/webmasters.readonlyRead Search Console metrics (read-only).
.../auth/analytics.readonlyRead Google Analytics 4 metrics (read-only).
openid, email, profileIdentify the Google account you connect or use to sign in (identifier, email address, and name).

Zaibel never modifies your Search Console or Google Analytics. Zaibel does not request any Google Ads permission from you.

7. How long we retain data

  • Google metrics: 16 months. They are automatically deleted after that period.
  • Disconnecting an integration: deletes the access token and revokes it with Google. Metrics already imported are retained until you delete them or the retention period above expires.
  • Deletion on request: an organization owner or administrator can delete a profile’s metrics, connections, and SEO audits at any time. You can also request deletion by writing to informacion@zaibel.com.
  • Subscription cancellation (when billing is available): we delete Google data and revoke tokens 90 days after the end of the paid period, with prior notice.
  • Deleted profiles or clients: their Google data is deleted within 30 days.
  • Backups: deleted data may remain in automatic backups for a maximum of 7 days.

8. Where we store data and how we protect it

Data is hosted on Microsoft Azure services in the West Europe region (the Netherlands), including the database. Google access tokens and WordPress credentials are stored encrypted. We apply role-based access controls within each organization.

9. Who we share data with

Only with providers needed to deliver the service and under contract: Microsoft Azure (hosting), our email delivery provider, and Stripe (payments) when billing is enabled. Zaibel does not share Google data with other third parties, except for disclosure to the AI assistant you connect, as described in section 4.

10. International data transfers

Zaibel hosts data within the European Economic Area (EEA). If you connect an AI assistant whose provider processes data outside the EEA, that transfer takes place at your discretion and subject to the safeguards offered by that provider.

11. Your rights

You may request access to, rectification, erasure, restriction of processing, objection to processing, and portability of your data, as well as withdraw your consent, by writing to informacion@zaibel.com. We will respond within one month. If you believe we have not respected your rights, you may lodge a complaint with the data protection authority in your country (in Spain, the Spanish Data Protection Agency).

You can also revoke Zaibel’s access to your Google account at any time at myaccount.google.com/permissions.

12. Changes to this policy

If we make material changes to this policy, we will notify you by email or within the application before the changes take effect.

13. Minors

Zaibel is a professional service and is not intended for persons under 18 years of age. We do not knowingly process data relating to minors.