Privacy policy

Last updated: 18 October 2026

This privacy policy explains how Bagubits srls processes the personal data of people who visit ciaougo.com, use the portal app.ciaougo.com and write to the assistant Ugo on WhatsApp (together, the “Service”), under Regulation (EU) 2016/679 (“GDPR”) and the Italian Privacy Code (Legislative Decree 196/2003). The Italian version of this policy prevails in case of differences.

1. Data controller

Bagubits srls
Via Carlo Chiapello 1, 12100 Cuneo (CN), Italy
VAT number IT03872360049 · SDI code K95IV18
Phone +39 0171 1640768 · Certified email (PEC) bagubitssrls@pec.it

Bagubits has not appointed a Data Protection Officer (DPO), as it is not required to: for any question you can reach us at the contact details above.

When Bagubits acts on the customer’s behalf

Ugo works on the data the customer connects: their calendar, emails, address book, documents, CRM and, with automations, the messages their own customers send to their WhatsApp Business number. For the data of third parties found in these tools (the customer’s contacts, customers and colleagues), the controller is the customer’s company and Bagubits processes them as a processor (Art. 28 GDPR), only to provide the Service and following the customer’s instructions. The customer must inform these people and have a legal basis for the processing.

2. The data we collect

Data you give us

• Account data: name, email, password (stored hashed), language and time zone, any photo or logo you upload.
• Company and billing data: company name, address, VAT number, invoicing code. Card details are collected directly by Stripe: we never see or store them.
• WhatsApp number: the number you write to Ugo from, verified with a code.
• Messages with Ugo: the texts, voice messages, images and documents you send Ugo on WhatsApp, and its replies.
• Data of the skills you connect: when you connect a service (for example Google Calendar, Gmail, Outlook, Google Drive, OneDrive, Odoo, HubSpot, Zoho CRM, monday.com, Zendesk), Ugo reads and, only after your confirmation, changes the data you need at that moment: appointments, emails, contacts, documents, deals. We store the access tokens (encrypted) and only what is needed for the Service to work, such as the synced address book.
• WhatsApp Business number and your customers’ messages: if you connect your WhatsApp Business number, we store the date, time and text of the messages you receive and send, to show you the conversations and run the automations you set up.
• Address book: the contacts you sync or add. If you ask, Ugo enriches them with publicly available information (website, public profiles) and suggests how and when to get back in touch.
• If you write to Ugo without an account: your WhatsApp number, your WhatsApp display name and the messages of the free trial, to let you try Ugo and get back to you if you are interested.
• Friends you invite: the email address of the friends you ask us to invite, and whether and when they open the invitation link (to grant free days to whoever invited them). To prevent abuse we keep a keyed hash of the IP address the invitation was sent from and of the one that opened it, never the IP address itself.
• Communications: what you send us through the contact form, by email or on the phone.

Data collected automatically

• Technical data and logs: IP address, browser and device type, pages requested, date and time, errors. They are needed for security and operation.
• Technical cookies of the portal (session, form protection, “remember me”) and your choice on the site’s cookie banner.
• Site statistics: only if you accept them on the banner, Google Analytics collects browsing data on ciaougo.com. Details are in the Cookie policy.

Data from third parties

• Services you connect (Google, Microsoft and the others above): the account name and email and the data you give us access to.
• Stripe: the outcome of payments and the last digits of the card.
• Who invited you: if you sign up from an invitation, we know which user invited you.

3. Why we use the data, and on which legal basis

Purpose	Data involved	Legal basis
Creating and managing the account, providing the Service, running skills, proactive messages and automations, support	Account, company, WhatsApp number, messages, skill data, technical data	Performance of the contract (Art. 6.1.b)
Billing, payments, tax and accounting obligations	Account, company and billing data, payment outcome	Legal obligation (Art. 6.1.c) and performance of the contract
Letting people who write on WhatsApp without an account try Ugo, and getting back to them	WhatsApp number and name, trial messages	Pre-contractual steps at the person’s request (Art. 6.1.b) and legitimate interest (Art. 6.1.f)
Sending a friend’s invitation and granting free days and months	Friend’s email, who invited them, opening of the link, sign-up and payment	Legitimate interest (Art. 6.1.f) in making the Service known at a user’s request; performance of the contract for the free months
Security, preventing abuse and fraud, legal defence	Technical data and logs, account	Legitimate interest (Art. 6.1.f) and legal obligation
Answering people who contact us	Data entered in the form or email	Pre-contractual steps (Art. 6.1.b) or legitimate interest
Service communications (important news, security, due dates)	Account	Performance of the contract
Site visit statistics	Browsing data	Consent (Art. 6.1.a), which you can withdraw at any time

We do not use your data for personalised advertising, we do not sell it and we do not make automated decisions that produce legal or similarly significant effects on you (Art. 22 GDPR).

4. Artificial intelligence

To understand requests and write replies, Ugo sends the text of the conversation and the data needed to answer to the Claude model by Anthropic, through its API. Under Anthropic’s commercial terms, data sent through the API is not used to train its models. Bagubits does not use your data to train artificial intelligence models either.

Voice messages are transcribed on our own servers in Europe, without external services.

Before doing anything with effects (sending an email, creating an appointment, changing the CRM), Ugo always asks for your confirmation. Artificial intelligence replies can contain mistakes: check them before relying on them for important decisions.

5. Data received from Google APIs

Ugo’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Google Calendar, Gmail, Google Contacts and Google Drive data is only used to provide the features you turned on, is not used for advertising, is not sold and is not used to train generalised artificial intelligence models; no person reads it, unless you explicitly ask, for security reasons or to comply with the law.

6. Who we share data with

Data is processed by authorised Bagubits staff and by the providers that help us deliver the Service, appointed as processors:

Provider	What it does	Where
Amazon Web Services	Servers, database and email delivery	EU (Frankfurt)
Anthropic	Claude artificial intelligence model	USA
Zernio	Connection to WhatsApp Business (WhatsApp solution provider)	See its privacy policy
Meta Platforms (WhatsApp)	Delivery of WhatsApp messages	EU / USA
Stripe	Payments and invoices	EU / USA
Google	Site statistics (with consent), maps and website previews	EU / USA

When you connect a third-party service (Google, Microsoft, Odoo, HubSpot, Zoho, monday.com, Zendesk, Notion, Linear…), data flows between Ugo and that service on your instructions, and that service processes it under its own privacy policy.

We may also share data with advisers (accountants, lawyers), with public authorities when the law requires it and, in corporate transactions (mergers, transfers), with the successor, who will have to respect this policy.

7. Transfers outside the European Union

Some providers are based in, or have servers in, the United States. In these cases the transfer relies on the European Commission’s adequacy decision for companies certified under the EU-U.S. Data Privacy Framework, or on the standard contractual clauses approved by the Commission (Art. 46 GDPR). You can ask us for a copy of the safeguards used.

8. How long we keep data

• Account, messages with Ugo and skill data: as long as the account is active. When you delete the account we erase them, except what we must keep by law.
• Messages of the WhatsApp Business number: as long as the number stays connected; disconnecting it erases them.
• Tokens of connected services: as long as the skill is on; disconnecting it deletes them.
• Accounting and tax records: 10 years, as required by Art. 2220 of the Italian Civil Code.
• Free trials of people without an account: up to 12 months after the last message, if they do not become customers.
• Emails of invited friends: until the friend signs up or the inviter deletes the invitation. We never send a second, unrequested invitation.
• Contact requests: as long as needed to answer and follow up any business relationship.
• Technical logs: for a limited period, as needed for security and troubleshooting.
• Site statistics: 14 months in Google Analytics.

9. Security

We use appropriate technical and organisational measures: encrypted connections (HTTPS), hashed passwords and encrypted tokens, access limited to authorised staff, servers in a certified data centre in the European Union, explicit confirmation before any action with effects. No system is 100% secure: should we become aware of a personal data breach, we will act as required by Articles 33 and 34 GDPR.

10. Children

The Service is meant for professionals and businesses and is not intended for people under 18. If you believe a minor has given us data, write to us and we will delete it.

11. Your rights

At any time you can ask Bagubits for:

• access to your data and a copy of it (Art. 15);
• rectification of inaccurate data (Art. 16);
• erasure (Art. 17);
• restriction of processing (Art. 18);
• portability in a machine-readable format (Art. 20);
• to object to processing based on legitimate interest (Art. 21);
• to withdraw consent, without affecting processing already carried out (for statistics: the “Cookie preferences” link at the bottom of every page of the site).

Much of this you can do yourself in the portal: edit your profile, disconnect skills, delete your account from Settings. For everything else write to bagubitssrls@pec.it or to the postal address above: we answer within one month. We may ask for information to verify your identity.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it) or with the supervisory authority of the country where you live or work.

12. Inviting friends

Before entering a friend’s email, make sure they are happy to receive it. We send one invitation only, in your name; the email explains why they receive it and that, if they are not interested, we will not write again.

13. Changes to this policy

We may update this policy when the Service or the law changes. The date at the top shows the latest version; if the changes are significant we will tell you in the portal or by email.