Data Processing Terms

Your organization decides what personal data to put into BABA and why, so your organization is the data controller for the employee, team, contract, and document data you provide. BABA acts as a data processor: we process that data only on your documented instructions and only to provide the Service.

We process the data your organization enters or connects (names and contact details, roles and reporting lines, goals and performance notes, contracts, and any documents you upload) for these purposes only:

• operating the platform and the features you use;
• generating insights and answering questions through the Ask Baba AI assistant;
• securing, backing up, and maintaining the Service;
• providing support you request.

BABA informs human decisions. It does not make them. BABA does not make automated employment decisions and does not use medical, disability, or other protected-class data to generate recommendations.

We use a small set of vetted sub-processors to run the Service, including cloud hosting and database infrastructure (AWS, Supabase) and the AI model providers that power Ask Baba. Each is bound by contractual confidentiality and data-protection obligations consistent with these terms. The current list, with what each provider receives and where it is processed, is in Section 5 (Sub-Processors and International Transfers) of the Privacy Policy. We will give notice of material changes.

We apply technical and organizational measures appropriate to the risk, including encryption in transit and at rest, row-level access controls that isolate each organization's data, least-privilege access for our systems, and audit logging of sensitive actions. No method of transmission or storage is perfectly secure, but we work to protect your data and to notify you without undue delay of any breach affecting it.

BABA operates infrastructure in multiple regions. Where personal data is transferred across borders, we rely on appropriate safeguards (such as Standard Contractual Clauses) for the transfer.

You remain responsible for responding to your people's data-subject requests (access, correction, erasure, portability). BABA provides the tooling to export and delete an individual's data on your instruction, and will assist you in meeting those obligations. See the Privacy Policy for how rights are handled today.

We retain personal data for as long as your organization uses the Service and as needed to provide it. When you delete a record, an individual, or your organization, we delete the associated personal data on the schedule described in the Privacy Policy, except where we must retain limited records to meet legal obligations (for example, the consent records that prove these terms were accepted).

Questions about how BABA processes data? Contact us at hello@babamethod.com.