Blackbot Privacy Policy

Blackbot privacy policy: BLACKWORKS' WhatsApp assistant

Last updated: 4 November 2026 · Versión en español

This policy explains what we do with your data when you write to BLACKWORKS on WhatsApp and Blackbot, our automated assistant powered by artificial intelligence (AI), replies to you. For everything else (website, ticket purchases, shop), see our general privacy policy. This is a translation; if there is any discrepancy, the Spanish version prevails.

In short

Who: BW MUSIC, S.L. (BLACKWORKS) is the controller of your data. Contact: contact@blackworks.es.
What Blackbot is: an AI assistant, not a person. It answers questions about our events and tickets.
What we use: your number (or your WhatsApp identifier) and your message, to reply to you and to protect the service.
Conversations: our systems don't store them. Meta (WhatsApp) and Anthropic (the AI) keep them on our behalf for 30 days at most, with the exceptions in section 8.
Where they go: WhatsApp/Meta, Cloudflare and Anthropic, with processing in the US (section 7).
Please don't send health or payment data or other people's data. In an emergency, tell venue security or call 112.
You decide: type STOP to stop AI replies, MY DATA to see what we keep linked to your number, or DELETE to erase it, except the opt-out (sections 9, 11 and 12).
Your rights: at contact@blackworks.es. You can also complain to the Spanish Data Protection Agency.

1. Who is responsible for your data

The controller is whoever decides why and how your data is used. For Blackbot, it is:

BW MUSIC, S.L. (brand BLACKWORKS), Spanish tax ID (NIF) B10549095.
Address: Calle Evaristo San Miguel, 20, 1.º izquierda, 28008 Madrid, Spain.
Privacy contact: contact@blackworks.es.

Our general privacy policy applies to everything else. This one supplements it for Blackbot.

2. What Blackbot is

A program that uses AI to answer your questions about our events: dates, times, how to get there, tickets and entry rules.
It only uses the information our team publishes. It can make mistakes: if something matters to you, check it on our website or at contact@blackworks.es.
It replies in Spanish, or in English or Italian if you write in those languages.
It doesn't sell, take payments, process refunds or ticket name changes, or make decisions about you. A member of our team always handles those, at contact@blackworks.es.
It doesn't send you advertising: it only answers what you ask.
Emergencies: if you tell us about an emergency or a health or safety problem, Blackbot immediately replies with a fixed message, without AI (call 112 or tell the venue's security staff), and that message is not sent to the AI. In an emergency during an event, don't wait for the chat: tell security staff or call 112.

3. What data we process

Your phone number. If WhatsApp doesn't pass it to us, we receive instead an identifier that WhatsApp assigns to your account for our company (called a BSUID).
Your WhatsApp profile name. It arrives with each message, but Blackbot doesn't read or store it.
Your message and our reply. Blackbot uses at most the first 2,000 characters of your message.
Technical message data: its identifier and whether it was delivered, read or failed. For the latter we only keep totals.
A "fingerprint" of your number, explained in section 5.
Files: voice notes, photos, videos, documents, stickers, locations and contact cards.
- WhatsApp (Meta) receives them and keeps them on our behalf for up to 30 days.
- Blackbot receives the file type, its format and an identifier. If you write text with a photo, video or document (the caption), that arrives too, as does the document's name. For locations and contact cards, their content arrives. Blackbot doesn't use, store or send any of this to the AI: if your question is in the caption, send it as a separate message.
- Blackbot doesn't download anything. If you send a voice note, photo, video, document, sticker or location, it asks you to type your question. Contact cards are ignored without a reply.

Data we don't ask for. We don't need health data, identity documents, payment data or other people's data. Please don't send them. If you write them anyway, they go through the same places as the rest of your message, except the emergency messages in section 2, which are not sent to the AI.

Do you have to give us your data? No. But WhatsApp doesn't work without your number (or identifier) and your message: if we don't receive them, we can't reply to you here. If you prefer, write to contact@blackworks.es.

4. Why we use your data and on what legal basis

The law requires a "legal basis" for each use: the reason that allows us to process your data. We choose the basis according to what you ask, not according to whether you have a ticket, because we can't know that.

Purpose	Legal basis
Answering your questions about events and tickets: dates, times, how to buy, how to get there and entry rules	Giving you the information you request before buying, whether or not you buy afterwards. If you already have a ticket, performing our contract with you (Art. 6(1)(b) GDPR)
Answering other enquiries (press, partnerships, curiosity) and people who tell us or show that they are minors, who cannot buy tickets	Our legitimate interest in responding to those who write to us (Art. 6(1)(f) GDPR)
Telling you where to get help if you report an emergency	Protecting your life or health (Art. 6(1)(d) GDPR) and our legitimate interest in the safety of people attending our events (Art. 6(1)(f) GDPR)
Protecting the service: limiting messages, avoiding duplicate replies and stopping abuse	Legitimate interest in the security of the service (Art. 6(1)(f) GDPR)
Controlling the cost of the service, for example with a daily AI usage limit	Legitimate interest in keeping the service sustainable (Art. 6(1)(f) GDPR)
Respecting your opt-out and not repeating the AI notice	Legitimate interest in respecting your choices (Art. 6(1)(f) GDPR)
Knowing how much the service is used: a mark with your fingerprint to count your conversation of the day (lasts 2 days; not created if you have opted out) and daily totals that don't identify you	Legitimate interest in managing the service (Art. 6(1)(f) GDPR)
Testing Blackbot before opening it, only with members of our team (internal test)	Legitimate interest in checking that the service works properly before offering it (Art. 6(1)(f) GDPR)

GDPR: the EU General Data Protection Regulation (Regulation (EU) 2016/679).
Legitimate interest: an interest of ours that the law accepts unless your right to privacy outweighs it. We have carried out this assessment in writing and you can ask us about it at contact@blackworks.es. You can object (section 10).

5. How we protect your data

Your conversations. Our systems don't store your conversations. The text passes through our providers (WhatsApp/Meta and Anthropic), who keep it on our behalf for a limited time and then delete it (section 8).
Your number is not stored. It is only used while your message is being processed. Instead, we store a fingerprint: a code calculated from your number with a secret key. It is used, for example, to remember that you opted out without storing your number. Without our key, it isn't possible to work out which number it comes from.
The AI only receives the text of your message, with our rules and the public event information. Never your number, your identifier or other technical data.
No memory. Blackbot doesn't remember your previous messages: it answers each one separately. If we ever enabled a conversation memory, we would tell you here before doing so.
Our team doesn't see your messages in the panel used to update the bot's information. If you write to contact@blackworks.es, a person replies.
Other measures:
- we check that each message really comes from WhatsApp;
- there are limits on messages per person and on AI usage;
- technical logs don't store phone numbers, texts or replies;
- access keys to our providers are kept as secrets;
- automatic filters try to prevent replies from including phone numbers, emails or links that aren't the official ones.

6. Who else sees your data

We work with three providers that process your data on our behalf. They are called "processors": they have a contract with us that requires them to follow our instructions and protect the data. Their contracts also allow some uses of their own, explained below the table.

Provider	What it does	What it receives	Where
Meta Platforms Ireland Limited (WhatsApp)	Receives and delivers messages	Everything you send and receive in this chat, including your number and profile name	Contract with the Irish company. Data centres in the US and the EU
Cloudflare, Inc.	The servers Blackbot runs on	Your message while it is processed. Stores the fingerprints and totals	US and its global network of data centres
Anthropic Ireland, Limited	The AI that writes the reply	Only the text of your message	Contract with the Irish company. Stores and processes data in the US

Uses of their own allowed by their contracts:

Meta also uses certain data on its own account, as an independent controller (a company that decides for itself how to use it), for the safety and integrity of WhatsApp. It does so under its own terms and privacy policy. Its terms also allow it to use data to improve its messaging service and, once aggregated or anonymised (combined with many people's data or stripped of anything that identifies you), other products of its own.
Anthropic has contractually committed not to train its AI models on your messages. However, to enforce its usage policy, it may keep messages flagged by its safety systems for up to 2 years, and the results of those checks for up to 7 years.
Cloudflare may use technical network traffic data (not the content of your messages) to maintain, protect and improve its services.

As a WhatsApp user, your use of the app is also governed by WhatsApp's terms and privacy policy.

Who we disclose your data to. Disclosing data means giving it to another company or body for its own purposes. We only do so with:

Meta, as an independent controller, for the purposes just explained.
Authorities and courts, when the law requires it.

7. Transfers outside Europe

An "international transfer" happens when your data leaves the European Economic Area (EEA: the EU plus Iceland, Liechtenstein and Norway). The law only allows it with safeguards.

Some providers process data outside the EEA, mainly in the US (Cloudflare also across its global network of data centres). The safeguards are:

Cloudflare, Inc. is in the US, so your data goes there directly.
- Safeguard: the EU-US Data Privacy Framework, which it has joined. It is a European Commission decision (Implementing Decision (EU) 2023/1795) recognising that participating US companies protect data adequately.
- As a backup: standard contractual clauses, which are contracts approved by the European Commission (Implementing Decision (EU) 2021/914).
Meta: our contract is with Meta Platforms Ireland Limited, in the EEA, so there is no transfer between us.
- Meta Ireland passes data to Meta Platforms, Inc. (US) and to the companies working for it (sub-processors), and is contractually bound to do so with safeguards that are valid under the GDPR.
- Meta Platforms, Inc. participates in the Data Privacy Framework.
Anthropic: our contract is with Anthropic Ireland, Limited, in the EEA, so there is no transfer between us.
- Anthropic Ireland passes the data to Anthropic, PBC (US) and to the companies working for it (sub-processors). We have limited AI processing to the US.
- Anthropic has not joined the Data Privacy Framework. The safeguard for that transfer is the standard contractual clauses approved by the European Commission, included in its data processing agreement. In addition, the safeguards the US introduced in 2022 (Executive Order 14086 and the Data Protection Review Court) apply to all transfers to the US, whatever safeguard is used.

You can ask us for more information about these safeguards, or a copy, at contact@blackworks.es.

8. How long we keep your data

What we keep about you is linked to your fingerprint (section 5), not your number. The only exception is the internal test (first row of the table). Each mark deletes itself when it expires.

Data	How long
Your number or WhatsApp identifier	We don't store it: it is only used while your message is processed. Only exception: the numbers of team members taking part in the internal test (up to five), which are removed from the list when the test ends
Your profile name	We don't read or store it
Your messages and our replies	Our systems don't store them. Meta keeps them on our behalf for 30 days at most. Anthropic, for 30 days at most, except what its safety systems flag (up to 2 years; the results of those checks, up to 7 years) and what the law requires
Files you send	Meta, up to 30 days. We don't download them
Mark to limit messages sent in quick succession	At most 60 seconds after your last message
Count of your conversations of the day	2 days
Daily reminder to people who have opted out	24 hours
Mark showing we already sent you the AI notice	90 days. After that, if you write again, you get the notice again
Opt-out mark (your fingerprint and the opt-out date)	Until you type ALTA, or up to 24 months without you writing to us (the period restarts on each day you write). If you write afterwards, you will get the AI notice again and can opt out again
Mark to avoid replying twice to the same message (not linked to your number)	7 days, plus up to 30 more days in Cloudflare's recovery system
Daily usage totals, which don't identify you	40 days
Technical logs, without your number, messages or replies	7 days
Conversation memory	Disabled

Providers' backups. Meta keeps its backups for a reasonable time, with no fixed period in its contract. Anthropic may hold copies in its automatic backup systems, under its terms.

9. Opting out: STOP and ALTA

Type STOP (or BAJA, on its own) and Blackbot stops replying with AI immediately. It confirms this once. You don't need to explain why.
If you have sent many messages in quick succession, the opt-out is still saved, but you won't get the confirmation. If you then write something else, you will get the reminder that you have opted out.
What still happens after you opt out. We can't stop WhatsApp from delivering your messages to us. If you write again, Blackbot:
- calculates your fingerprint to know that you have opted out and to apply the limits;
- sends you at most one reminder a day, fixed and without AI, explaining how to come back.
While you are opted out, we don't count your conversation in the statistics.
Your messages still go through WhatsApp (Meta), as in any chat.
Type ALTA to come back: your opt-out mark is deleted and Blackbot replies to you again. ALTA does not mean you accept advertising.
STOP doesn't delete your data. To do that, type DELETE (section 12).
The automatic replies to STOP, ALTA, MY DATA and DELETE are in Spanish.
To speak to a person, write to contact@blackworks.es.

10. Your right to object

You can object at any time, on grounds relating to your situation, to our use of your data based on our legitimate interest (section 4).
The quickest way: type STOP. It immediately stops all AI replies, without you having to explain anything. You can also write to contact@blackworks.es.
What we keep doing: calculating your fingerprint, keeping your opt-out mark and applying the limits. Without that, we couldn't respect your opt-out or protect the service from abuse. If you write again, we also send you at most one reminder a day explaining how to come back, so that you know why we aren't replying.
If you stop writing, no new mark is created. Existing ones are deleted when they expire (section 8).

11. Your rights

You can ask us, free of charge, for:

Access: to know what data of yours we process and receive a copy.
Rectification: to correct inaccurate data.
Erasure: to delete your data (section 12).
Objection: section 10.
Restriction: to keep your data without using it in certain cases, for example while we check a complaint of yours.
Portability, where applicable: to receive, in a commonly used format, the data you gave us to answer your questions about events and tickets, or to have us pass it to another company. As we don't store your messages, we will normally have none to give you.

In the chat, the quickest way: type MY DATA and Blackbot immediately tells you what we keep linked to your number; type DELETE to erase it (section 12). Writing from your WhatsApp already shows that the chat is yours.

By email: write to contact@blackworks.es stating the WhatsApp number you wrote from. As our team doesn't see WhatsApp messages, to check that the number is yours we will ask you to send Blackbot MY DATA or DELETE from that number, depending on your request.

Deadline: we reply within one month at most. If the request is complex, this may be extended by two more months; if so, we will tell you within the first month.

Please note: our systems don't store your number or your conversations. What we hold linked to you are the marks in section 8, and that is what we can show or give you. The text of your messages is kept by Meta and Anthropic on our behalf for 30 days at most, with the exceptions in section 8, and we can't view or retrieve it from our systems.

Complaints: if you think we are not handling your data properly or have not dealt with your rights, you can complain to the Spanish Data Protection Agency (AEPD), at www.aepd.es.

12. How to delete your data

In the chat, the quickest way: type DELETE.

Blackbot deletes all the marks linked to your fingerprint, except the opt-out: the AI notice mark, the message limit mark, today's and yesterday's conversation counts, the opt-out reminder and, if there were one, the conversation memory. It also works if you have opted out.
It confirms the deletion (if you have just sent many messages in quick succession, the deletion still happens, but you may not get the confirmation: type DELETE again after a minute). If you write again afterwards and have not opted out, you will get the AI notice again. If you have opted out, you will at most get the daily reminder (section 9), and the AI notice will arrive when you write again after ALTA.
You don't need to send any document: writing from your WhatsApp already shows that the chat is yours. It also works if WhatsApp doesn't pass us your number.
DELETE doesn't remove the opt-out: we keep it so that we keep respecting that you don't want AI replies. If you also want to remove it, type ALTA (Blackbot will reply to you again).
The per-message mark and the daily totals are not linked to your number and delete themselves (section 8).

By email: write to contact@blackworks.es with the subject "Delete my WhatsApp data" and state your number. We will ask you to send DELETE from that number: that is how we check it is yours. We reply within one month at most.

What providers keep: the text of your messages kept by Meta and Anthropic on our behalf is deleted automatically within 30 days at most, with the exceptions in section 8. We can't delete it sooner from our systems. What Anthropic keeps for safety reasons or legal obligations follows its own periods (sections 6 and 8), and providers may keep backups for a while (section 8).

13. Minors

Our events are for people aged 18 and over only.
Blackbot doesn't ask your age and can't check it. If you are a minor, it may answer general questions. About age, it will only tell you what we have published for each event: it doesn't invent or confirm exceptions that haven't been published (not even with your parents' permission) and refers you to contact@blackworks.es.
If you are under 14, please don't write to us on WhatsApp: ask your mother, father or guardian to write to contact@blackworks.es for you.

14. Artificial intelligence

Blackbot is a program, not a person. It uses an AI model by Anthropic.
It tells you so in a notice (in Spanish) before its first AI reply. If WhatsApp doesn't accept that notice, it doesn't reply with AI and tries again with your next message. The only things that may reach you before the notice are fixed messages, without AI: those for STOP (the confirmation and the reminder), ALTA, MY DATA, DELETE and emergencies (sections 2, 9, 11 and 12). The EU AI Act (Regulation (EU) 2024/1689, Art. 50) requires us to tell you that you are talking to an AI, and we do so with that notice.
Because of how WhatsApp works, the notice can only reach you after you have written: the AI answers your first message right after the notice. That is why the basic information is also on BLACKWORKS' WhatsApp business profile, which you can see before writing.
Its replies are for information only. It doesn't make decisions about you that have legal effects or significantly affect you, which is what Art. 22 GDPR calls "automated decisions".
It can make mistakes. Check anything important on our website or at contact@blackworks.es.
Anthropic has contractually committed not to train its models on your messages (section 6).

15. Changes to this policy

If we change this policy, we will publish the new version here with its update date.
If the change affects what we tell you in the initial notice (for example, a new provider or enabling conversation memory), we will publish it here before applying it and Blackbot will send you the new notice.