Privacy policy

1. Data controller

[Company legal name], tax ID (NIF/CIF) [number], registered address [address], Spain. Contact: [privacy email]. Data Protection Officer (if appointed): [DPO contact].

2. Data we process and why

Account data (name, email, hashed password, sign-in sessions) to provide the service. Legal basis: performance of a contract (Art. 6.1.b GDPR).

Content you create (organizations, brand projects, AI prompts and generated assets) to provide the features you use. Legal basis: contract.

Product analytics (PostHog), only after you accept in the cookie banner. Legal basis: consent (Art. 6.1.a), which you can withdraw at any time.

Error reports (Sentry) and security logs to keep the service running and secure. Legal basis: legitimate interest (Art. 6.1.f).

3. Processors and international transfers

We use providers that act as processors under Art. 28 GDPR: [hosting provider], Resend (email), PostHog EU (analytics), Sentry (errors), [AI provider] (brand generation), Upstash (rate limiting), Cloudflare R2 (file storage). Where data leaves the EEA, transfers rely on the EU-US Data Privacy Framework or Standard Contractual Clauses.

4. Retention

Account data is kept while your account exists. When you delete your account, personal data is erased within [30] days except where the law requires us to keep it.

5. Your rights

You can access, rectify, erase, restrict or object to processing, and request portability. Settings has a one-click JSON export and account deletion. For anything else write to [privacy email].

You can complain to the Spanish Data Protection Agency (AEPD, www.aepd.es) or your local supervisory authority.

6. Changes

We will notify material changes by email or in the app.