Legal

Privacy policy

Last updated: 12 November 2026

This is an informative English translation. The Spanish version is the legally binding text.

Data controller

[COMPLETAR: razón social], tax ID [COMPLETAR: CIF], registered address [COMPLETAR: domicilio], email [COMPLETAR: correo de contacto].

What data we process

The messages you send to People and the company or time-tracking data it queries according to your permissions, portal data, and the data you give us in the demo form: full name, work email, company, number of people, phone (optional) and what you tell us you want to solve. To prevent abuse we also store a fingerprint (hash) of your IP address to limit attempts; the plain IP is not kept for this purpose.

Purpose

To handle your demo, contact or launch-notification request and to provide the portal features and People queries. Actual email sending is pending activation.

Legal basis

Your consent, given by ticking the form checkbox (art. 6.1.a GDPR), and pre-contractual measures at your request (art. 6.1.b GDPR). You can withdraw consent at any time without affecting the lawfulness of prior processing.

Recipients

Supabase is the data hosting provider. Messages to People and the data it queries are processed by an AI provider through the Lovable gateway, acting as data processor. We apply data minimisation: workforce queries use a closed list of fields and access depends on company and role. [PENDING VERIFICATION: contractual identity of the AI provider, processing agreements and sub-processors under art. 28 GDPR, Lovable and Supabase terms, and legal basis for portal data and AI queries].

International transfers

[PENDING VERIFICATION: Supabase hosting region, processing locations of Lovable and the AI provider, international transfers, contracts and applicable safeguards]. We do not state a region or transfer guarantee until they are documented.

Retention

Time-tracking originals and corrections are kept for at least four years, under art. 34.9 of the Spanish Workers' Statute, with no automatic purge. [PENDING DEFINITION: retention, blocking and deletion periods for leads, profiles and conversations, and AI provider retention].

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to [COMPLETAR: correo de contacto], stating the right you are exercising. If you believe we have not handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

Security

We apply appropriate technical and organisational measures: leads are only handled server-side; portal data is accessed according to company, person and role.