Privacy policy

1. Data controller

No Data Protection Officer has been appointed, as none of the circumstances set out in article 37 GDPR apply. You may direct any privacy enquiry to the address above.

• Controller: JP Servicios de Publicidad y Directorios, S.L.
• Spanish tax ID (NIF): B70934898
• Address: Calle Hurtado de Amézaga 14, entresuelo 1º izquierda, 48008 Bilbao (Bizkaia), España
• Data protection contact: jpserviciosypublicidad@gmail.com

2. Personal data we process

• Account data: name and email address, obtained when you register or through your Google account if you choose that sign-in method.
• Billing data: name or company name, tax ID, postal address, postcode and city.
• Payment data: handled entirely by Stripe. We do not store or have access to your full card numbers.
• Website data: URL, crawled public content, brand profile, categories, keywords and generated articles.
• Google Search Console data: if you connect the integration, we process access tokens and your property's performance metrics (queries, impressions, clicks and positions).
• Technical data: IP address, browser type, access and error logs needed for service security and diagnostics.

3. Purposes and legal bases

• Providing the contracted service, generating and publishing content, and offering support — basis: performance of the contract (art. 6.1.b GDPR).
• Issuing invoices and complying with accounting and tax obligations — basis: legal obligation (art. 6.1.c GDPR).
• Ensuring platform security, preventing abuse and improving the service — basis: legitimate interest (art. 6.1.f GDPR).
• Sending commercial communications about our own products — basis: legitimate interest or consent, with the right to object at any time.
• Managing the affiliate programme and settling commissions — basis: performance of the contract (art. 6.1.b GDPR).

4. Retention periods

We retain your data for as long as the contractual relationship remains in force. After it ends, we keep it blocked for the legally required periods: four years for tax obligations (Spanish General Tax Act) and six years for commercial records (Spanish Commercial Code).

Generated content and your site data are deleted when you delete your account, except where we are legally required to retain them.

5. Recipients and processors

We do not sell or transfer your personal data to third parties for commercial purposes. To deliver the service we rely on the following providers, which act as processors and with which we have entered into the corresponding article 28 GDPR agreements:

• Supabase, Inc. — database, authentication and file storage.
• Vercel, Inc. — web application hosting.
• Stripe Payments Europe, Ltd. — payment processing and subscription management.
• Anthropic, PBC — text generation and evaluation using language models.
• OpenAI, L.L.C. — generation of article featured images.
• Firecrawl — crawling of your website's public content and of search results.
• Google Ireland, Ltd. / Google, LLC — Google sign-in and Google Search Console connection.
• FacturaDirecta — invoicing and tax compliance.

6. International data transfers

The database and file storage are hosted on servers located in the European Union.

Some of the providers listed are established in the United States. In those cases, transfers rely on the Standard Contractual Clauses approved by the European Commission and, where applicable, on the provider's certification under the EU-U.S. Data Privacy Framework.

When the artificial intelligence models generate content, the context needed for drafting is transmitted to those providers (public information from your website, keywords and brand profile). Your billing data and credentials are never transmitted to them.

7. Automated decisions and AI-generated content

The service generates content automatically using language models and assigns each article a quality score. These operations do not produce legal effects concerning individuals nor similarly significantly affect them, and therefore do not constitute automated decision-making within the meaning of article 22 GDPR.

Generated content is always subject to your review or to the quality thresholds you have configured before publication.

8. Data security

We apply appropriate technical and organisational measures: TLS encryption of communications, isolation of each customer's data through row-level security policies in the database, storage of API keys as cryptographic hashes, and access restricted to authorised personnel.

No system is entirely invulnerable. Should a security breach occur that poses a high risk to your rights, we will inform you and notify the supervisory authority in accordance with articles 33 and 34 GDPR.

9. Cookies

Adri uses only technical cookies necessary to keep you signed in and to remember your language preference. Under article 22.2 LSSI-CE, these cookies are exempt from the prior consent requirement.

We do not use analytics, advertising or third-party profiling cookies. Should we introduce them in future, a consent management system would be enabled beforehand.

10. Your rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent given without affecting the lawfulness of prior processing.

To exercise them, write to jpserviciosypublicidad@gmail.com stating the right you wish to exercise and attaching a document proving your identity. We will respond within one month at the latest.

If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid — www.aepd.es).

11. Minors

The service is intended solely for persons over 18 acting on their own behalf or on behalf of a company. We do not knowingly collect data from minors.

12. Changes to this policy

We may update this policy to reflect regulatory or service changes. Where the change is substantial, we will notify you by email with reasonable advance notice. The date of the latest update appears at the top of this document.