Privacy Policy

Data Controller: Marie du Mesnil du Buisson, Self-employed professional (Autónoma) Address: Llull 200, Barcelona 08005, Spain Email: privacy@pablito.app Data Protection Officer: Not appointed — not legally required for this processing scale and type. EU Representative: Not required (Data Controller established within the European Union).

2.1 Account Data: Name, email address, login credentials (encrypted), subscription type and payment status, VAT number (if provided by EU businesses).

2.2 Professional Content: Biography and artist statements, curriculum vitae (CV), artwork images and videos, artwork descriptions, titles, dates, dimensions, uploaded media files and associated metadata. IMPORTANT — Special Category Data: If you upload images containing identifiable individuals (including yourself), this may constitute biometric data under GDPR Article 9 (special category personal data). You are responsible for obtaining necessary consents from individuals before uploading such content. We process this data only as your processor for storage and display as you instruct.

2.3 Technical Data: IP address, browser type and version, device identifiers, access logs and timestamps, operating system, referring website.

2.4 Usage Data: Features used and frequency, pages visited, session duration, user preferences and settings.

2.5 Third-Party Integration Data: If you connect third-party accounts (optional), we access: Instagram (via Unipile): Username, account ID, direct messages (fetched on-demand, not stored in our database), media upload capability. We do NOT access private account data or analytics. We do NOT sell, rent, or trade personal data to third parties for their marketing purposes.

2.6 Payment Data: Payment processing is handled by Stripe. We do NOT store full credit card numbers. We receive only: transaction ID, payment status, last 4 digits of card, billing email.

2.7 How You Found Us: When you sign up, we save with your account how you found Pablito — the link or the kind of website you came from (for example an Instagram link, a search engine or an AI assistant) and your answer to the optional "How did you hear about us?" question. We also save the country you signed up from, worked out from your connection (we don't save your IP address with your account). We use this only to understand which channels work and where our users are.

2.8 Contact Form: If you write to us from the About page, we receive your name (optional), email address, topic and message by email, only to reply to you. We don't keep them in our database and we never send you an automatic email.

We process your data based on the following legal grounds:

3.1 Contract Performance (Art. 6(1)(b)): Processing necessary to provide the Service you subscribed to — account creation and management, content hosting and storage, payment processing, customer support.

3.2 Legal Obligations (Art. 6(1)(c)): Processing required by law — tax compliance and record-keeping (Spanish tax law requires retention for 4–10 years), responding to law enforcement requests, compliance with court orders.

3.3 Legitimate Interests (Art. 6(1)(f)): Processing necessary for our legitimate interests, balanced against your rights — fraud prevention and detection, system security, service improvement (analyzing usage patterns to enhance functionality), technical troubleshooting.

3.4 Consent (Art. 6(1)(a)): We rely on your explicit consent for — marketing emails (you may opt out at any time), non-essential cookies (analytics, performance tracking), optional third-party integrations (Instagram). You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

We share data only with trusted service providers (subprocessors) who assist in operating the Service. All subprocessors are bound by contractual data protection obligations compliant with GDPR Article 28. For a complete, up-to-date list of subprocessors, visit: /legal/subprocessors or contact privacy@pablito.app

Data Sharing with Authorities: We may disclose personal data to comply with legal obligations under Spanish or EU law, court orders or judicial requests, law enforcement requests (where legally mandated), and protection of our rights, property, or safety.

Subprocessor Changes: We will notify Professional Users via email at least 14 days before adding new subprocessors. Professional Users may object within this period by contacting privacy@pablito.app. If we cannot accommodate the objection, the user may terminate their subscription.

Some subprocessors operate outside the European Economic Area (EEA). When data is transferred outside the EEA, we ensure appropriate safeguards: European Commission Adequacy Decisions: For transfers to countries deemed to have adequate data protection (e.g., UK, Switzerland). Standard Contractual Clauses (SCCs): For transfers to processors in countries without adequacy decisions (e.g., US-based providers like Stripe, Cloudinary, Google). You may request a copy of the applicable safeguards by contacting privacy@pablito.app.

We retain personal data for the following periods:

• Account data (profile, artworks, schedules): kept while your account is active; erased when you delete your account
• Usage & analytics events: automatically deleted after 90 days
• Disconnected integrations (e.g. Instagram): associated data deleted within 30 days
• Legal compliance (tax, accounting): 4–10 years as required by Spanish law
• Backups: rolled off within 90 days
• Marketing data (if consent given): until consent is withdrawn

You can delete your account at any time to erase your personal data (subject to the legal-retention periods above). After these periods, data is securely deleted.

You have the following rights regarding your personal data:

• Right of Access (Art. 15): Request a copy of your personal data
• Right to Rectification (Art. 16): Correct inaccurate data
• Right to Erasure / "Right to be Forgotten" (Art. 17): Request deletion of your data (subject to legal retention obligations)
• Right to Data Portability (Art. 20): Receive your data in machine-readable format (JSON/CSV)
• Right to Restriction of Processing (Art. 18): Limit how we use your data
• Right to Object (Art. 21): Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent for marketing emails, non-essential cookies, or optional integrations at any time

How to Exercise Your Rights: Send requests to privacy@pablito.app. We will respond within 30 days (extendable to 60 days for complex requests). We may request proof of identity to prevent unauthorized access.

Right to Lodge a Complaint: If you believe we have violated your data protection rights, you may file a complaint with the Agencia Española de Protección de Datos (AEPD) — www.aepd.es — C/ Jorge Juan, 6, 28001 Madrid, Spain, OR your local EU data protection authority.

We do NOT make automated decisions that produce legal effects or similarly significantly affect you. All decisions regarding your account, access, or service terms are made by humans. We do use AI-assisted tools for organizational features (artwork tagging, visual clustering, metadata generation), but these are assistive tools that do not affect your rights or access to the Service. You may contact privacy@pablito.app with any questions about how automated processing is used.

We implement technical and organizational security measures to protect your data:

• Encryption in transit: TLS 1.3 (HTTPS)
• Password hashing: bcrypt with 12 salt rounds
• Access controls: JWT-based authentication, role-based access restrictions
• Secure payment processing: Stripe PCI-DSS compliant infrastructure
• Cloud-based infrastructure with automated security monitoring
• Regular automated backups with MongoDB Atlas

Data Breach Notification: In the event of a data breach affecting your personal data, we will notify the AEPD within 72 hours of discovery (GDPR Art. 33), notify affected users without undue delay if the breach poses a high risk to your rights (GDPR Art. 34), and take immediate remedial action to contain and mitigate the breach.

IMPORTANT: While we implement reasonable security measures, no system can guarantee absolute security. Users are responsible for safeguarding their account credentials.

Meta/Instagram Platform Data: Our use of Meta (Facebook/Instagram) data complies with the Meta Platform Policy. Instagram integration (via Unipile): We access your username and account ID (stored), and direct messages (fetched on-demand, not stored). We do NOT access private account data, analytics, or follower information. We do NOT use Meta data for advertising or sell it to third parties.

AI providers: We use third-party AI APIs to power core features — Google Gemini (artwork image analysis), OpenAI (posting-schedule generation), and Anthropic / Claude (captions, hashtags, and artist documents). These use direct API-key authentication — no Google or other OAuth account data is shared. We send only the content each feature needs: your artwork images and the text you ask Pablito to create. Each provider processes this data on our behalf under a data-processing agreement (see the Subprocessors page).

Data Retention for Third-Party Integrations: Instagram data (username, account ID) is stored for the duration of the integration. Direct messages are fetched on-demand and not stored. If you disconnect an integration, associated data is deleted within 30 days. You may revoke access to third-party integrations at any time via your Pablito account settings or your Meta/Instagram account settings.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: Request disclosure of categories and specific pieces of personal data collected
• Right to Delete: Request deletion of personal data (subject to legal exceptions)
• Right to Opt-Out of Sale: We do NOT sell personal data
• Right to Non-Discrimination: You will not be discriminated against for exercising CCPA rights

To exercise these rights, contact: privacy@pablito.app

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors. If we discover that we have inadvertently collected data from a minor, we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify users of material changes via email at least 30 days before the changes take effect. Continued use after the notice period constitutes acceptance.

For questions about this Privacy Policy or to exercise your rights: Email: privacy@pablito.app Address: Marie du Mesnil du Buisson, Llull 200, Barcelona 08005, Spain