Privacy Policy

1. Data controller

Altoclick S.L.
Tax ID: ESB64562044
Address: C/ Cecs de la Boquería 4, 3º A, 08002 Barcelona, Spain
Email: [email protected]
Legal representative: Andrés Granollers Lo Celso

2. Data we collect

We collect the following personal data:

2.1 Data provided by the user

• Registration data: full name, email address, and encrypted password.
• Billing data: processed directly by Stripe. Altoclick S.L. does not store credit card data.
• Images: photographs uploaded to the platform for processing.

2.2 Automatically collected data

• Browsing data: IP address, browser type, pages visited, time spent.
• Cookies: we use technical cookies and, with your consent, analytics and advertising cookies (see section 7).

3. Purpose of processing

We process your data for the following purposes:

• Manage your user account and provide the contracted Services.
• Process payments and manage subscriptions.
• Send service-related communications (account confirmation, service changes).
• Improve the platform and user experience through aggregated analysis.
• Comply with legal and tax obligations.

4. Legal basis for processing

• Performance of contract: processing is necessary to provide the requested Services (Art. 6.1.b GDPR).
• Consent: for analytics and advertising cookies (Art. 6.1.a GDPR).
• Legitimate interest: to improve our services and prevent fraud (Art. 6.1.f GDPR).
• Legal obligation: to comply with tax and legal obligations (Art. 6.1.c GDPR).

5. Data recipients

Your data may be shared with the following third parties, all acting as data processors:

• Supabase (Supabase Inc.): database hosting and authentication. EU servers.
• Vercel (Vercel Inc.): web platform hosting. EU and US servers (standard contractual clauses).
• Stripe (Stripe Inc.): payment processing. PCI-DSS certified. International transfers under standard contractual clauses.
• Google Cloud (Google LLC): AI image processing (Vertex AI). International transfers under standard contractual clauses.
• Resend (Resend Inc.): transactional email delivery.
• Google Analytics: web analytics, only with user consent.
• Meta Platforms: advertising tracking, only with user consent.

We do not sell or share personal data with third parties for commercial purposes.

6. International transfers

Some of our service providers are located outside the European Economic Area (EEA). In these cases, transfers are carried out under the appropriate safeguards provided for in the GDPR, such as standard contractual clauses approved by the European Commission or adequacy decisions.

7. Cookies

We use a consent management system (Klaro) that allows users to accept or reject non-essential cookies before they are activated. The cookies used are:

• Technical cookies: necessary for the platform to function. No consent required.
• Analytics cookies (Google Analytics): allow us to analyze platform usage. Consent required.
• Advertising cookies (Meta Pixel, Google Ads): allow us to measure advertising campaign effectiveness. Consent required.

You can modify your cookie preferences at any time through the cookie banner or your browser settings.

8. Data retention

• Account data: while the account remains active and for the legally required period after cancellation.
• Images: automatically deleted 30 days after processing.
• Billing data: retained for the period required by tax regulations (5 years).
• Browsing data: retained for a maximum of 26 months.

9. Your rights

Under the GDPR, you have the right to:

• Access: request a copy of your personal data.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request the deletion of your data ("right to be forgotten").
• Restriction: request the restriction of processing in certain circumstances.
• Portability: receive your data in a structured, commonly used format.
• Objection: object to the processing of your data in certain circumstances.
• Withdrawal of consent: withdraw your consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, send an email to [email protected] stating your name and the right you wish to exercise. We will respond within a maximum of 30 days.

You also have the right to file a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

10. Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, including password encryption, HTTPS connections, role-based access control, and periodic security reviews.

11. Minors

The Platform is not intended for children under 16. We do not knowingly collect data from minors under this age. If you become aware that a minor has provided personal data, please contact us so we can proceed with its deletion.

12. Modifications

We reserve the right to update this Privacy Policy. Significant changes will be communicated to users by email or through a notice on the Platform.

13. Contact

For any questions about this Privacy Policy or the processing of your data:
[email protected]
Altoclick S.L. · C/ Cecs de la Boquería 4, 3º A, 08002 Barcelona, Spain