Privacy Policy

1.Data controller

The controller of your personal data is Reina Catalina S.C., with registered address at Calle La Fragata 9, 29630 Benalmádena, Málaga, Spain and tax identification number (NIF) J19762525. Contact email: [email protected].

2.Personal data we collect

We collect the following categories of data:

• Account data: name, email, password (stored encrypted), optional profile picture.
• Billing data: business name, tax address, tax ID and payment method. Card numbers are processed and stored by Stripe; Agent Pilo has no access to the full card number.
• Business content: business description and uploaded photos.
• Data from the connected Instagram account (when you authorise the integration): Instagram identifier, username (handle), long-lived access token encrypted at rest, granted permissions (instagram_business_basic, instagram_business_content_publish and instagram_business_manage_insights) and public metrics of the posts published from Agent Pilo (reach, views, likes, comment count, saves, shares, new follows and profile visits; for Reels, also average and total watch time). We do not read direct messages, followers or previous posts. You can disconnect Instagram or delete this data at any time — see Delete your data.
• Usage data: pages visited, in-app events, IP address, browser and device.
• Cookies: see our cookie policy (page in Spanish).

3.Purposes of processing

We process your data for the following purposes:

• Providing the Service: generating content, publishing it on your behalf, displaying analytics.
• Billing and subscription management.
• Customer support and operational communications.
• Improving the Service through aggregated and anonymised analysis.
• Complying with legal obligations (tax, accounting, regulatory).
• Marketing communications about Agent Pilo, only where you have given your express consent.

4.Legal basis for processing

The legal bases for the processing are those set out in the GDPR:

• Performance of a contract (Art. 6(1)(b) GDPR): to provide the Service you have contracted.
• Legal obligation (Art. 6(1)(c) GDPR): to comply with tax, accounting and anti-money-laundering regulations.
• Legitimate interest (Art. 6(1)(f) GDPR): for Service security, fraud prevention and product improvement.
• Consent (Art. 6(1)(a) GDPR): for marketing communications and non-essential cookies.

5.Data retention

• Account data: for as long as the account is active, plus one (1) year after cancellation in order to comply with legal and audit obligations.
• Billing data: six (6) years, in accordance with Spanish commercial and tax law.
• Analytics usage data: up to twenty-six (26) months.
• Security logs: twelve (12) months.

6.Recipients

To provide the Service we share data with the following processors:

• Stripe (payment processing).
• Supabase (database hosting and authentication).
• Artificial intelligence providers (prompt processing and image generation). Providers vary by plan; in every case, their contractual terms prohibit the use of the content to train models.
• Vercel (website and application hosting).
• Sentry (technical error logging for diagnostics).

A Data Processing Agreement (DPA) under Art. 28 GDPR is in place with every processor.

7.International transfers

Some of the processors process data outside the European Economic Area, mainly in the United States. These transfers rely on:

• The Standard Contractual Clauses approved by the European Commission (SCCs).
• Where applicable, the EU-US Data Privacy Framework.

8.Your rights

As a data subject, you have the right to:

• Access your personal data.
• Rectify inaccurate or incomplete data.
• Request erasure (the "right to be forgotten").
• Restrict or object to the processing.
• Data portability: receive your data in a structured, commonly used format.
• Withdraw your consent at any time, without retroactive effect.

To exercise these rights, write to us at [email protected]. If you want to exercise the right to erasure immediately, you can also do so from within the application by following the step-by-step guide at Delete your data (page in Spanish). You may also lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) or with the competent supervisory authority in your country of residence.

9.Cookies

We use essential cookies for the operation of the site and, with your prior consent, analytics cookies. Full details are set out in our cookie policy (page in Spanish).

10.Changes to this policy

This policy may be updated. We will notify you of material changes by email or from within the application. The version in force is always published at /es/privacidad, and this English translation at /en/privacy.

11.Contact

Data controller: [email protected].