Privacy Policy
Last updated 7 September 2026 · A template. Have it reviewed by a lawyer, and check that it matches what your deployment actually does before publishing it.
1. Who we are
The operator of this site is the data controller for the personal data described in section 3. The controlling entity and its registered address are not yet published — the service is in development and is not selling anything. They will be named here and on the Legal Notice page before any payment can be taken. For any privacy request in the meantime, write to privacy@sprosimo.net and it will be handled on the timescales set out below.
Contact for privacy matters: privacy@sprosimo.net. We have not appointed a Data Protection Officer; our processing does not meet the Article 37 threshold. If that changes, this page will name one.
2. Two different roles
This distinction matters and is often blurred by other vendors:
- We are the controller for your account, billing and support data — the data described in this policy.
- We are a processor for the content you index and for your visitors' conversations. You decide what goes in and why. Where that contains personal data — a staff name on an About page, or an email a visitor types into the chat — we process it only on your instructions under our Data Processing Addendum.
3. What we collect, why, and on what legal basis
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Email, password hash, company name, country | To create and operate your account | Performance of a contract | Life of the account, then 30 days |
| Purchase history, invoice history | To bill you and to meet tax and accounting obligations | Contract; legal obligation | As required by tax law in Spain (typically 6 years) |
| Consent records: the wording shown, its version, the timestamp and your IP address | To evidence what you agreed to when you subscribed, and to defend payment disputes | Legitimate interests (defending claims); legal obligation | 7 years |
| Access activity log: sign-ins, indexing runs, exports, IP address, user agent | Security, abuse prevention, and evidence in a payment dispute | Legitimate interests | 24 months |
| Indexed content and its search index | So the assistant can retrieve answers from it | Contract (and, for any personal data inside it, as your processor) | Life of the account, then 30 days |
| Visitor conversations: question, answer, page URL, a salted daily hash instead of the raw IP | To show you what your customers ask and to produce the content-gap report | Contract; as your processor | Life of the account, then 30 days |
| Support correspondence | To answer you and improve the product | Contract; legitimate interests | 24 months |
| Server logs | Operating and securing the service | Legitimate interests | 90 days |
Where we rely on legitimate interests we have considered your rights and concluded our interest is not overridden. You can object — see section 7.
4. What we do not do
- We do not sell personal data, ever, to anyone.
- We do not use your content or your visitors' conversations to train machine learning models.
- We do not use one customer's content to answer another customer's questions.
- We do not store your visitors' raw IP addresses.
- We do not run advertising or behavioural tracking, and we set no advertising cookies.
- We do not enrich your data from third-party brokers.
5. Who we share it with
Only the sub-processors listed at https://sprosimo.net/subprocessors, each under a written contract limiting them to our instructions. That page names the provider, what it does and where it is located, and we update it before adding anyone new.
We may also disclose data where we are legally required to, or to establish or defend legal claims. If we receive a government or law enforcement request we will notify you unless legally prohibited.
6. International transfers
Some sub-processors are established outside the EEA. Where that is the case we rely on the European Commission's Standard Contractual Clauses, together with any applicable adequacy decision, and we check that each provider's data processing agreement includes the SCCs as a fallback rather than relying on an adequacy decision alone. Details, per provider, are on the Sub-processors page.
7. Your rights
Under the GDPR you can ask us to: give you a copy of your data; correct it; delete it; restrict how we use it; give it to you in a portable format; or object to processing based on legitimate interests. You may also withdraw consent where we rely on it, without affecting past processing.
You can do the two most common ones yourself, immediately, from Dashboard → Account: export everything as JSON, or delete your account and its data. For anything else email privacy@sprosimo.net. We respond within 30 days and do not charge for a first request.
If you are unhappy with how we handle it you may complain to the supervisory authority in your country. In Spain that is the Agencia Española de Protección de Datos (AEPD), aepd.es.
8. Security
Transport encryption on every connection; passwords stored using bcrypt with a per-password salt; API keys stored as SHA-256 hashes and displayed once; access to production limited to those who need it and logged; regular dependency updates. Full detail on the Security page, including an honest list of what we do not have.
If a personal data breach is likely to result in a risk to your rights, we will notify the supervisory authority within 72 hours of becoming aware and tell you without undue delay where the risk is high.
9. Cookies
We set one strictly necessary cookie, for your session. We run no analytics or advertising cookies and therefore do not show a consent banner — there is nothing to consent to. See the Cookie Policy. If we ever add analytics, we will ask first and make "reject" as easy as "accept".
10. Children
The Service is sold to businesses and is not directed at children. We do not knowingly collect data from anyone under 16.
11. Automated decision-making
We do not carry out automated decision-making producing legal or similarly significant effects concerning you. Confidence scoring applies to data records, not to people.
12. Changes
We will post any change here and, if it materially affects you, email you at least 30 days beforehand.