Legal
Privacy policy
Last updated: 21 October 2026
This policy explains how we process your personal data when you use PromptYa, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). In short: we only process the data needed to provide the service, we don't sell it and we don't use it to train AI models.
1. Data controller
- Controller: «[NOMBRE O RAZÓN SOCIAL]»
- Tax ID (NIF): «[NIF]»
- Address: «[DOMICILIO]»
- Contact: hola@webprompts-para-ia.com
We have not appointed a Data Protection Officer because we are not required to; for any privacy question, write to the email above.
2. What data we process
- Account data: your email and, if you sign in with your phone, your phone number. If you sign in with Google or Apple, we receive your account identifier and email from them.
- Free trial: the email you give us to send you the prompt and the form answers needed to generate it.
- Use of the service:if you have an account, your form answers and the prompts generated are stored in your history so you can look them up. For templates that ask for health, injury, allergy or financial details we store neither the answers nor the prompt: only that you used the template and when. Copy the result when you generate it, because you won't be able to recover it from your history later.
- AI features: when you use “Run with AI” or “Fill with AI”, the prompt text or the description you write is sent to the AI provider to get the answer.
- Payments: handled by Stripe. We receive data such as your customer ID, the plan or pack purchased, the subscription status and the amount. We never receive or store your card details.
- Newsletter: your email and language, if you subscribe.
- Test code requests: your email, your language and the template you ask from, if you ask us for a code during the pilot.
- Affiliate program: name, email, audience type and size, if you apply.
- Technical data: a random device identifier (cookie
wp_device) and your IP address, which we store pseudonymised (hashed), to enforce free-trial and AI usage limits and prevent abuse. Our hosting provider also keeps technical access logs for security.
Some templates (for example nutrition or training) let you enter data such as allergies or your physical condition. It is always optional: if you include it, we process it only to generate your prompt, based on your explicit consent when you provide it (art. 9.2.a GDPR). Please don't enter more personal data than needed.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the service: generating prompts, managing your account, history and AI features | Performance of the contract (art. 6.1.b GDPR) |
| Emailing you the free-trial prompt | Performance of your request (art. 6.1.b GDPR) |
| Payments, invoicing and accounting and tax obligations | Performance of the contract and legal obligation (art. 6.1.b and 6.1.c GDPR) |
| Sending you the pilot code you ask for | Performance of your request (art. 6.1.b GDPR) |
| Sending you the newsletter | Your consent (art. 6.1.a GDPR), which you can withdraw at any time |
| Handling your affiliate application | Pre-contractual steps at your request (art. 6.1.b GDPR) |
| Preventing fraud and abuse, enforcing usage limits and protecting the service | Legitimate interest in the security of the service (art. 6.1.f GDPR) |
| Answering your questions | Your request and our legitimate interest in answering it (art. 6.1.b and 6.1.f GDPR) |
We don't make automated decisions with legal effects on you, and we don't build advertising profiles.
4. How long we keep data
- Account and history: while you keep your account. If you ask us to close it, we delete them.
- Payment and invoicing data: for as long as commercial and tax law requires (generally up to 6 years).
- Newsletter: until you unsubscribe.
- Test code requests: until the pilot ends.
- Affiliate applications: while the relationship lasts or, if it doesn't go ahead, «[PLAZO, p. ej. 12 meses]».
- Device identifier, pseudonymised IP and usage counters: «[PLAZO DE CONSERVACIÓN]».
After those periods, data is deleted or blocked for as long as legal liabilities may arise.
5. Who processes your data on our behalf
We don't share your data with third parties unless required by law. To provide the service we use these providers, acting as data processors:
| Provider | What for |
|---|---|
| Google (Firebase Authentication and Cloud Firestore) | Sign-in and database (account, history, packs, usage limits) |
| Stripe | Payments and subscription portal |
| Resend | Sending emails (free prompt, confirmations, newsletter) |
| Vercel | Website hosting |
| Anthropic | Running with AI (Claude) the prompts you choose to run, and the “Fill with AI” feature |
If you sign in with Google or Apple, that company processes your data under its own privacy policy. Stripe may also act as an independent controller to meet its legal obligations (for example, fraud prevention).
6. International transfers
Some of these providers are based in the United States or may access data from there. In those cases the transfer relies on the EU-US Data Privacy Framework, where the provider is certified, or on the Standard Contractual Clauses approved by the European Commission.
7. Your rights
You can exercise at any time your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent without affecting the lawfulness of prior processing. Write to hola@webprompts-para-ia.comstating the right you want to exercise; if needed, we'll ask you to verify your identity. We'll reply within one month at the latest.
If you believe we haven't handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid) or with the supervisory authority of your country.
8. Minors
The service is not intended for children under 14. If you are under that age, please don't give us personal data.
9. Security
We apply reasonable technical and organisational measures to protect your data: encrypted connections, restricted database access and pseudonymisation of IP addresses.
10. Cookies and changes to this policy
We only use technical cookies; details are in the Cookie policy. If we change this policy in a meaningful way, we'll say so on this page and, if you have an account, let you know by email.