Privacy Policy

Privacy Policy — TOKIFY

At TOKIFY, we take the protection of your personal data seriously. This policy explains what data we process, why, for how long, and what rights you have, in accordance with Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD), and Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE).

1. Data Controller

Fact	Information
Headline	[First and last name or business name]
Tax ID Number / CIF	[Number]
Address	[Full mailing address, Spain]
Privacy Email

[privacy@domain]

Website

[https://www.dominio-definitivo.com]

Registration Information

[Only if it is a corporation: Commercial Registry, volume, folio, page]

We have not appointed a Data Protection Officer (DPO) because our activities do not require one under Article 37 of the GDPR and Article 34 of the LOPDGDD. For any questions regarding privacy, please email us at the address provided.

2. Data We Process

We process only the data necessary for each purpose. We do not process special categories of data (health, political views, ethnic origin, etc.), and we ask that you not send us such information.

Origin	Data
Contact Forms	Name, email address, [phone number], [company], and the content of your message
Registration and Customer Account	First name, last name, email address, username, and password (encrypted)
Purchasing and Billing	Billing information (name or business name, tax ID number, address), order history, and transaction details. Full credit card information is processed directly by the payment gateway; we do not store it.
[Newsletter]	[Email and Subscription Preferences]
Navigation	IP address, browser, device, dates, and pages visited, as recorded in the server's technical logs and through cookies, in accordance with the [Cookie Policy]

Public content analyzed by our radar. To provide our services, we access public sources on the Internet through their official APIs or public feeds, such as Hacker News or Stack Exchange. For each post, we store only the title, an excerpt, the link, and aggregated public metrics (upvotes, answers, views). We do not store the authors’ usernames or profiles. If a post incidentally contains any personal data, we process it in accordance with the safeguards set forth in this policy, and you may exercise your rights regarding that data (Section 8).

3. Purposes of the Processing

We process your data for the following purposes, each with its own legal basis under Article 6 of the GDPR.

Purpose	Legal Basis
Respond to your inquiries and requests for quotes	Implementation of precontractual measures at your request (Art. 6.1.b)
Manage your account, your orders, the provision of the services you've purchased, and after-sales support	Performance of the Contract (Art. 6.1.b)
Issue invoices and comply with accounting and tax obligations	Legal obligation (Art. 6.1.c)
[To send you the newsletter and marketing communications you have requested]	[Consent (Art. 6.1.a and Art. 21 of the LSSI-CE)]
Send customers information about services similar to those they have purchased	Legitimate interest (Art. 6.1.f and Art. 21.2 of the LSSI-CE); you may object to each email
Ensure site security and prevent fraud and abuse	Legitimate interest (Art. 6.1.f)
Analyze public content on the Internet to identify trends and business opportunities	Legitimate interest (Art. 6.1.f)
Install non-essential cookies (analytics, preference, or advertising cookies)	Consent (Art. 6.1.a and Art. 22.2 of the LSSI-CE)

4. Legal Basis: Clarifications

Required information. We have marked the required fields on the forms. If you do not provide this information, we will not be able to process your request or provide you with the service.

Consent. When processing is based on your consent, you may withdraw it at any time, without this affecting the lawfulness of the processing that took place prior to the withdrawal. Simply write to us or use the unsubscribe link included in every communication.

Legitimate interest. We have weighed our interests against your rights. When analyzing public content, we only use sources for which automated use is permitted; we respect their access restrictions; we do not identify the authors; and we limit the data we store to what is strictly necessary. You may object to any processing based on legitimate interests (Section 8).

Use of artificial intelligence. We use third-party AI models to classify and summarize the public content we analyze. We do not make decisions based solely on automated processing that produces legal effects concerning you or significantly affects you, nor do we profile users for that purpose.

5. Retention Periods

We retain your data only for as long as necessary to fulfill the purpose for which it was collected. Afterward, we block the data for the duration of the statute of limitations for potential liabilities, as required by Article 32 of the LOPDGDD, and finally delete it.

Data	Deadline
Consultations without a subsequent contractual relationship	[12 months] since the last communication
Customers: Accounts and Orders	For the duration of the relationship and, thereafter, for up to 6 years (Art. 30 of the Commercial Code)
Invoices and Tax Information	6 years (Commercial Code) and, in any case, 4 years (General Tax Law)
[Newsletter]	[Until you cancel your subscription]
Server Technical Logs	[The time limit set by the hosting provider, up to a maximum of X months]
Public content analyzed by the radar	180 days from the date of detection, except for opportunities selected by our team
Cookies	According to the [Cookie Policy]

6. Recipients and Data Processors

We do not sell or disclose your information to third parties. We only disclose it when required by law, for example, to the Tax Agency, courts, or law enforcement agencies.

To provide this service, we work with vendors who access data in their capacity as data processors. We have entered into a contract with each of them in accordance with Article 28 of the GDPR.

Supplier	Service	Location
[IONOS — exact company name as stated in your contract]	Web Hosting and Email	European Union
[Stripe / PayPal / Redsys / other payment gateway]	Payment Processing	[According to the runway]
[Tax and Accounting Services]	Accounting and Tax Obligations	Spain
[Email Marketing Provider]	[Newsletter Delivery]	[According to the supplier]
OpenAI	Classification and AI-powered summary of the analyzed public content	United States
[DeepSeek, if enabled]	[Classification and AI-generated summary of the analyzed public content]	[China]

We only send AI providers the public content described in section 2. We never send them the data you provide to us as a user or customer.

7. International Transfers

Some providers listed in Section 6 may process data outside the European Economic Area. In such cases, the transfer is based on one of the safeguards set forth in Chapter V of the GDPR:

United States: the EU-U.S. Data Privacy Framework, when the provider is certified, or, failing that, the standard contractual clauses approved by the European Commission.
Other countries without an adequacy decision [such as China]: Standard contractual clauses and supplementary measures. [Only public content is sent to these providers; user or customer data is never sent.]

You can request more information or a copy of the applicable warranties by writing to [privacy@domain].

8. Your Rights

You may exercise the following rights at any time, free of charge:

Law	What It Is
Access	Find out if we process your data and obtain a copy
Correction	Correct inaccurate or incomplete data
Deletion	Request that we delete your data when it is no longer necessary, among other circumstances
Opposition	Object to processing based on legitimate interests or for commercial purposes
Limitation	Request that we retain your data without processing it, for example, while a complaint is being resolved
Portability	To receive the data you provided to us in a structured format, or to have us send it to another data controller
Withdrawal of Consent	You can stop taking it whenever you want; it won't affect your previous treatment.

How to exercise them. Please email [privacy@domain] or send a letter to [address], specifying the right you are exercising. If we are unable to verify your identity by other means, we will ask you to provide proof of your identity. We will respond within one month, extendable by two additional months in complex cases, as provided for in Article 12 of the GDPR.

Complaint. If you believe we have not properly addressed your rights, you may file a complaint with the Spanish Data Protection Agency (C/ Jorge Juan, 6, 28001 Madrid).

9. Security, Minors, Cookies, and Changes

Safety. We implement technical and organizational measures appropriate to the risk, as required by Article 32 of the GDPR: encrypted connections (HTTPS), encrypted passwords, access controls, backups, and regular updates. If a security breach occurs that poses a risk to you, we will notify the AEPD and, where appropriate, the individuals affected.

Minors. Our services are intended for professionals and businesses. We do not knowingly collect data from children under 14 years of age, which is the minimum age for consent in Spain according to Article 7 of the LOPDGDD. If we discover that we have received such data, we will delete it.

Data accuracy. You warrant that the information you provide to us is accurate and agree to notify us of any changes. If you provide us with information about third parties, you must have informed them and obtained their authorization.

Cookies. This site uses first-party and third-party cookies. You can find out which ones we use, what they're for, and how to manage them in our [Cookie Policy].

Changes to this policy. We may update this policy due to changes in the law or in our services. We will post the current version on this page, and if the changes are significant, we will notify you through our usual channels.

Last updated: [publication date].