At TOKIFY, we take the protection of your personal data seriously. This policy explains what data we process, why, for how long, and what rights you have, in accordance with Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD), and Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE).
1. Data Controller
| Fact | Information |
|---|---|
| Headline | [First and last name or business name] |
| Tax ID Number / CIF | [Number] |
| Address | [Full mailing address, Spain] |
| Privacy Email |
[privacy@domain]
Website
[https://www.dominio-definitivo.com]
Registration Information
[Only if it is a corporation: Commercial Registry, volume, folio, page]
We have not appointed a Data Protection Officer (DPO) because our activities do not require one under Article 37 of the GDPR and Article 34 of the LOPDGDD. For any questions regarding privacy, please email us at the address provided.
2. Data We Process
We process only the data necessary for each specific purpose. We do not process special categories of data (health, political views, ethnic origin, etc.), and we ask that you not send us such data, including via chat or the API.
| Origin | Data |
|---|---|
| Contact Forms | Name, email address, [phone number], [company], and the content of your message |
| Registration and Customer Account | First name, last name, email address, username, and password (encrypted) |
| Purchasing and Billing | Billing information (name or business name, tax ID number, address), order history, and transaction details. Full credit card information is processed directly by the payment gateway; we do not store it. |
| Using the Chat and the API | The messages you write or send, the data you enter into the tools (for example, in a quote), the model’s responses, the model you selected, the tokens consumed, the credits charged, the date, and your balance. If you have chat history enabled, we store your web chat conversations in encrypted form so you can resume them; you can disable this feature or delete them directly from the chat. We do not store the content of what you enter into the tools or send via the API—only the usage log. |
| API Keys | The name you assign to each key, its first characters, creation and last-use dates, and associated usage. The full key is stored only in an irreversibly encrypted form (hash). |
| Country of connection | Approximate country determined based on your IP address, either on our own server or through [Cloudflare], to enforce the service's geographic restrictions. We do not store your location in your account. |
| [Newsletter] | [Email and Subscription Preferences] |
| Navigation | IP address, browser, device, dates, and pages visited, as recorded in the server's technical logs and through cookies, in accordance with the [Cookie Policy] |
Public content analyzed by our radar. To provide our services, we access public sources on the Internet through their official APIs or public feeds, such as Hacker News or Stack Exchange. For each post, we store only the title, an excerpt, the link, and aggregated public metrics (upvotes, answers, views). We do not store the authors’ usernames or profiles. If a post incidentally contains any personal data, we process it in accordance with the safeguards set forth in this policy, and you may exercise your rights regarding that data (Section 8).
[Opening credits.] [If you receive gift credits when you create your account, we store an irreversible fingerprint (a one-way encrypted code) of your email address and the IP address from which you received them, to prevent the same person from receiving them multiple times. Neither your email address nor your IP address can be recovered from the fingerprint. The legal basis is our legitimate interest in preventing fraud (Art. 6.1.f of the GDPR). The hash is retained for one year, even if you delete your account, because its purpose is precisely to prevent the gift from being requested again with a new account.]
3. Purposes of the Processing
We process your data for the following purposes, each with its own legal basis under Article 6 of the GDPR.
| Purpose | Legal Basis |
|---|---|
| Respond to your inquiries and requests for quotes | Implementation of precontractual measures at your request (Art. 6.1.b) |
| Manage your account, your orders, the provision of the services you've purchased, and after-sales support | Performance of the Contract (Art. 6.1.b) |
| Provide the chat and API: send your messages to the AI provider of your choice, receive the response, and deduct the credits used | Performance of the Contract (Art. 6.1.b) |
| Save your chat history so you can pick up where you left off | Contract performance (Art. 6.1.b); you can deactivate it or delete your conversations at any time |
| Review messages using automated moderation and suspend accounts that repeatedly violate the terms of use | Performance of the contract (Art. 6.1.b) and legitimate interest in preventing abuse and complying with our suppliers’ terms and conditions (Art. 6.1.f) |
| Notify you by email when your balance is low | Performance of the Contract (Art. 6.1.b) |
| Enforce the country-specific restrictions required by AI providers and international sanctions regulations | Legal obligation (Art. 6.1.c) and legitimate interest in complying with our suppliers’ terms and conditions (Art. 6.1.f) |
| Issue invoices and comply with accounting and tax obligations | Legal obligation (Art. 6.1.c) |
| [To send you the newsletter and marketing communications you have requested] | [Consent (Art. 6.1.a and Art. 21 of the LSSI-CE)] |
| Send customers information about services similar to those they have purchased | Legitimate interest (Art. 6.1.f and Art. 21.2 of the LSSI-CE); you may object to each email |
| Ensure site security and prevent fraud and abuse, including the misuse of API keys | Legitimate interest (Art. 6.1.f) |
| Analyze public content on the Internet to identify trends and business opportunities | Legitimate interest (Art. 6.1.f) |
| Install non-essential cookies (analytics, preference, or advertising cookies) | Consent (Art. 6.1.a and Art. 22.2 of the LSSI-CE) |
4. Legal Basis: Clarifications
Required information. We have marked the required fields on the forms. If you do not provide this information, we will not be able to process your request or provide you with the service.
Consent. When processing is based on your consent, you may withdraw it at any time, without this affecting the lawfulness of the processing that took place prior to the withdrawal. Simply write to us or use the unsubscribe link included in every communication.
Legitimate interest. We have weighed our interests against your rights. When analyzing public content, we only use sources for which automated use is permitted; we respect their access restrictions; we do not identify the authors; and we limit the data we store to what is strictly necessary. You may object to any processing based on legitimate interests (Section 8).
Use of artificial intelligence. Our chat and API use third-party AI models (Section 6): when you use them, your messages are sent to the provider of the model you choose to generate a response. Responses are generated by a machine and may contain errors; please review them before using them to make important decisions. We also use AI to categorize and summarize the public content analyzed by our radar.
Moderation and automatic suspension. Each message is automatically reviewed before being sent to the model. If it violates our terms of use, it will not be sent, and you will not be charged. If [5] messages from the same account are blocked within 24 hours, access to the chat and the API is automatically suspended, without losing your balance. This decision is necessary to fulfill the contract and comply with our suppliers’ terms (Art. 22.2.a of the GDPR). You have the right to have a member of our team review this decision, to express your point of view, and to challenge it by writing to [privacy@domain]. Apart from these cases, we do not make decisions based solely on automated processing that produce legal effects on you or significantly affect you.
5. Retention Periods
We retain your data only for as long as necessary to fulfill the purpose for which it was collected. Afterward, we block the data for the duration of the statute of limitations for potential liabilities, as required by Article 32 of the LOPDGDD, and finally delete it.
| Data | Deadline |
|---|---|
| Consultations without a subsequent contractual relationship | [12 months] since the last communication |
| Customers: Accounts and Orders | For the duration of the relationship and, thereafter, for up to 6 years (Art. 30 of the Commercial Code) |
| Log of chat and API usage (model, tokens, credits, date) | For the duration of the relationship and for up to 6 years afterward, because it justifies the billing |
| Content of the conversations | Web chat with chat history enabled: until you delete them, disable saving, or your account is deleted, and for a maximum of [90] days without activity; after that, they are automatically deleted. API: We do not retain the content. AI providers process and retain it in accordance with their own terms [specify each provider’s retention period as outlined in their service agreement]. |
| Log of messages blocked by moderators (date and categories, without the content) | 90 days |
| Account Suspension and the Reason for It | For the duration of the suspension |
| API Keys | Until you revoke them or your account is deleted; after that, only the associated usage record is retained |
| Country of connection | 24 hours, in the server's temporary memory |
| Invoices and Tax Information | 6 years (Commercial Code) and, in any case, 4 years (General Tax Law) |
| [Newsletter] | [Until you cancel your subscription] |
| Server Technical Logs | [The time limit set by the hosting provider, up to a maximum of X months] |
| Public content analyzed by the radar | 180 days from the date of detection, except for opportunities selected by our team |
| Cookies | According to the [Cookie Policy] |
6. Recipients and Data Processors
We do not sell or disclose your information to third parties. We only disclose it when required by law, for example, to the Tax Agency, courts, or law enforcement agencies.
To provide this service, we work with vendors who access data in their capacity as data processors. We have entered into a contract with each of them in accordance with Article 28 of the GDPR.
| Supplier | Service | Location |
|---|---|---|
| [IONOS — exact company name as stated in your contract] | Web Hosting and Email | European Union |
| [Cloudflare] | [Site distribution and security network; determines the country of connection] | [The United States and the Global Network] |
| [Stripe / PayPal / Redsys / other payment gateway] | Payment Processing | [According to the runway] |
| [Tax and Accounting Services] | Accounting and Tax Obligations | Spain |
| [Email Marketing Provider] | [Newsletter Delivery] | [According to the supplier] |
| Anthropic | Claude Models for Chat and the API | United States |
| OpenAI | Moderation of all chat and API messages; GPT models; classification and summarization of public content analyzed by the radar | United States |
| [DeepSeek, if enabled] | [DeepSeek Chat and API Models] | [China] |
| [Other model providers: Groq, Together…] | [Open Chat and API Models] | [According to the supplier] |
Before sending a message to any model, we run it through OpenAI’s moderation service to prevent prohibited uses, so OpenAI receives all messages from the chat and the API, regardless of which model you choose. In addition, each model provider receives the messages from conversations in which you choose one of their models. We do not send them your name, email address, billing information, or balance.
Privacy Shield. If you keep it enabled (it is enabled by default in chat and tools), before sending the message to moderation and the AI, we replace your email addresses, phone numbers, ID numbers (DNI, NIE, CIF), bank account numbers (IBAN), credit card numbers, tax ID numbers (RFC, CURP, CUIT, RUT), and any «words to hide» that you specify with placeholders on our own server. Service providers receive the placeholders, not the actual data, and when the response arrives, we show you the real data. The shield does not detect people’s names on its own: add them to your list of words to hide. We store those words in your account until you delete them or delete your account. Even so, we recommend that you do not include unnecessary personal data—whether your own or that of third parties—in your messages.
Private mode. If you enable private mode in the chat, the conversation won't be saved in your history. We only keep a record of usage (date, model, tokens, and credits), without any content.
7. International Transfers
Some providers listed in Section 6 may process data outside the European Economic Area. In such cases, the transfer is based on one of the safeguards set forth in Chapter V of the GDPR:
- United States: the EU-U.S. Data Privacy Framework, when the provider is certified, or, failing that, the standard contractual clauses approved by the European Commission.
- Other countries without an adequacy decision [such as China]: standard contractual clauses, an assessment of the impact of the transfer, and supplementary measures. [If you use a template from a provider located in these countries, your messages will be processed there: we’ll indicate this next to the template’s name so you can choose another one.]
You can request more information or a copy of the applicable warranties by writing to [privacy@domain].
8. Your Rights
You may exercise the following rights at any time, free of charge:
| Law | What It Is |
|---|---|
| Access | Find out if we process your data and obtain a copy |
| Correction | Correct inaccurate or incomplete data |
| Deletion | Request that we delete your data when it is no longer necessary, among other circumstances |
| Opposition | Object to processing based on legitimate interests or for commercial purposes |
| Limitation | Request that we retain your data without processing it, for example, while a complaint is being resolved |
| Portability | To receive the data you provided to us in a structured format, or to have us send it to another data controller |
| Withdrawal of Consent | You can stop taking it whenever you want; it won't affect your previous treatment. |
How to exercise them. Please email [privacy@domain] or send a letter to [address], specifying the right you are exercising. If we are unable to verify your identity by other means, we will ask you to provide proof of your identity. We will respond within one month, extendable by two additional months in complex cases, as provided for in Article 12 of the GDPR.
Complaint. If you believe we have not properly addressed your rights, you may file a complaint with the Spanish Data Protection Agency (C/ Jorge Juan, 6, 28001 Madrid).
9. Security, Minors, Cookies, and Changes
Safety. We implement technical and organizational measures appropriate to the risk, as required by Article 32 of the GDPR: encrypted connections (HTTPS), encrypted passwords and API keys, encrypted stored conversations, access controls, backups, and regular updates. If a security breach occurs that poses a risk to you, we will notify the AEPD and, where appropriate, the individuals affected.
Minors. Our services are intended for professionals and businesses. We do not knowingly collect data from children under 14 years of age, which is the minimum age for consent in Spain according to Article 7 of the LOPDGDD. If we discover that we have received such data, we will delete it.
Data accuracy. You warrant that the information you provide to us is accurate and agree to notify us of any changes. If you provide us with information about third parties, you must have informed them and obtained their authorization.
Cookies. This site uses first-party and third-party cookies. You can find out which ones we use, what they're for, and how to manage them in our [Cookie Policy].
Changes to this policy. We may update this policy due to changes in the law or in our services. We will post the current version on this page, and if the changes are significant, we will notify you through our usual channels.
Last updated: [publication date].
Español 
English 
Português do Brasil