Privacy Policy

This Privacy Policy governs the processing of personal data collected through the Adorea website and SaaS platform, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”), Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD) and any other applicable data protection legislation.

1. Data controller

• Owner: Adauge S.L.
• Registered address: Carrer d'Orient, 78-84, 3º 10ª, 08172 Sant Cugat del Vallès, Barcelona, Spain
• Contact email: contact@adorea.ai

2. Data we process

Depending on how you interact with the platform, we may process the following categories of data:

• Account data: first name, surname, email address, encrypted password, language and time zone.
• Organization data: company name, sector, website, logos, brand kit, products and catalogue of uploaded assets.
• Billing data: company name, tax identification number (NIF/CIF), tax address, plan purchased and payment history. Card data is processed directly by Stripe and is never stored on our systems.
• Generated content and instructions: prompts, texts, images and videos created by the user using AI, as well as SEO campaign settings.
• Third-party integration credentials: tokens for WordPress, Shopify, Instagram and other connected integrations, stored encrypted.
• Usage and technical data: IP address, device identifier, browser type, pages visited, actions on the platform and credit consumption.
• Communications: messages sent to support, newsletter subscriptions and contact requests.

3. Purposes and legal bases

• Provision of the service (account registration, onboarding, generation and publication of content, credit management) — legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Billing and tax/accounting compliance — legal basis: legal obligation (Art. 6(1)(c) GDPR).
• User assistance and support — legal basis: performance of a contract and legitimate interest.
• Service improvement and security (fraud detection, technical monitoring with Sentry, quota control) — legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Trial onboarding emails (help getting started, notices about the end of the trial and an offer of a call) — legal basis: performance of a contract (Art. 6(1)(b) GDPR) for notices about your account and legitimate interest (Art. 6(1)(f) GDPR) for the subsequent offer. You may unsubscribe at any time using the link in each email.
• Commercial communications and newsletter — legal basis: consent (Art. 6(1)(a) GDPR), which may be withdrawn at any time.
• Compliance with the AI Act (Regulation (EU) 2024/1689): technical logging of the use of AI systems, traceability of outputs and compliance with transparency obligations — legal basis: legal obligation.

4. Data retention

Account data is retained for as long as the user maintains the contractual relationship with Adorea. After the account is closed, it will be kept blocked for the periods required by law (up to 6 years for commercial and tax obligations; up to 4 years for any applicable employment or tax obligations) and will be deleted once any potential liabilities have become time-barred.

Generated content and prompts are retained for as long as the account is active. Technical logs are retained for a maximum of 12 months for security and service improvement purposes.

5. Recipients and data processors

In order to provide the service, we disclose data to the following data processors, all of which provide the safeguards required by Art. 28 GDPR:

• Supabase Inc. — database, authentication and storage. Servers in the European Union.
• Vercel Inc. — hosting and delivery of the application front end.
• Google LLC (Gemini API) — AI generation of text, images and video. Prompts and input materials are sent to Google for content generation.
• Stripe Payments Europe, Ltd. — payment gateway and subscription management.
• Sentry — technical monitoring and error logging.
• Meta Platforms Ireland Ltd. (Instagram Graph API) — only if the user connects their Instagram account.
• Automattic / Shopify — only for publishing to the WordPress or Shopify accounts that the user connects.

No data is disclosed to third parties for their own commercial purposes, and no personal information is sold.

6. International transfers

Some providers (Google, Stripe, Vercel, Sentry) may process data outside the European Economic Area. In such cases, transfers are based on the Standard Contractual Clauses approved by the European Commission (Decision (EU) 2021/914) and, where applicable, on the EU-U.S. Data Privacy Framework (adequacy decision of July 10, 2023). The user may request a copy of the applicable safeguards by writing to contact@adorea.ai.

7. Data subject rights

In accordance with Articles 15 to 22 GDPR, the user has the right to:

• Access their personal data.
• Request the rectification of inaccurate data.
• Request erasure (right to be forgotten).
• Request the restriction of processing.
• Object to processing based on legitimate interest.
• Request the portability of their data in a structured format.
• Not be subject to automated individual decisions producing legal effects.
• Withdraw consent at any time, without retroactive effect.

These rights may be exercised free of charge by writing to contact@adorea.ai with proof of the requester’s identity. If you consider that the processing does not comply with the law, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD).

8. Data security

Adorea applies appropriate technical and organizational measures to protect personal data, including: encryption in transit (TLS) and at rest, access control through Row Level Security in the database, encryption of third-party integration credentials, rate limiting, security event monitoring and regular backups.

In the event of a security breach affecting personal data, we will notify the AEPD and, where applicable, the user, within the time limits established by law (Arts. 33 and 34 GDPR).

9. Automated decisions and use of AI

The platform uses generative artificial intelligence systems (Google Gemini) to produce content based on the user’s instructions. These generations do not constitute automated decisions producing legal effects concerning the data subject within the meaning of Article 22 GDPR: the user retains editorial control and the final decision on publication at all times.

Generated content may contain inaccuracies; human review of it is the user’s responsibility. For more information on our transparency obligations under the AI Act (Regulation (EU) 2024/1689), see sections 3 and 4 of the Terms and Conditions.

Images of people uploaded by the user. If the user uploads images in which other people appear, the user acts as the controller of that processing and Adorea as processor: Adorea processes them only to generate the content requested by the user, through the AI provider indicated (Google LLC, Gemini API), and retains them until the user deletes them or for as long as the user keeps the account. Adorea does not use those images to identify anyone or to train models.

10. Cookies and similar technologies

The site uses first-party and third-party cookies that are strictly necessary for its operation (session, authentication) and, only with the user’s consent, analytics cookies (Google Analytics) and marketing cookies (Meta pixel and Google Ads, managed through Google Tag Manager, and the ChatGPT Ads conversion pixel, from OpenAI). You may change or withdraw your consent at any time via the “Cookie settings” link in the footer.

11. Minors

The service is intended exclusively for professionals and businesses. We do not knowingly collect data from children under 14. If we detect a registration by a minor, we will delete their data immediately.

12. Changes to this policy

Adorea may update this Privacy Policy to adapt it to legislative changes or to the evolution of the service. Material changes will be communicated by email or by a prominent notice on the platform at least 15 days in advance.