Privacy policy

1. Data Controller

The data controller for your personal data is:

• Company name: Aquí Está el Pato SL ("we", "the Company")
• Tax ID: B86353836
• Registered address: Las Rozas de Madrid, Spain
• Contact email and DPO: support@altux.ai

2. What Data We Collect

We collect different types of information to provide you with the service:

2.1 Data You Provide Directly

• Registration data: When creating an account (if applicable) or purchasing credits, we collect your email address.
• Billing data: To issue invoices, we may require your name, address, country, and Tax ID/VAT ID (if you are a business).
• Generated Content (Inputs and Outputs): We collect the texts ("prompts") you enter and the images generated by the AI, which are stored in your private history.

2.2 Automatically Collected Data

• Usage data: IP address, browser type, operating system, access time, and pages visited within the platform.
• Cookies: We use essential technical cookies to keep your session active and remember your preferences.

2.3 Payment Data

We DO NOT store or process your complete credit card data. Transactions are made directly through our secure payment provider, Stripe, Inc. We only receive payment confirmation and limited details (such as the last 4 digits of the card) for accounting purposes.

3. Purpose of Processing

We use your data for the following purposes:

• Service provision: Manage your account, process credit purchases, and allow you to use the image generation tools.
• Customer support: Respond to your questions, complaints, or refund requests.
• Legal compliance: Issue invoices, declare taxes (VAT), and comply with accounting obligations before Spanish tax authorities.
• Service improvement: Analyze in an aggregated and anonymous way how the platform is used to fix errors and improve the experience.

4. Legal Basis

The legal basis for processing your data is:

• Contract execution: To manage your registration as a user and the purchase of credits.
• Legal obligation: For billing and tax management.
• Legitimate interest: To prevent fraud and ensure network security.

5. Data Sharing with Third Parties

To provide the service, it is strictly necessary to share certain data with technological service providers ("Data Processors"):

• Payment processor: Stripe (US/Ireland) receives your financial data to process payments.
• Artificial intelligence engines: When you generate an image, your text ("prompt") is sent to AI providers such as Google (Gemini), OpenAI, or Anthropic for processing.

  Note: These providers receive the text anonymously or associated with a technical ID, not necessarily linked to your real name, for the sole purpose of generating the image.

• Hosting and Infrastructure: Cloud hosting providers (such as Firebase/Google Cloud) where our servers and databases are hosted.
• Public administration: Tax authorities and competent bodies when required by law.

6. International Data Transfers

By using providers such as Google, OpenAI, Anthropic, or Stripe, some of your data may be processed outside the European Economic Area (EEA), specifically in the United States.

We ensure that such transfers comply with the GDPR through:

• The EU-U.S. Data Privacy Framework.
• Standard Contractual Clauses (SCC) approved by the European Commission.

7. Data Retention

• Account data: As long as you keep your account active. If you request deletion, your data will be erased, except for that which we must retain by law.
• Tax data: Invoices and transaction data will be retained for the time required by tax regulations (generally 4 or 5 years).
• Images: Retained in your gallery until you decide to delete them or close your account.

8. Your Rights

As a user, you have the right to:

• Access: Know what data we have about you.
• Rectification: Correct inaccurate data.
• Erasure ("Right to be Forgotten"): Request that we delete your data when it is no longer necessary.
• Objection and Restriction: Object to the processing of your data in certain circumstances.
• Portability: Receive your data in a structured format.

To exercise these rights, send an email to support@altux.ai indicating "DATA PROTECTION" in the subject line.

9. Security

We apply technical and organizational measures (HTTPS encryption, secure databases, restricted access) to protect your data against unauthorized access, loss, or alteration. However, no Internet transmission is 100% secure.

10. Changes to the Policy

We may update this policy occasionally to reflect legal or service changes. We will notify you of any significant changes through the website or by email.