Privacy Policy

1. Data controller

In accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), we inform you that the controller of your personal data is:

• Controller: Pau Romaní
• National ID (DNI): 23928922K
• Address: Barcelona, 08023, Spain
• Email: info@directorai.org
• Website: https://directorai.org

2. Personal data we collect

We collect the following personal data depending on how the User interacts with the Website and the Software:

2.1. Registration and account data

• First name and surname.
• Email address.
• Username.
• Password (stored encrypted).

2.2. Billing and payment data

• Full name or company name.
• Billing address.
• Tax ID (NIF/CIF), if an invoice is requested.
• Transaction details (amount, date, payment method).

Important note: payment details (card number, banking credentials, PayPal data) are handled directly by the payment gateways (Stripe, PayPal, Google Pay) and are never stored on our servers.

2.3. Contact form data

• Name.
• Email.
• Message or enquiry.

2.4. Browsing data

• IP address.
• Browser and device type.
• Pages visited and time spent.
• Operating system.

2.5. Software usage data

• Licence identifier.
• Number of executions consumed.
• Version of the Software used.
• Technical data for each execution (characteristics of the computer, duration, artificial intelligence model used and options selected).
• If the User creates legal pages for their directories, the details of the person or entity that owns those websites, as entered by the User in the Software (name or company name, tax identifier, address and contact details).

3. Purposes of processing

The personal data collected will be processed for the following purposes:

4. Recipients of the data

Your personal data may be disclosed to the following recipients:

No international data transfers are made outside the European Economic Area except to the providers listed, which have appropriate safeguards in place (standard contractual clauses approved by the European Commission or adequacy decisions).

5. Retention period

Personal data will be retained for the following periods:

• Account data: for as long as the account remains active and, thereafter, for the period required by law.
• Billing data: a minimum of 4 years (under the Spanish General Tax Act) and up to 6 years (under the Spanish Commercial Code).
• Contact data: until the enquiry is resolved and, thereafter, for a maximum of 1 year.
• Browsing data: a maximum of 13 months.
• Marketing communications: until the User withdraws consent.

Once these periods expire, the data will be deleted or irreversibly anonymised.

6. User rights

Under the GDPR and the Spanish LOPDGDD, the User has the right to:

• Access: obtain confirmation as to whether their data is being processed and access it.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure: request deletion of their data when it is no longer necessary for the purpose for which it was collected.
• Objection: object to the processing of their data in certain circumstances.
• Restriction: request restriction of processing in the cases provided for by law.
• Portability: receive their data in a structured, commonly used, machine-readable format and transmit it to another controller.
• Withdrawal of consent: withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand.

To exercise these rights, the User may write to info@directorai.org, attaching a copy of their national ID or equivalent identity document.

The User is also entitled to lodge a complaint with the Spanish Data Protection Agency (AEPD) if they consider that the processing of their data does not comply with current regulations: www.aepd.es.

7. Third-party data collected by the Software

DirectorAI lets Users collect publicly available data about businesses and establishments listed on platforms such as Google Maps. This information may include:

• The business trading name.
• Published address and contact details.
• Opening hours.
• Business categories and description.
• Reviews and ratings published by platform users.
• Public photographs of the business.

Regarding this data:

• DirectorAI acts solely as a technical tool. The User is the data controller for the data they collect and publish through the directories generated.
• The User must ensure that the use of such data complies with applicable regulations, including the GDPR, and must provide the necessary mechanisms (such as legal notices and privacy policies) on the directories they publish.
• If a third party (a business or an individual) wishes to exercise their rights over data included in a directory generated with DirectorAI, they must contact the User who owns that directory.
• If the data appears published on the directorai.org website itself (for example, in demos), the owner will handle requests to exercise rights at info@directorai.org.
• The DirectorAI Engine plugin that the User installs on their directory sends the owner, encrypted, the technical data needed to verify the licence, provide updates and deliver the service, including a log of the emails the directory sends (recipient, subject and result) and of the activity of its featured listings. The owner processes this data as a processor on behalf of the User.
• With the record of each execution, the DirectorAI Software sends the owner the technical data of that execution (version, characteristics of the computer, timings, artificial intelligence model used and options selected) and, if the User creates legal pages for their directories, the details of the person or entity that owns those websites, as entered by the User in the Software (name or company name, tax identifier, address and contact details), which are in any case published on those pages. The owner processes this data to provide the service, offer technical support and improve the Software, on the legal bases set out in section 3, and keeps it for as long as the User’s account remains active.

8. Featured listings in our own directories

In addition to distributing the Software, the owner operates its own web directories where a business can purchase a featured listing. In that case the controller of the data of that business is the owner of this policy, and not a User of the Software.

To provide that service and issue the corresponding invoice, we process the contact details of the person purchasing it (name, email address and, if given, telephone number) and the billing details of the business (name, address and tax identification number). The legal basis is performance of the contract and compliance with tax obligations, and billing data is kept for the periods set out in section 5.

Invoices are always issued through Stripe Payments Europe, Limited (Ireland), acting as a processor, which may transfer data to Stripe, Inc. (United States) under the safeguards provided for in the Regulation. If payment is made by card, Stripe also handles the payment. If payment is made with PayPal, the payment is processed by PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg), which handles the payment data as an independent controller under its own privacy policy, and the billing details are entered in the directory before paying. The owner never has access to the card details or to the payer’s PayPal account.

The information published in the listing itself (trade name, address, telephone, opening hours, photographs and reviews) comes from publicly available sources or is provided by the business, and can be corrected or removed by writing to info@directorai.org.

9. Security measures

The owner has adopted the technical and organisational measures needed to safeguard personal data and prevent its alteration, loss, unauthorised processing or access, including:

• Password hashing with secure algorithms.
• Encrypted communications using HTTPS/TLS.
• Access to personal data restricted to authorised personnel only.
• Regular backups.
• Hosting on servers located in the European Union.
• Payment processing delegated entirely to certified payment gateways (Stripe, PayPal).

10. Marketing communications

The User will only receive marketing communications by email if they have given express consent. In any case, every message will include a link to unsubscribe immediately and free of charge.

Consent to receive marketing communications is separate from the contractual relationship and may be withdrawn at any time without affecting provision of the service.

11. Minors

DirectorAI is not aimed at anyone under 16. We do not knowingly collect personal data from minors. Should the owner become aware that a minor’s data has been collected without parental consent, it will be deleted immediately.

12. Changes to this privacy policy

The owner reserves the right to amend this privacy policy at any time. Any change will be published on this page with the corresponding update date. Users are advised to review this policy periodically.