Privacy Policy

1. Data controller

• Controller: PUERTO INNOVA SL (“Pictulab”, “we” or “us”)
• NIF (Spanish tax ID): B25904202
• Address: C/ dels Caus, 6, 46870 Ontinyent, Valencia (Spain)
• Registry: Commercial Registry of Valencia, Sheet V-231231
• Privacy contact: [email protected]
• Phone: +34 672 38 63 31

Given the volume and nature of the processing we carry out, we are not required to appoint a Data Protection Officer (Art. 37 GDPR and Art. 34 LOPDGDD). Any privacy question can be sent to the contact address above, which is handled directly by the company's management.

2. Who this policy applies to

This policy applies to the processing we carry out as controller in respect of:

• Visitors to the pictulab.com website and its subdomains.
• Registered users of the Pictulab web application, the mobile app for Android and iOS, the API and the MCP server, including team members.
• Customers who buy tokens or subscribe to a plan.
• People who subscribe to the newsletter or contact support or the sales team.
• Business contacts at companies with which we have, or wish to start, a commercial relationship.

When a customer uses Pictulab to process personal data of third parties (for example, photographs of people uploaded to the platform or data from a connected online store), the customer is the controller of that data and Pictulab acts as processor, processing it solely to provide the service and in accordance with the customer's instructions, pursuant to Article 28 GDPR and the Terms of Service.

3. Personal data we process

We only process the data needed for each purpose. Depending on how you interact with us, this may include:

• Account data: name, email address, password (stored only as an irreversible cryptographic hash, never in plain text), phone number if you choose to provide it, language, time zone, and account and notification preferences.
• Third-party sign-in data: if you sign in with Google or GitHub, we receive your identifier, name and email address from that provider. We do not receive your password for those services.
• Security and access data: IP address, browser and device (user agent), date and time of sign-ins and failed attempts, active sessions and, if you enable two-step verification, the secret needed to validate it.
• Team data: team membership, role, invitations sent and received (including the invitee's email address).
• Billing data: name or company name, tax ID or EU VAT number, postal address, country, purchase history, subscriptions and invoices issued.
• Payment data: payments are processed by Stripe. Pictulab does not receive or store your full card number; only customer and transaction identifiers, the payment status and basic details of the payment method (for example, the card brand and last four digits).
• Content you upload or generate: prompts, parameters, images, videos and other files you upload or generate, folders and projects, and the associated metadata (model used, date, size).
• Service usage data: token consumption, operations performed and, if you use the API, request logs (including IP, user agent and parameters sent) for billing, usage limits, security and support.
• Integrations you connect: if you link external services (for example, Google Drive, Dropbox, S3/FTP/SFTP storage or a WooCommerce or PrestaShop store), the necessary credentials or authorisations and the data you choose to exchange with them.
• Communications: messages and attachments you send to support or by email, and technical delivery data for the emails we send you (delivery, bounce, open and click).
• Referral programme: the invitation code used and the link between the referrer and the referred person, in order to assign rewards.
• Account origin: when you create an account we record where you came to Pictulab from (for example, a search engine, an invitation link or a free tool), without cookies, so we know which channels work. This data is not shared with third parties or used for advertising.
• Browsing data: information obtained through cookies and similar technologies, as described in the Cookie Policy.
• Mobile app: in the app we process the same account, content and usage data as on the web. It only asks for permission to save images to your gallery, and only when you request it; it does not access your contacts or your location and does not use advertising identifiers. If you report an image from the app, we handle it as a communication with support.

We do not request special categories of data (Art. 9 GDPR). Please do not include them in prompts, files or support messages unless strictly necessary.

Data marked as mandatory in each form is necessary to provide the service; if you do not provide it, we will not be able to handle your request. You guarantee that the data you provide is accurate and that, if you provide data about third parties (for example, when inviting a colleague), you are entitled to do so.

4. Purposes and legal bases

For each purpose, we indicate the legal basis under Article 6 GDPR:

Where processing is based on legitimate interest, we have balanced that interest against your rights and reasonable expectations. You can ask us for information about that assessment and object to the processing at any time (see section 10).

5. Artificial intelligence and your content

To run a generation or edit, we send your prompt, the parameters and, where applicable, the reference images to the provider of the model you have chosen (see section 7). The result is returned to Pictulab and saved in your library.

• We do not train models on your prompts, images or files. Pictulab does not develop its own AI models.
• Model providers act as processors or sub-processors and may only use the data to return the result, under their terms for business API use. Some may temporarily retain requests to detect abuse, in accordance with their own policies.
• The improve prompt feature sends your text to a language model to rewrite it; it only runs when you request it.
• Several free tools on the website (background removal, image conversion or resizing, PDF tools, video-to-GIF conversion) run entirely in your browser: files never leave your device or reach our servers.
• We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Automated abuse-detection systems may block a specific request, and you can always ask for a person to review it.

6. Content you share

Your content is private by default and is only visible to you and your team members. It becomes accessible to others only when you decide:

• When you create a share link for a project, folder or image, anyone with the link can view it and, unless you disable it, download it. You can set an expiry date and revoke the link at any time; we record the number of views.
• When you mark an image as public, it becomes accessible via its address.
• If you publish or export content to third-party services through integrations, those third parties will process it in accordance with their own policies.

Take particular care when sharing images showing identifiable people: you need their permission.

7. Recipients and processors

We do not sell or transfer your personal data to third parties for their own purposes. We only disclose it to:

• Service providers (processors) that we need to provide the service, with whom we have signed the agreements required by Article 28 GDPR.
• Public authorities, judges and courts, where there is a legal obligation (for example, the Spanish Tax Agency).
• Other members of your team, who see the content and activity shared in that team, and third parties you yourself give access to through links or integrations.
• Professional advisers (accountants, lawyers), bound by confidentiality, where necessary.
• In the event of a reorganisation, merger or sale of the business, to the acquirer, who would take on the same commitments set out in this policy.

The providers with access to personal data, grouped by category, are:

We name the providers you deal with directly when paying or signing in. You can ask us at any time for the identity of the other processors and sub-processors by writing to [email protected]; if you are a customer and Pictulab processes data on your behalf, we will also inform you of any changes to them.

8. International transfers

Some of the providers listed are located, or may access data, outside the European Economic Area, mainly in the United States. In those cases, the transfer is based on:

• The European Commission's adequacy decision on the EU-US Data Privacy Framework, for entities certified under it.
• The standard contractual clauses approved by the European Commission (Decision 2021/914), together with any supplementary measures required.

You can request information about the safeguards applied and obtain a copy of them by writing to [email protected].

9. Retention periods

We keep data only for as long as necessary for the purpose for which it was collected. After that, we keep it blocked (Art. 32 LOPDGDD), available exclusively to judges, courts and authorities, for the limitation periods of any potential liabilities, and finally we delete it.

10. Your rights

You can exercise the following rights at any time, free of charge:

• Access: find out whether we process your data and obtain a copy.
• Rectification: correct inaccurate or incomplete data. You can change much of it yourself in your account settings.
• Erasure: ask us to delete your data. You can delete your account from your account settings, on the web or in the mobile app (Account → Delete account), or by writing to [email protected] from your account's email address, including if you signed in with Google or GitHub. More details in Delete your account.
• Objection: object to processing based on legitimate interest, including marketing, which we will stop immediately.
• Restriction: ask us to suspend processing while a complaint is being verified.
• Portability: receive the data you have provided to us in a structured, commonly used format, and have us transmit it to another controller. You can download your images and files from the application at any time.
• Withdrawal of consent, without affecting the lawfulness of prior processing.
• Not to be subject to automated individual decisions with legal or similarly significant effects.

To exercise them, write to [email protected] from the email address associated with your account, or by post to our registered address, stating the right you are exercising. We will only ask for additional information if it is needed to confirm your identity. We will respond within one month, which may be extended by two further months in complex cases, in which case we will let you know.

If you believe we have not properly handled your rights, you can lodge a complaint with the Agencia Española de Protección de Datos (AEPD, the Spanish Data Protection Agency; C/ Jorge Juan, 6, 28001 Madrid, www.aepd.es) or with the supervisory authority of your country of residence in the EU. We would appreciate it if you wrote to us first so we can try to resolve it.

11. Security

We apply technical and organisational measures appropriate to the risk (Art. 32 GDPR), including:

• Encryption of communications via HTTPS/TLS.
• Passwords stored using strong hash functions (bcrypt) and API keys stored only in hashed form.
• Protected session cookies (HttpOnly, Secure and SameSite) and sessions with expiry.
• Data isolation per team, role-based access control and logging of administrative actions.
• Share links with random, unguessable identifiers, revocable and with optional expiry.
• Database backups and infrastructure monitoring.

In the event of a personal data breach, we will notify the AEPD within 72 hours at most and, where it poses a high risk to your rights, we will inform you without undue delay (Arts. 33 and 34 GDPR).

12. Minors

Pictulab is intended exclusively for people aged 18 or over. We do not knowingly collect data from minors. If we find that a minor has created an account, we will delete it together with their data. If you are a parent or guardian and believe that a minor has provided us with data, write to us at [email protected].

13. Cookies

We use necessary technical cookies and, only if you accept them, analytics cookies. All the information, the list of cookies and how to change your choice are in the Cookie Policy.

14. Changes to this policy

We may update this policy to reflect legal or service changes (for example, the addition of a new provider). We will always indicate the date of the last update and, if the change is significant, we will let you know by email or through a notice in the application before it takes effect.