1. Data controller

In compliance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Act 3/2018 (LOPDGDD), we inform you that the controller of the personal data processed on this website is:

Controller: PUERTO INNOVA SL
Tax ID (NIF/CIF): B25904202
Address: C/ dels Caus, 6, 46870 Ontinyent, Valencia (España)
Contact email: [email protected]
Website: pictulab.com

2. Personal data we process

Depending on how you use Pictulab (purchase of tokens, cloud subscription, contact, support, etc.), we may process the following categories of data:

Identification and account data: name (if provided), email, password (hash), username, language.
Billing data: name/company, NIF/VAT (if applicable), address, country, invoice and purchase history.
Payment data: information required to process payment (for example, payment token, transaction ID or payment status). In general, Pictulab does not store your full card details.
Support data: communications, incidents, screenshots or information you send us voluntarily.
Technical data: IP, access logs, device/browser type, technical identifiers and security events.
Generated or submitted content: prompts, parameters, generated images and/or files associated with the service (when the user uses the platform).

The user guarantees that the data provided is accurate and undertakes to communicate any changes.

3. Purposes of processing

We process your personal data for the following purposes:

User account management: registration, authentication, access to the dashboard and features.
Provision of the service: enabling the purchase/use of tokens and the use of cloud subscriptions.
Payment and billing management: processing payments, issuing invoices, managing renewals or cancellations.
Support and user assistance: handling queries, incidents and requests.
Security and fraud prevention: detecting improper use, unauthorized access or service abuse.
Legal compliance: tax, accounting and consumer obligations, as well as requests from authorities.
Product improvement: analyzing the operation of the service and fixing errors (where applicable).

4. Legal basis (legitimation)

The legal basis for processing the data depends on the purpose:

Performance of a contract (Art. 6.1.b GDPR): registration, account management, purchase of tokens, subscription and provision of the service.
Compliance with a legal obligation (Art. 6.1.c GDPR): tax, accounting and official obligations.
Legitimate interest (Art. 6.1.f GDPR): security, fraud prevention, service improvement and defense against claims.
Consent (Art. 6.1.a GDPR): commercial communications (if enabled) and non-technical cookies (where applicable).

5. Data retention (periods)

We will retain the data for the time necessary to fulfill the purpose for which it was collected and, subsequently, for the periods required by applicable regulations or while liabilities may arise:

Account data: while the user keeps the account active. After cancellation, it will be blocked or deleted as appropriate.
Billing/purchase data: for the legal tax and accounting retention periods (generally 4 years for tax purposes and up to 6 years under Art. 30 of the Spanish Commercial Code).
Support: for the time necessary to handle the incident and any potential liabilities.
Security logs: for the time strictly necessary for security and auditing purposes.

In certain cases, we may keep the data duly blocked for the time necessary to handle claims or the exercise/defense of legal actions.

6. Recipients (to whom we disclose data)

We do not disclose your personal data to third parties, except where legally required. However, in order to provide the service, we may work with providers that act as data processors, with whom we sign the corresponding contracts in accordance with Art. 28 GDPR.

These providers may include, by way of example:

Payment platforms (for example, Stripe or other payment providers).
Hosting and cloud infrastructure services (servers, storage, CDN, etc.).
Email and support services (communications and customer service).
Analytics tools (only if used and subject to prior acceptance of cookies where applicable).

7. International transfers

In the event that some technology providers are located outside the European Economic Area (EEA), international data transfers may take place, applying the safeguards required by the GDPR, such as standard contractual clauses (SCCs), adequacy decisions or other equivalent measures.

8. Content processing and image generation

To provide the service, Pictulab processes the information entered by the user (for example, prompts) and the resulting content (for example, generated images) in order to execute the requested functionality.

The user declares that they have the right to use the texts, descriptions, images or materials they provide and that these do not infringe the rights of third parties (for example, intellectual property, image rights or confidentiality).

Pictulab may apply reasonable security and abuse-prevention controls to protect the service, prevent unlawful or fraudulent use and ensure the continuity of the platform.

9. Rights of users

You may exercise the rights recognized by data protection regulations: access, rectification, erasure, objection, restriction of processing and portability, as well as withdrawing consent at any time (where processing is based on consent).

To do so, you may contact us at: [email protected]. We may request additional information to verify your identity when necessary.

Likewise, if you consider that your rights have not been properly addressed, you may file a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

10. Security measures

Pictulab applies reasonable technical and organizational measures to protect personal data against loss, alteration, unauthorized access or disclosure, taking into account the state of the art, the costs of implementation and the nature of the data processed.

11. Cookies

This website may use its own and third-party cookies. For more information, please see our Cookie Policy.

12. Minors

Pictulab is intended for adults. Under Art. 7 of the LOPDGDD, individuals over 14 years of age may give consent for the processing of their data; below that age, the consent of the holders of parental authority or guardianship is required. If we detect that a minor's data has been collected without proper authorization, we will delete it. If you believe a minor has provided us with data, please contact us so we can remove it.

13. Automated decision-making

We do not make automated decisions that produce legal effects on the user or similarly significantly affect them (Art. 22 GDPR). The image-generation systems carry out the functionality requested by the user and do not perform profiling with such effects.

14. Amendments to the Privacy Policy

PUERTO INNOVA SL reserves the right to amend this Privacy Policy to adapt it to legislative developments or changes in the service. In the event of significant changes, users will be informed by reasonable means.