Privacy policy

Controller

• Ontobit, S.L.U., tax ID B05748074
• Registered office: Calle Jesús Aprendiz 7, 28007 Madrid, España
• Privacy contact: hello@ontobit.dev

We have not appointed a data protection officer, as we are not required to.

Two different roles

We are the CONTROLLER of the data of people who visit this website, who write to us, and who hold an account to use our services on behalf of a customer.

We are a PROCESSOR of the data our customers store and manage inside the services: their contacts, their students, their buyers, the messages they send them. Each customer is the controller of that data and decides what it is used for; we process it only on their instructions and under the data processing agreement included in the Terms of use. If your data is held in the account of one of our customers, please contact them first.

Data we process as controller

• Contact: name, email, company and whatever you tell us when you write.
• Account: name, email, the organisation you belong to, role, and sign-in data (passwords are stored as an irreversible hash; passkeys, as a public key).
• Usage and security: technical access logs (date, IP address, browser) and logs of relevant actions within the account.
• Customer billing: tax and payment details. Card data is handled by the payment provider; we never see or store it.

Purposes and legal bases

• Answering your requests and providing the contracted services: performance of a contract or pre-contractual steps.
• Keeping the services secure, preventing abuse and improving them: legitimate interest.
• Invoicing and meeting tax and accounting duties: legal obligation.
• Sending you commercial communications, if you asked for them: your consent, which you can withdraw at any time.

We do not make automated decisions with legal effects about you, nor do we profile you for that purpose.

Data received from third-party platforms

The services let a customer connect their accounts on other platforms (for example Facebook, Instagram, WhatsApp Business or TikTok) to publish content or send and receive messages from one place. When they connect an account, we receive from that platform what is needed to do so: account, page or phone number identifiers, display name, the permissions granted and an access token; and, depending on the feature, posts, messages and their statuses.

We use that data solely to provide the customer with the feature they enabled. We do not sell it, we do not share it with third parties for their own purposes, and we do not use it for advertising or profiling. The customer can disconnect each account at any time; when they do, we delete its token and stop receiving data from it.

Who we share data with

We do not sell personal data. We disclose it only to providers that render a service to us, under a data processing agreement, and when the law requires it. Currently:

• Hosting and infrastructure: Hetzner (Germany) and Cloudflare.
• Email: Google Workspace.
• Payments: Stripe and Revolut.
• Course video: Bunny.
• Artificial intelligence features the customer chooses to use: Anthropic.
• The platforms the customer connects (Meta, TikTok…), to carry out what they request.

Transfers outside the European Economic Area

Some of those providers are in the United States or process data from there. In those cases the transfer relies on an adequacy decision (EU–US Data Privacy Framework) or on the European Commission's standard contractual clauses.

How long we keep it

• Enquiries: until resolved and one year after.
• Account: while it is active. Once closed, it is deleted or anonymised within 30 days, except for what must be kept by law.
• Invoices and accounting records: six years (Spanish Commercial Code); tax records, for the limitation period.
• Security logs: up to twelve months.
• Data processed on behalf of a customer: as the customer decides while the service lasts; on termination it is returned or deleted as they instruct.

Your rights

You can access your data, rectify it, erase it, object to its processing, ask for it to be restricted, request its portability, and withdraw any consent you gave. Write to hello@ontobit.dev from the email associated with your data, stating which right you are exercising. We reply within one month.

If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

The step-by-step procedure to delete your data is on the “Data deletion” page.

Security

We apply technical and organisational measures proportionate to the risk: encryption in transit, each customer's data kept separate from the others', sign-in with a second factor or passkey, least-privilege permissions, backups, and logging of sensitive operations.

Children

The services are aimed at businesses and professionals. We do not knowingly collect data from children under 14 without the consent of their parents or guardians.

Cookies

This website uses no analytics or advertising cookies. The services use only the strictly necessary technical cookies that keep you signed in, which do not require consent.

Changes

If we change this policy in a material way, we will say so here and, if you have an account, by email. The date of the last update is shown above.