This English version is a translation provided for convenience only. The Spanish version is the only legally binding version and prevails in the event of any discrepancy. Read the Spanish version.

This policy explains what personal data Stackslides S.L. (“wiweb”) processes when you visit wiweb.io, create an account, publish a page or take out a plan on app.wiweb.io, in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, GDPR) and Organic Law 3/2018 (LOPDGDD, the Spanish Data Protection and Digital Rights Act).

1. Data controller

Stackslides S.L., Musitu 47, 08023 Barcelona (Spain). Privacy contact: privacidad@wiweb.io. No Data Protection Officer has been appointed.

2. Important: our customers’ pages

If you have visited a page published with wiweb (on a wiweb.me subdomain or on a business’s own domain) and submitted its form, the controller of your data is the owner of that page, not wiweb. wiweb acts as data processor on behalf of that owner, under the Data Processing Agreement: we store your message and send it to the owner by email, and nothing more. Please read the privacy policy published on the page you visited and address any request to exercise your rights to its owner; if you write to us instead, we will pass your request on to the owner, as the controller.

3. What data we process, for what purposes and on what legal basis

• Account and service. Your email address, your name and your password (encrypted), or the data Google provides to us if you sign in with your Google account (name, email address and photo); the details of your business or your page (trade name, company name, tax ID (NIF), address and tax address, phone number, opening hours, services and prices, links to social networks); the content of your page and the photos you upload; your conversations with the editing assistant, which are kept so that the thread can continue and which you can delete whenever you like; and your settings. Basis: performance of the contract (Art. 6(1)(b)), also on the Free plan.
• Billing. Payments are processed by Stripe: we store your Stripe customer identifier, your plan, the status of your subscription and the date of the first charge; Stripe keeps your card details and issues the invoices. We do not see or store your card number. Basis: contract and legal obligation (Art. 6(1)(c)).
• Proof of acceptance of the terms. When you take out a paid plan, we record who accepted the Terms, which version, when and with which payment session. Basis: legitimate interest in being able to prove the contract (Art. 6(1)(f)).
• Service communications. Sign-up and welcome emails, the notification of each message your page receives, the visits email, the presence reports (monthly or weekly depending on your plan), and notices about your domain, your payments and changes to the service. Basis: performance of the contract. We may send you information about our own services similar to those you already use (Art. 21(2) LSSI), always with a link to unsubscribe; any other commercial communication will require your consent.
• Support and forms. Whatever you send us through the help form in the dashboard (your message and your account details), the contact form on wiweb.io (name, email address, message), the Custom access request (name, email address, company, your current site if you give it, the option you chose and what you need) or the careers form (name, email address, position and cover letter). It reaches our internal Slack channel and our email so that we can deal with it. Basis: contract or pre-contractual measures (Art. 6(1)(b)) and legitimate interest in replying to those who write to us.
• Security and operation. Technical logs of requests (IP address, browser, date) kept by our hosting providers for a short period; to limit abuse, we temporarily store a cryptographic summary (salted hash) of the IP address, never the IP address itself; and error reports with technical data about the request that failed. Basis: legitimate interest in protecting the platform (Art. 6(1)(f)).
• Measurement and advertising. On wiweb.io, and only if you accept each category in the cookie notice: cookieless analytics (Vercel), Meta Pixel and its Conversions API (which receives your irreversibly hashed email address, your IP address and your browser when you submit a form) and Google Ads. Basis: consent (Art. 6(1)(a) and Art. 22(2) LSSI). In the dashboard: cookieless analytics and the Google Ads tag, to attribute paid sign-ups to a campaign; basis: legitimate interest in measuring our advertising, which you may object to. If you accepted advertising in the wiweb.io cookie notice, also Meta Pixel and its Conversions API, which receive your sign-up when you create your account, with your irreversibly hashed email address, your IP address and your browser; basis: your consent. Details in the Cookie Policy.
• Our own visit measurement (cookieless). We count page views on wiweb.io from our own server, using the same technique we use on every customer site: we store the date, the page, the domain that linked to you, the country and the device type, plus a one-way identifier derived from your IP address and browser that changes every day, so you cannot be recognised from one day to the next. We use no cookies and store nothing on your device, and the IP address is not stored: it is used to compute that identifier and then discarded. It is never linked to your account or to any other data, and it does not leave our providers. Records are deleted after 400 days. Basis: legitimate interest in measuring our own audience (Art. 6(1)(f)), within the terms of the Spanish DPA's audience-measurement exemption.
• Where you came from. When you sign up, we store with your account how you reached wiweb: the campaign tags carried by the link (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the ad click identifier if there was one (Google’s gclid, Meta’s fbclid), the website that referred you (only its domain, never the full address), the wiweb.io page from which you clicked, and the date. This is copied to your project when you create your page. It does not use cookies or store anything on your device, and we do not send it to third parties: it only tells us which channels bring us customers. Basis: legitimate interest in measuring where our sign-ups come from (Art. 6(1)(f)), which you may object to.
• Public data about your business. When you create your page, we look up your public Google Business Profile (name, address, opening hours, rating) to fill it in and, on plans with monitoring and as an initial check when the page is created, we ask Google, AI assistants and search data providers how your business appears. What we send are generic searches containing your line of business and your city, and the public address of your page; never your account details. Basis: performance of the contract.
• Photos and videos. If you search for stock photos, Pexels receives the search term and the chosen photo is copied to our storage. If you add a video, YouTube receives the video’s identifier so that we can read its title.
• Your Instagram account, if you connect it. From Settings you can connect your Instagram professional account. Meta then gives us, with your authorisation and with a single read permission (instagram_business_basic), your username, your name, your profile photo, your number of followers and your latest eight posts (the image, the caption and the link), so that we can show them in the Instagram widget and the Followers widget on your page. We do not read messages or comments, we do not publish anything and we do not share this data with anyone. We store the access permission encrypted, copy the images to our storage—your page requests nothing from Instagram when someone visits it—and refresh them once a day. Basis: performance of the contract (Art. 6(1)(b)): you ask for it by connecting, and you can undo it whenever you like.
• Your TikTok account, if you connect it. From Settings you can connect your TikTok account. TikTok then gives us, with your authorisation and with read-only permissions (user.info.basic, user.info.profile, user.info.stats and video.list), your username, your name, your profile photo, your number of followers and your latest eight public videos (the cover image, the title and the link), so that we can show them in a widget on your page. We do not publish anything, we do not read messages and we do not share this data with anyone. We store the access permission encrypted, copy the cover images to our storage—your page requests nothing from TikTok when someone visits it—and refresh them once a day. Basis: performance of the contract (Art. 6(1)(b)).
• Your YouTube channel, if you enter its address. wiweb uses the YouTube API Services to read the public data of the channel whose address you enter in Settings: name, photo, number of subscribers and the featured or most recently published video. We do not access your Google account or ask for any authorisation: it is the same information anyone can see on your channel. The images are copied to our storage and refreshed daily. When these data are used, the Google Privacy Policy and the YouTube Terms of Service apply. Basis: performance of the contract (Art. 6(1)(b)).

We do not request special categories of data; please do not include them in free-text fields. We do not take automated decisions that produce legal effects concerning you.

4. Artificial intelligence: what we send and to whom

We use OpenAI models to write and correct the texts on your page, to describe and crop your photos, and for the editor chat. They receive your page’s content and your business details (including your photos, when the feature needs them) and your messages to the assistant. They do not receive your billing details or the messages your customers send you through the form. Under the terms of their APIs, OpenAI does not use these data to train its models and keeps them for a maximum of 30 days to detect abuse; Perplexity does not retain queries made through its API; and Google does not use data from the paid Gemini API to improve its products. The presence analyses (ChatGPT, Perplexity, Gemini and Google) send generic questions such as “mejor peluquería en Gràcia” (“best hairdresser in Gràcia”), without personal data.

5. Retention

• Account data and the content of your page are kept for as long as the account is active. Free accounts do not expire.
• If you delete your page or your account, it remains blocked for 90 days—invisible to everyone and recoverable only if you ask us—and is then permanently deleted, photos included.
• We process the messages your page receives and its visit data on your behalf; daily visitor identifiers are deleted after 400 days (see the Data Processing Agreement).
• Billing data are kept blocked for the periods required by commercial and tax law; the record of acceptance of the Terms, for the limitation periods of any potential liabilities, even if you delete your account.
• Your Instagram data, for as long as the connection exists. We delete them—the access permission and the copies of your posts and your photo—when you disconnect from Settings or when you remove wiweb’s access from Instagram (Settings → Apps and websites); you can also ask us to by email. The same applies to TikTok: we delete the data when you disconnect from Settings, and we stop using them if you remove access from TikTok. The public data of your YouTube channel stop being shown if we have not been able to refresh them for 30 days, and disappear when you remove the channel address or delete your page.
• Job applications and contact messages, up to 12 months.
• Technical logs, a few days; the hashed IP address summaries used to limit abuse, a few hours.

6. Recipients and processors

We do not sell your data or disclose it to third parties unless required by law. To provide the service, we rely on providers that process data on our behalf under contract (Art. 28 GDPR). This is the complete list, with each provider’s country and, where it is outside the European Economic Area, the mechanism that covers the transfer:

• Vercel Inc. (USA) — hosting, content delivery network, functions and cookieless analytics. Certified under the EU-US Data Privacy Framework (DPF).
• Supabase, Inc. (USA) — database, authentication and file storage. The data are hosted in the European Union (Ireland, eu-west-1 region); the provider’s remote access from the USA is covered by the European Commission’s Standard Contractual Clauses.
• Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (USA) — payments and invoices. DPF.
• Resend, Inc. (USA) — sending the service’s emails. DPF.
• Functional Software, Inc. (Sentry) (USA) — error monitoring. DPF.
• Slack Technologies, LLC / Salesforce, Inc. (USA) — internal notifications from the forms and the help section. DPF.
• Meta Platforms Ireland Ltd. (Ireland) — Instagram API, only if you connect your account: it receives your authorisation and returns your profile and post data to us. DPF.
• TikTok Technology Limited (Ireland) — TikTok API, only if you connect your account: it receives your authorisation and returns your profile and video data to us.
• Google Ireland Ltd. / Google LLC (Ireland / USA) — Gemini API, YouTube API Services (the public data of your channel, if you enter its address), PageSpeed, Maps and Places, YouTube, Google Ads, corporate email, and the fonts that pages load if their visitor accepts them. DPF.
• OpenAI Ireland Ltd. (Ireland), with processing by OpenAI OpCo, LLC (USA) — AI-assisted writing, editing and chat features. Standard Contractual Clauses.
• Perplexity AI, Inc. (USA) — analysis of presence in AI. DPF.
• Serper (United Kingdom) — Google search results. Adequacy decision for the United Kingdom.
• DataForSEO OÜ (Estonia, EU) — search volumes.
• Pexels GmbH (Germany, EU) — stock photos.
• Meta Platforms Ireland Ltd. (Ireland) — Meta Pixel and its Conversions API, on wiweb.io and in the dashboard, only with your consent to advertising. DPF (Meta Platforms, Inc.).

7. International transfers

Several providers are in the United States. Where the provider is certified under the EU-US Data Privacy Framework, the transfer is covered by the European Commission’s adequacy decision of 10 July 2023; in the other cases (Supabase and OpenAI), by the European Commission’s Standard Contractual Clauses together with the corresponding transfer impact assessment. The database and files of your account and your page are stored in the European Union (Ireland). Transfers to the United Kingdom are covered by its adequacy decision.

8. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent at any time, by writing to privacidad@wiweb.io. We respond within one month. We may ask you to prove your identity. You can also lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es), which is the controller’s supervisory authority.

9. Security

We apply technical and organisational measures appropriate to the risk: encryption of traffic (TLS) on all sites, including customers’ pages; isolation of each customer’s data through row-level access control in the database; least-privilege access; hashed summaries instead of IP addresses; a change history and copies of each page that allow previous versions to be restored; rate limiting; and a mechanism for immediately suspending abusive pages.

10. Changes

We will publish any update to this policy on this page, stating the date of the latest version, and we will notify customers of substantial changes by email.