Platform Privacy Policy

This policy governs the processing of personal data of portal account holders (app.bcopilot.ai), for which SOLIDPULSE LABS, SL is the Controller. It does not govern the Customer's End Users' data processed through the Service (that relationship is one of processing, see the DPA). It is governed by the GDPR (EU 2016/679) and the LOPDGDD (Spanish Organic Law 3/2018).

• Company name: SOLIDPULSE LABS, SL · Tax ID (CIF): B27565878.
• Registered office: Avenida Emilio Lemos, 32, Bloque 1, Piso 5, Puerta B, 41020 Seville (Spain).
• Contact: legal@idptrust.com · Data protection: privacy@idptrust.com.
• Data Protection Officer: not designated following an assessment of non-obligation (Art. 37 GDPR); reassessable as processing grows (see DPA cl. 1).

• Account data of Authorized Users (name, email, role; registration with email and password or with single sign-on (Google, SAML, or OIDC), managed by our identity provider) — to create and manage the account, authenticate portal access, provide the Service, and offer support.
• Portal usage data (access logs, IP address, session identifier, browser) — for security, abuse prevention, diagnostics, and Service improvement.
• Billing and payment data (company name, Tax ID/VAT, address, plan, invoice history; card data is processed directly by the payment gateway) — to manage contracting, billing, and compliance with accounting and tax obligations.
• Communications (support inquiries, service notifications and, if you authorize it, marketing) — to address requests, inform of Service incidents/changes and, with consent, news.

We do not process special categories of data intentionally. The Service is intended for businesses and professionals; it is not directed at minors.

• Performance of the contract (Art. 6.1.b GDPR): account management, Service provision, support, and billing.
• Compliance with legal obligations (Art. 6.1.c): accounting and tax obligations.
• Legitimate interest (Art. 6.1.f): Service security, fraud/abuse prevention, and improvement, without overriding the data subject's rights.
• Consent (Art. 6.1.a): marketing communications and non-essential cookies (see portal Cookie Policy).

Data is retained during the term of the relationship and, after its end, for the applicable limitation periods: generally, billing documentation up to 6 years (Commercial Code, Art. 30) and 4 years for tax purposes; access/security logs for a maximum of 12 months; data processed on the basis of consent, until its withdrawal.

We do not share data with third parties except where required by law. To provide the Service we rely on providers acting as processors (Art. 28 GDPR) or, where applicable, as independent controllers:

• Cloud infrastructure and web delivery and protection providers, acting as processors. Data is hosted in the European Union.
• Payment provider, processing payment data as an independent controller and billing data as a processor.
• Email provider, for portal notices (registration, password reset and notifications), as a processor.

Artificial intelligence (Customer's own key): the Service's AI features use the OpenAI key that the Customer itself configures in its workspace. OpenAI is not a processor of SOLIDPULSE LABS, SL: it is a provider contracted directly by the Customer, under its own account and terms. The content the Customer chooses to process with AI (e.g., meeting transcripts) is sent to OpenAI with that key. Without a configured key, no data is sent to OpenAI; the Customer can remove it at any time. More detail in the subprocessor list and the DPA.

If a provider processes data outside the European Economic Area, the transfer relies on an adequacy decision (EU-US Data Privacy Framework) or on Standard Contractual Clauses. The identity of the subprocessors is set out in the List of Subprocessors.

You may exercise the rights of access, rectification, erasure, objection, restriction, and portability, and withdraw consent at any time, by writing to privacy@idptrust.com (or legal@idptrust.com) with the subject 'GDPR Rights'. We will only request identity verification documentation if there are reasonable doubts. You have the right to lodge a complaint with the Spanish Data Protection Authority (www.aepd.es).

SOLIDPULSE LABS, SL applies technical and organizational measures appropriate to the risk, given the state of the art, and reviews them periodically (see Annex II of the DPA).

We may modify this policy to reflect legislative or Service changes, publishing the current version on this page with its updated date.