Privacy Policy

Who we are

The data controller for Laspi Pro ('Laspi Pro', 'we', 'us') is GradeBuilder S.L. (CIF B75608927), Santiago de la Ribera, Murcia, Spain — org@laspi.pro, +34 622 448 805. This policy covers the Laspi Pro website, the Laspi Pro web app and the Laspi Pro Android app.

Data we collect

We collect only what we need to create your content and run the service:

• Account & identity — your name, email address and profile picture, received from Google when you sign in with Google, plus your chosen interface and content languages.
• Your business profile — the business name, description, industry, audience, tone and links you enter during onboarding.
• Content you provide — photos and images you upload, voice recordings you dictate, and any text notes you write.
• Content we generate for you — the captions, images and short videos Laspi Pro produces from your materials.
• Device & notifications — your device push token (so we can tell you when content is ready), app version, device model and operating system, and basic diagnostic logs.
• Usage data — actions you take in the app and generation records (which AI model was used, length, and cost) needed to operate and bill the service.
• Payment data — your plan, subscription status and a customer/subscription identifier from our payment provider, Stripe. Card details are entered on and handled by Stripe; we never see or store full card numbers.

Connected accounts: what we store

You can connect an account so that Laspi Pro publishes on your behalf. Nothing is connected by default, connecting is always your explicit action, and one button disconnects it again. Every credential below is stored encrypted at rest.

• LinkedIn — your name, your LinkedIn member identifier, your email address and an access token valid for 60 days, obtained through LinkedIn's own sign-in screen. We never receive or ask for your LinkedIn password. Revoke: «Disconnect» in Laspi Pro, and at any time in LinkedIn under Data privacy → Permitted services.
• Telegram — the identifier of the channel you added our bot to and, if you choose to use your own bot instead of ours, that bot's token. Your Telegram account password is never involved. Revoke: remove the bot from the channel's administrators, or «Disconnect» in Laspi Pro.
• Bluesky — your handle and an APP PASSWORD. This is not your account password: you create it in Bluesky under Settings → Privacy and Security → App Passwords, it cannot change your password or delete your account, and you can revoke it there at any moment. Revoke: delete the app password in Bluesky, or «Disconnect» in Laspi Pro.
• WordPress — your site address and an application password issued by our plugin. Revoke: remove it in the plugin or in your WordPress profile.

What we send to a platform when you publish

This is the part worth reading closely. When you press «Publish» (or schedule a post and the scheduled time arrives), we transmit to that platform: the text of the post, the image or video attached to it, the time of publication, and the identifier of your connected account, channel or site. We send nothing else, and we send nothing at all to a platform you have not connected.

From that moment the platform processes this data as an INDEPENDENT CONTROLLER under its own terms and privacy policy — not as our processor. Today that means LinkedIn Ireland Unlimited Company, Telegram FZ-LLC, Bluesky Social PBC and, for a self-hosted site, your own WordPress installation. When we add publishing to Meta (Facebook, Instagram), Google Business Profile or another network, the same rule applies to Meta Platforms Ireland Limited, Google Ireland Limited and their equivalents, and this list is updated before the first post is sent.

A published post is public and it leaves our control. We cannot withdraw it from the platform afterwards: disconnecting stops all future publishing, but an already-published post is deleted in the platform itself.

Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR) — you instruct us to publish, and transmitting the post is how that instruction is carried out. Connecting an account is entirely optional and you withdraw it by disconnecting; the service works without any connection, with you publishing manually.

Some of these platforms are established or process data outside the European Economic Area. That transfer is governed by the platform's own terms, which you accept with that platform; we transmit only what is needed to publish the content you asked us to publish, and never for advertising, profiling or audience matching.

What we do NOT do

We never ask for the password of your social-media ACCOUNT. Where a network has no other way in, we use a revocable app password that you create and can delete on that network at any time (Bluesky, WordPress) — it cannot change your password or delete your account. We do not sell your personal data, we do not use it for cross-context behavioural advertising, and we never hand your data to a network you have not connected.

Device permissions

The Android app asks for these permissions, and uses them only for the stated purpose. You can decline or revoke any of them in your system settings:

• Microphone — only while you actively record a voice note to describe what's new this week.
• Photos / media — only to let you pick the photos you want to upload for your content.
• Notifications — to let you know when your weekly content is ready and to send periodic reminders, which you can turn off anytime in settings or via the unsubscribe link in every email.

How we use your data

• To create your weekly content plan, captions, images and videos.
• To provide, secure, maintain and improve the service.
• To process payments and manage your subscription.
• To send service messages and periodic reminders you can opt out of at any time.
• To provide support and to comply with our legal and accounting obligations.

Legal bases (GDPR)

We rely on: performance of our contract with you; your consent (e.g. notifications and non-essential cookies); our legitimate interests in running, securing and improving the service; and compliance with legal obligations.

How we share data

We share data only with service providers (sub-processors) that process it on our behalf under data-processing agreements:

• Networks you connected yourself (LinkedIn, Telegram, Bluesky, your WordPress; later Meta and Google Business Profile) — these are NOT our processors: they receive your post as independent controllers. See «What we send to a platform when you publish» above.
• Hosting & database — Railway.
• File storage & delivery — Cloudflare R2.
• Sign-in & push — Google (Google Sign-In; Firebase Cloud Messaging for Android notifications).
• Payments — Stripe.
• AI processing (to transcribe your voice and generate text, images, video and voice-over) — fal.ai, xAI, ElevenLabs and large-language-model providers including Anthropic, Moonshot AI and DeepSeek.
• Website analytics — Google Analytics, loaded only if you accept analytics cookies.

International transfers

Some of these providers process data outside the European Economic Area (for example, in the United States). Where they do, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

How long we keep it

We keep your data while your account is active and for as long as needed for legal, tax and accounting purposes, after which we delete or anonymise it. Backups expire on a rolling schedule.

How to delete your data

You can delete your account and its data at any time:

• In the Android app: Profile → Delete account.
• On the web: Profile → Delete account.
• Or email us at org@laspi.pro and we'll do it for you.

Deletion — what happens

Deleting your account permanently removes your profile, your business projects, the photos and voice notes you uploaded, and the content we generated for you, and cancels any active subscription — subject only to limited legal/accounting retention and backups that expire on a rolling basis.

Security

We protect your data with encryption in transit (HTTPS), access controls, and time-limited signed URLs for media. No method of transmission or storage is 100% secure, but we work to protect your information and to notify you of incidents where required by law.

Children

Laspi Pro is a business tool and is not directed to children under 16. We do not knowingly collect personal data from children; if you believe a child has provided us data, contact us and we will delete it.

Your rights

You can access, correct, delete, restrict or port your data, object to processing, and withdraw consent at any time — just contact org@laspi.pro. You also have the right to complain to your local data-protection authority (in Spain, the AEPD, www.aepd.es).

Changes to this policy

We may update this policy from time to time. We'll change the 'Last updated' date above and, for material changes, let you know in the app or by email.

Contact

Questions about your privacy? Write to us at org@laspi.pro. GradeBuilder S.L. (CIF B75608927), Santiago de la Ribera, Murcia, Spain — org@laspi.pro, +34 622 448 805.