Privacy Policy
| Data controller | CEDIA Investigación y Desarrollo, S.L. (AI Psychologist) |
|---|---|
| Contact | support@psicologoia.ai |
| Scope | The website https://sg.psychologistai.ai and all its services |
This Privacy Policy describes how AI Psychologist collects, uses, stores and protects users' personal data, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). Please read it carefully before using our services.
1. Data controller
| Company name | CEDIA Investigación y Desarrollo, S.L. |
|---|---|
| Tax ID (NIF / VAT) | B93806404 |
| Address | Av. Aragón 30, 46021 Valencia, Spain |
| Trade name | AI Psychologist |
| Activity | AI-based virtual assistant for emotional wellbeing |
| support@psicologoia.ai | |
| Website | https://sg.psychologistai.ai |
| Applicable regulations | GDPR (EU) 2016/679 · LOPDGDD 3/2018 |
2. What data we collect and why
We collect different categories of data depending on how the user interacts with the platform:
2.1. Registration and account data
- Name or username.
- Email address.
- Password (stored in encrypted form, never in plain text).
- Date of registration and last login.
2.2. Usage and conversation data
- Content of the conversations held with the AI assistant.
- History of interactions on the platform.
- Technical session data (IP address, device type, browser, operating system).
- Behavioural data on the platform (pages visited, session time).
Special category data: health data (Art. 9 GDPR). Conversations held on the platform may contain information about the user's emotional, psychological or mental health. The GDPR classifies this data as a special category, which requires a higher level of protection.
The legal basis for processing it is the user's explicit consent (Art. 9.2.a GDPR), given through a separate checkbox at the time of registration. Users may withdraw this consent at any time without affecting the lawfulness of prior processing.
AI Psychologist does not use this data to make clinical decisions or issue diagnoses, nor does it share it with health systems, insurers, employers or any unauthorised third party.
2.3. Billing and payment data
- Data needed to manage the subscription (processed by Stripe; AI Psychologist does not store card numbers).
- Payment and invoice history.
2.4. Browsing data and cookies
- Own and third-party cookies (see section 7 and the Cookie Policy).
- Meta Pixel for measuring advertising campaigns (see section 5).
- Web analytics data.
2.5. Data we do NOT collect
- We do not knowingly collect data from minors under 18.
- We do not store credit card data (handled entirely by Stripe).
- We do not collect biometric data or precise geolocation data.
3. Purposes of processing and legal bases
Each processing activity has a specific purpose and a specific legal basis under Article 6 GDPR:
| Purpose | Data processed | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Managing registration and account access | Email, password, username | Performance of a contract (Art. 6.1.b) |
| Providing the AI assistant service | Conversations, session data | Performance of a contract (Art. 6.1.b) + explicit consent for health data (Art. 9.2.a) |
| Managing subscriptions and payments | Billing data, payment history | Performance of a contract (Art. 6.1.b) + legal obligation (Art. 6.1.c) |
| Sending transactional communications (registration confirmation, payment notices, etc.) | Performance of a contract (Art. 6.1.b) | |
| Sending commercial communications and newsletters | Email, name | Consent (Art. 6.1.a) + Art. 21 LSSI |
| Analysing and improving the service | Anonymised usage data | Legitimate interest (Art. 6.1.f) |
| Personalised advertising on Meta (Facebook/Instagram) | Browsing data, Meta Pixel, audience lists | Consent (Art. 6.1.a) through cookie management |
| Compliance with legal obligations (tax, accounting) | Billing data | Legal obligation (Art. 6.1.c) |
| Security, fraud prevention and abuse detection | IP, session data, logs | Legitimate interest (Art. 6.1.f) |
4. Data processors and international transfers
To provide the service, AI Psychologist works with the following providers, which act as data processors under Article 28 GDPR:
| Provider | Function | Country / location | GDPR safeguards |
|---|---|---|---|
| Anthropic, PBC | Processing of conversations (Claude AI model) | USA / multi-region | DPA + Standard Contractual Clauses (SCCs), modules 2 and 3 |
| Hostinger International Ltd. | Hosting of the platform and web infrastructure | Lithuania (EU) | Within the EEA, no international transfer |
| Stripe, Inc. | Payment processing and subscription management | USA / EU office in Ireland | DPA + SCCs + PCI-DSS certification |
| Brevo (Sendinblue SAS) | Sending transactional emails and commercial communications | France (EU) | Within the EEA, no international transfer |
| Meta Platforms Ireland Ltd. | Advertising on Facebook and Instagram (Meta Pixel, audiences) | Ireland (EU) / USA | DPA + SCCs + EU-US Data Privacy Framework |
4.1. International data transfers
Some of these providers involve a transfer of data outside the European Economic Area (EEA), mainly to the United States. These transfers are covered by the Standard Contractual Clauses adopted by the European Commission (Implementing Decision 2021/914) and, in the case of Meta, also by the EU-US Data Privacy Framework, adopted by the European Commission's adequacy decision of July 2023.
4.2. Data retention by Anthropic (API)
AI Psychologist uses the Anthropic API under commercial terms (not a consumer account). Under these terms, Anthropic deletes conversation inputs and outputs within a maximum of 7 days of receipt or generation and does not use API data to train its AI models. In the exceptional case that a conversation is flagged by abuse detection systems, retention may be extended to up to 2 years under Anthropic's acceptable use policy.
5. Social media advertising: Meta Ads
AI Psychologist uses Meta Ads (Facebook Ads and Instagram Ads) to promote its services. This involves the following technologies:
5.1. Meta Pixel
The Meta Pixel is a piece of JavaScript code that AI Psychologist installs on its website. When a user visits the site and has accepted marketing cookies, the pixel collects information about their behaviour (pages visited, actions taken, conversions) and sends it to Meta Platforms for the following purposes:
- Measuring the effectiveness of advertising campaigns (conversions, cost per acquisition).
- Creating Custom Audiences to show ads to users who have already visited the site.
- Creating Lookalike Audiences to reach new users with profiles similar to current ones.
- Optimising ad delivery towards users more likely to convert.
Important: the Meta Pixel is only activated if the user has given prior consent through the cookie management panel. If the user rejects marketing cookies, the pixel will not run and no data will be sent to Meta. Users can withdraw their consent at any time from the website's cookie settings.
5.2. Custom audiences and remarketing
AI Psychologist may share with Meta, in encrypted form (SHA-256 hash), lists of email addresses of users who have given their express consent to receive commercial communications. This practice is called Custom Audiences from Customer List and makes it possible to show specific ads to those users on Facebook and Instagram.
Users can object to this practice at any time by writing to support@psicologoia.ai or directly from the ad settings of their Facebook account.
5.3. Joint controllership with Meta
In relation to the use of the Meta Pixel, AI Psychologist and Meta Platforms Ireland Ltd. act as joint controllers under Article 26 GDPR, in accordance with the Controller Addendum entered into with Meta. For more information on how Meta processes data, please see Meta's Privacy Policy.
5.4. Express restriction: health data and advertising
AI Psychologist does not use or share with Meta any data from the conversations held on the platform, nor any data that could reveal the user's mental or emotional health. The Meta Pixel operates only at the level of browsing behaviour (visits, clicks, conversions) and never accesses the content of conversations. This restriction is absolute and cannot be waived.
6. Commercial communications and email marketing
AI Psychologist uses Brevo (Sendinblue SAS), a company based in France (EU), to send electronic communications to its users. Brevo acts as data processor and has a GDPR-compliant DPA.
6.1. Types of communications
- Transactional communications: registration confirmation, account verification, payment notices, subscription renewal notifications, password reset. These communications are necessary for the performance of the contract and do not require additional consent.
- Commercial communications: newsletters, promotions, service news, useful content on emotional wellbeing. These communications require the user's prior and express consent (Art. 21 LSSI) and can be cancelled at any time through the unsubscribe link included in each email or by writing to support@psicologoia.ai.
6.2. Data processed by Brevo
To send emails, Brevo receives and processes: email address, user name and technical delivery metadata (open rate, clicks, bounces). No conversation data is passed to Brevo.
6.3. Opting out of commercial communications
Users can unsubscribe from commercial communications at any time without giving a reason, through:
- The "Unsubscribe" link included in the footer of every commercial email.
- A direct request to support@psicologoia.ai.
- The preference settings in their account panel.
7. Cookies and tracking technologies
The website uses its own and third-party cookies. The main categories are described below:
| Category | Purpose | Examples | Consent |
|---|---|---|---|
| Technical / necessary | Basic operation of the site, user session, security | Session cookie, CSRF token | Not required (Art. 22.2 LSSI) |
| Analytics | Aggregated analysis of traffic and user behaviour | Google Analytics, Microsoft Clarity | Required |
| Marketing / advertising | Conversion measurement, remarketing, custom audiences | Meta Pixel (_fbp, _fbc) | Required |
| Preferences | Remembering user settings (language, interface preferences) | Interface settings cookies | Required |
For more detailed information on the cookies used, their duration and the third parties involved, please see our Cookie Policy. Users can manage or withdraw their consent at any time through the cookie preferences panel.
8. Data retention periods
| Data category | Retention period | Justification |
|---|---|---|
| Account data (email, name) | Duration of the contractual relationship + 5 years after closing the account | Legal obligation (limitation period for civil claims) |
| Conversation history (platform) | While the account is active, or until deletion is requested | Performance of the service |
| Conversations on Anthropic's servers | Maximum 7 days (commercial API) | Anthropic's retention policy for API customers |
| Billing data | 5 years from the date of the invoice | Tax obligation (Spanish General Tax Law 58/2003) |
| Security and access logs | 12 months | Legitimate interest in security + Art. 12 LSSI |
| Email marketing data (subscribers) | Until consent is withdrawn or the user unsubscribes | Consent (revocable) |
| Marketing cookie data (Meta Pixel) | Maximum 90 days for _fbp / _fbc cookies | Meta Platforms policy |
9. User rights
Users may exercise the following rights against AI Psychologist as data controller at any time:
| Right | What it means |
|---|---|
| Access | Obtain confirmation of whether their data is being processed and access it. |
| Rectification | Request the correction of inaccurate or incomplete data. |
| Erasure | Request the deletion of their data when it is no longer necessary or consent is withdrawn. |
| Restriction | Request the suspension of processing in certain cases. |
| Portability | Receive their data in a structured, commonly used format in order to transmit it to another controller. |
| Objection | Object to processing based on legitimate interest or for direct marketing purposes. |
| Withdrawal of consent | Withdraw the consent given at any time, without affecting prior processing. |
| Not to be subject to automated decisions | Request human intervention in decisions made solely by automated systems that significantly affect them. |
How to exercise your rights: send an email to support@psicologoia.ai stating the right you wish to exercise and attaching a copy of your identity document. We will reply within a maximum of 30 days of receiving the request.
Complaint to the AEPD: if you consider that the processing of your data does not comply with current regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos): www.aepd.es
10. Security measures
AI Psychologist applies appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR:
- Encryption of data in transit using TLS 1.2 or higher (HTTPS).
- Encryption of data at rest (databases and backups).
- Passwords stored with secure hash functions (bcrypt or equivalent).
- Access to data restricted to staff with a justified need to know.
- Two-factor authentication for administrative access.
- Periodic security audits and vulnerability management.
- A documented procedure for responding to security breaches.
In the event of a security breach that poses a risk to users' rights and freedoms, AI Psychologist will notify the AEPD within a maximum of 72 hours of becoming aware of it, and will inform the affected users without undue delay, in accordance with Article 34 GDPR.
11. Minors
The service is intended only for persons aged 18 or over. When registering, users expressly declare that they are of legal age. AI Psychologist does not knowingly collect data from minors. If it is detected that a user is under 18, their account will be cancelled immediately and their data erased.
In accordance with Article 7 LOPDGDD, processing the data of minors under 14 requires the consent of their parents or legal guardians.
12. Changes to this Privacy Policy
AI Psychologist reserves the right to modify this Privacy Policy to adapt it to new legislation, case law or changes in the services provided. Any substantial change will be communicated to users by email at least 15 days before it comes into force. The updated version will always be available on the website, showing the date of the last update.
13. Applicable law and jurisdiction
This Privacy Policy is governed by Spanish law and by European data protection regulations. For the resolution of any dispute relating to it, the parties submit to the jurisdiction of the courts and tribunals corresponding to the user's domicile in Spain, without prejudice to the user's right to lodge a complaint with the AEPD.
See also our Legal Notice, Terms of Use and Cookie Policy.