Privacy policy
This explains what personal data we process when you use Audience Seems, why, who we share it with and what you can require of us. No detours and no small print.
1. Data controller
- Controller: BLACK FLAG DESIGN STRATEGY, S.L. (Spanish tax ID B72514565)
- Address: Calle Gaztambide 16, 1A, 28015 Madrid, Spain
- Data protection contact: hola@blackflag.es
2. What data we process
- Account data: email address, name and, if you give it, company or agency. You provide it when you sign up.
- Billing data: name or company name, tax ID and tax address, amount and status of payments. We neither see nor store your card details: Stripe processes them directly.
- Session content: the stimuli you write, the brand and category you name, the transcripts generated and the resulting reports. It is your content; it contains personal data only if you enter it, which the terms of use ask you not to do.
- Usage data: technical access logs, IP address, errors and your plan's consumption, needed to run and protect the service.
- Browsing analytics: only if you accept the analytics cookies. If you decline, no measurement tool is loaded.
- Newsletter and referrals: your email and the associated code, if you subscribe or take part in the programme.
- Correspondence: whatever you write to us and our reply.
3. What we use it for, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and maintaining your account and providing the service you bought | Performance of the contract (art. 6.1.b GDPR) |
| Charging for plans and issuing invoices | Performance of the contract and legal obligation (art. 6.1.b and 6.1.c) |
| Keeping your history of sessions and reports | Performance of the contract |
| Security, abuse prevention and usage limits | Legitimate interest in protecting the service (art. 6.1.f) |
| Answering your support questions | Performance of the contract, or legitimate interest |
| Site usage analytics | Your consent (art. 6.1.a), withdrawable at any time |
| Newsletter and discount codes | Your consent, withdrawable at any time |
| Complying with legal or judicial requirements | Legal obligation |
4. What you write inside a session
The content of the stimuli is sent to the language model providers listed below in order to generate the answers. That is why we ask you not to enter third parties' personal data, confidential information or special categories of data in the questions, brand names or materials you upload. The product is designed to test messages and concepts, not to process information about identifiable people.
If you enter personal data by mistake, write to us and we will remove it from our systems.
5. Who else processes this data
We work with providers acting as processors, under a signed contract and with access limited to what is strictly necessary:
| Provider | What for | Location |
|---|---|---|
| Vercel Inc. | Hosting the application and delivering content | US / EU |
| Supabase, Inc. | Database, authentication and session storage | EU (Frankfurt) |
| Stripe Payments Europe, Ltd. | Payment processing and billing | Ireland / US |
| Anthropic PBC | The language engine that generates the participants' answers | US |
| Google Ireland Ltd. (Gemini) | Language engine for the Demo plan and embedding computation | Ireland / US |
| Google Ireland Ltd. (Analytics) | Site usage analytics, only if you accept the analytics cookies | Ireland / US |
We may also disclose data to the tax authorities, to law enforcement or to the courts where there is a legal obligation to do so. We do not sell personal data, nor share it for advertising purposes.
6. International transfers
Some of these providers are established in the United States or may access the data from there. Those transfers rely on the standard contractual clauses approved by the European Commission and, where the provider is certified, on the EU-US Data Privacy Framework, together with additional technical measures such as encryption in transit and at rest. You can ask us for a copy of the applicable safeguards by writing to hola@blackflag.es.
7. How long we keep it
- Account and sessions: while the account is active. If you delete it, we delete or anonymise the associated data within 30 days at most, except what we must keep by legal obligation.
- Billing: 6 years, under the Spanish Commercial Code, plus the applicable tax limitation periods.
- Technical and security logs: up to 12 months.
- Newsletter: until you unsubscribe.
- Participant learnings with no brand reference: kept in aggregate and unlinked from your account, so they cease to be personal data.
8. Your rights
You can exercise at any time your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you have given, without affecting the lawfulness of processing before the withdrawal.
Write to hola@blackflag.es saying which right you want to exercise. We answer within one month. We may ask you to prove your identity if we have reasonable doubts about who is making the request.
If you believe we have not handled your request properly, you can complain to the Spanish Data Protection Agency: www.aepd.es, C/ Jorge Juan 6, 28001 Madrid.
9. Security
We apply technical and organisational measures proportionate to the risk: encryption in transit, per-account access control, isolation of each customer's data in the database, and logging of administrative access. No system is infallible; if a breach occurred that posed a high risk to your rights, we would tell you and notify the supervisory authority within the legal deadlines.
10. Automated decisions
The participants' answers are generated by a language model, but we do not make automated decisions producing legal effects concerning you and we do not profile you. The archetypes are synthetic characters, not profiles of real people.
11. Minors
The service is not aimed at people under 18 and we do not knowingly collect data from minors. If we identify an account belonging to a minor, we will delete it.
12. Changes to this policy
If we change it, we will update the date in the footer and, where the change is material, we will tell you by email before it takes effect. You can also read the cookie policy and the terms of use.