Privacy Policy

In compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Spanish LOPDGDD 3/2018, we inform you that your data is processed under a Joint Controllership agreement (Art. 26 GDPR) between: * Service Provider & Legal Holder: SMART IBÉRICA de Impulso Empresarial S. Coop. And. (Fiscal ID: F-90065418), based in Avenida Blas Infante 6, 2 planta 41011, Sevilla, Spain. Registered in the Register of Cooperatives of Andalusia. * Project Operational Manager: Iván Turatti, working partner of SMART IBÉRICA. SMART IBÉRICA and the Project Manager act as Joint Controllers of the personal data associated with the management of the website and the services offered through it. For any privacy-related matters, the single point of contact is: support@openidea.biz

Information we collect falls into two categories: “voluntarily provided” information and “automatically collected” information. ### A. Voluntarily Provided Information * Account Data: Name, email address, payment details (processed securely by Stripe/PayPal). * AI Inputs (Prompts): Text or data you input into the yOCA assistant. * Communications: Data provided when you contact support, book a session, or fill out forms. ⚠️ **Special Categories of Data (Sensitive Data):** In the context of using the yOCA assistant, you may voluntarily provide information that falls into “Special Categories” under Art. 9 GDPR (e.g., health, political opinions, religious beliefs). Important: These data are not required for the service. They will be processed exclusively if you voluntarily provide them in your prompts. By submitting such data, you provide your explicit consent (Art. 9.2.a GDPR) for its processing solely to generate the requested AI response. You may withdraw this consent at any time by deleting the chat history. ### B. Automatically Collected Information * Log Data: IP address, browser type, pages visited, time spent. * Device Data: Device type, operating system, geo-location (country level). * Cookies: See our Cookie Policy for details.

We process your personal information for the following specific purposes and legal bases: | Purpose | Legal Basis (GDPR) | | :--- | :--- | | **Service Provision:** Providing access to yOCA, managing accounts, processing payments. | Contractual Necessity (Art. 6.1.b) | | **Hybrid Support (eXtra Power Sessions):** Human review of AI outputs to provide the consulting services included in your plan. | Contractual Necessity (Art. 6.1.b) | | **Marketing & Communications:** Sending newsletters, updates, or managing contests/giveaways. | Explicit Consent (Art. 6.1.a) | | **Quality Assurance & Prompt Engineering:** Analyzing chat logs (aggregated/anonymized where possible) to identify logic errors and optimize system instructions. | Legitimate Interest (Art. 6.1.f) | | **Security & Fraud:** Detecting bots, preventing abuse. | Legitimate Interest (Art. 6.1.f) | | **Legal Compliance:** Tax and accounting obligations. | Legal Obligation (Art. 6.1.c) |

To ensure transparency regarding how we improve yOCA, we distinguish between “Model Training” and “System Optimization”: * **NO Model Training:** We do not use your data to train, fine-tune, or modify the neural weights of foundational AI models (LLMs). Your data is not fed back into the public knowledge base of providers like OpenAI or Google to train their general models. * **Prompt Engineering & QA:** We process chat logs solely to identify logical errors, “hallucinations,” and to refine the system instructions (prompts). This processing is based on our Legitimate Interest to ensure the security, accuracy, and quality of the service provided. * **Human-in-the-Loop:** Authorized human operators (the Project Manager) may review chat logs primarily when triggered by a support request, a scheduled “eXtra Power Session,” or for anonymized quality assurance spots-checks.

We may disclose personal information to the following trusted third parties (Data Processors) strictly for service provision: * **Hosting & Infrastructure:** Google Cloud (Google Cloud Run), 20i (Web Hosting provider). * **Payment Processors:** Stripe, PayPal. * **AI Platform & Providers:** Pickaxe (platform), OpenAI / Google (model providers via Enterprise API). * **Marketing & Communications:** SendFox, MailPoet (newsletters), KingSumo (giveaways/contests), FormSubmit.co (Email processing). * **Scheduling & Operations:** TidyCal (booking eXtra Power Sessions), Forminator (form processing), AppSumo Connect (Automation & Webhooks). * **Analytics:** Google Analytics. * **Legal Authorities:** Courts, tribunals, or regulatory authorities, strictly if required by law.

When you utilize the provided prompts, JSON files, or configurations (referred to as “yOCA+”) on your own personal or business AI accounts (e.g., OpenAI ChatGPT, Anthropic Claude, Google Gemini), the following applies: * **Transfer of Control:** Once you download the files and import them into your third-party account, you become the sole Data Controller for any subsequent interactions. * **No Access:** OPENIDEA.biz does not have access to, nor does it store, the conversations you have with your self-hosted yOCA+ assistant. * **Third-Party Governance:** Those interactions are governed exclusively by the privacy policy and terms of service of the AI platform provider you have chosen (e.g., OpenAI, Anthropic).

Your personal information may be transferred to countries outside the European Economic Area (EEA), specifically to the United Kingdom (for hosting services) and the United States (for AI and payment tools). These transfers are secured under the EU-U.S. Data Privacy Framework (DPF), the UK Adequacy Decision, or, where applicable, Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring an adequate level of protection.

We keep your personal information only for as long as needed: * **Account Data:** While the account is active + statutory limitation periods (e.g., 5 years for tax records). * **AI Chat Logs:** Retained for the duration of the service relationship to allow for consulting sessions and history access, then deleted.

Under the GDPR, you have the following rights: * **Access:** Request a copy of the data we hold about you. * **Rectification:** Correct inaccurate data. * **Erasure (Right to be Forgotten):** Request deletion of your data (subject to legal retention obligations). * ⚠️ **Impact on Service:** Please be aware that deleting your account or chat logs is irreversible and will result in the loss of your “yOCA” history and context. Consequently, we will be unable to provide “eXtra Power Sessions” or consulting support based on your previous work, effectively resetting your path. * **Restriction:** Limit how we use your data. * **Portability:** Receive your data in a structured format. * **Objection:** Object to processing based on legitimate interest (e.g., you may object to your logs being used for general prompt optimization, though this may limit our ability to provide technical support for specific errors). To exercise these rights, contact us at: **support@openidea.biz**

If you believe we have breached data protection laws, you have the right to lodge a complaint with the competent supervisory authority. * **Spain:** Agencia Española de Protección de Datos (AEPD) – www.aepd.es

We may update this privacy policy to reflect changes in our business processes or legislative changes. We will notify registered users of significant changes.