1. Introduction and Data Controller This Privacy Policy establishes how Aquí Está el Pato, S.L. (hereinafter, "Carmen AI", "we" or "the company") collects, uses, stores, and protects the personal information of Carmen AI application users.
Controller Data: Corporate name: Aquí Está el Pato, S.L. Registered address: Mercedes Formica 1, Portal 11, 2A Tax ID: B86353836 Contact email: contacto@carmenai.org Data Protection Officer: contacto@carmenai.org
This policy complies with the General Data Protection Regulation (GDPR) EU 2016/679 and Spanish data protection legislation.
2. Types of Data Collected and Legal Basis
2.1 Registration Data (Legal Basis: Legitimate Interest) Data collected:
- Name and surname
- Gender
- Email address
- Date of birth
Purpose: Service personalization and user account management. Legitimate interest: Providing personalized service and maintaining application functionality.
2.2 Usage Data and Conversations (Legal Basis: Legitimate Interest) Data collected:
- Complete history of conversations with artificial intelligence
- Food product scanning history
- Application usage patterns
- User preferences and settings
Purpose: Improving technical functionality of the application and offering personalized suggestions. Legitimate interest: Service optimization and functionality development.
2.3 Technical Data (Legal Basis: Legitimate Interest) Data automatically collected:
- IP address
- Device type and operating system
- Access and usage logs
- Application performance data
- Error and technical failure information
Purpose: Security, technical maintenance, and fraud prevention. Legitimate interest: Ensuring service security and stability.
2.4 Voluntarily Provided Data Optional data:
- Product comments and ratings
- Food product photos
- Any additional information provided in conversations
Legal basis: Implied consent through voluntary use of these functionalities.
3. Processing Purposes Personal data is processed exclusively for the following purposes:
3.1 Primary Purposes
- Service provision: Application operation and its features
- Personalization: Adaptation of recommendations and suggestions
- AI processing: Analysis of conversations and images to generate responses
- Account management: Authentication and user profile administration
3.2 Secondary Purposes
- Service improvement: Usage analysis for technical optimization
- Security: Fraud detection and platform protection
- Technical support: Incident resolution and user assistance
- Legal compliance: Response to legal and regulatory requirements
3.3 Exclusions Carmen AI does NOT use personal data for:
- Direct marketing or advertising
- Sale or transfer to third parties for commercial purposes
- Automated profiling with legal effects
- Purposes other than specified without additional consent
4. Sharing with Third Parties and Providers
4.1 Artificial Intelligence Service Providers
OpenAI (United States)
- Data shared: AI conversations and product images
- Purpose: Natural language processing and image analysis
- Guarantees: EU-approved Standard Contractual Clauses (SCC)
Anthropic (United States)
- Data shared: Conversation text for AI processing
- Purpose: Artificial intelligence services and language processing
- Guarantees: EU-approved Standard Contractual Clauses (SCC)
Google AI Services (United States)
- Data shared: Data for analysis and additional AI services
- Purpose: Complementary artificial intelligence services
- Guarantees: EU-approved Standard Contractual Clauses (SCC)
4.2 Infrastructure Providers
Firebase/Google Authentication (United States)
- Data shared: Authentication data and user management
- Purpose: Secure authentication and account management
- Guarantees: EU-approved Standard Contractual Clauses (SCC)
Amazon Web Services - AWS (Ireland)
- Data shared: All data stored in the application
- Purpose: Hosting, storage, and infrastructure services
- Guarantees: Servers located in the European Union (Ireland)
4.3 Mandatory Disclosure Data may be disclosed when legally required:
- Court orders or requests from competent authorities
- Compliance with legal obligations
- Protection of rights, security, or property of Carmen AI or third parties
- Emergency situations requiring protection of persons
5. International Data Transfers
5.1 Destination Countries
- United States: OpenAI, Anthropic, Google AI, Firebase
- European Union (Ireland): Amazon Web Services
5.2 Applied Guarantees For transfers to the United States:
- EU-approved Standard Contractual Clauses (SCC)
- Contractual clauses guaranteeing protection level equivalent to GDPR
- Provider commitment to comply with European protection standards
For transfers within the EU:
- Direct application of GDPR
- Servers located in Ireland (EU jurisdiction)
5.3 Your Rights in Transfers You have the right to:
- Obtain information about applied guarantees
- Request copy of contractual clauses
- File complaints with the supervisory authority
6. Data Retention
6.1 Retention Criteria Active users:
- Data is retained while you maintain your active account
- Periodic review of retention necessity
After account deletion or inactivity:
- Grace period: 1 year from last activity or account deletion
- Definitive deletion: After one year, complete and secure deletion
- Security data: Technical logs retained up to 3 years for security
6.2 Secure Deletion
- Irreversible deletion of personal data
- Secure deletion protocols in all systems
- Deletion confirmation in third-party systems
7. Data Security
7.1 Implemented Technical Measures
- Encryption: Password and sensitive data encryption
- Authentication: Two-factor authentication systems available
- Access control: Restricted and authenticated access to personal data
- Secure infrastructure: Use of AWS services with security certifications
7.2 Organizational Measures
- Security audits: Quarterly security system reviews
- Staff training: Regular data protection training
- Internal policies: Strict personal data handling procedures
- Incident response: Security breach response protocols
7.3 Breach Notification In case of security breach affecting personal data:
- Notification to competent authorities within 72 hours
- Communication to affected users if high risk exists
- Immediate containment and remediation measures
8. Your Rights as a User According to GDPR, you have the following rights:
8.1 Right of Access (Art. 15 GDPR)
- Obtain confirmation about whether we process your data
- Access your personal data and processing information
- Receive copy of your personal data
8.2 Right of Rectification (Art. 16 GDPR)
- Correct inaccurate personal data
- Complete incomplete personal data
8.3 Right of Erasure (Art. 17 GDPR) Deletion of your personal data when:
- No longer necessary for original purposes
- You withdraw consent (when it's the legal basis)
- Data has been unlawfully processed
- Necessary to comply with legal obligation
8.4 Right to Restriction of Processing (Art. 18 GDPR) Suspend processing when:
- You contest data accuracy
- Processing is unlawful but you prefer restriction instead of erasure
- You need data for legal claims
8.5 Right to Data Portability (Art. 20 GDPR)
- Receive your data in structured, machine-readable format
- Transmit this data to another controller when technically possible
8.6 Right to Object (Art. 21 GDPR)
- Object to processing based on legitimate interest
- Object at any time to processing for direct marketing
8.7 Exercise of Rights How to exercise your rights:
- Email: contacto@carmenai.org
- Subject: "GDPR Rights Exercise"
- Required information: Clear identification and right specification
Response timeframes:
- Initial response: 30 days from request
- Possible extension: 60 additional days in complex cases
- No cost to user (except excessive requests)
9. Minors
9.1 Minimum Age
- Carmen AI is not directed at minors under 16 years
- Minors under 16 cannot create accounts
- Age verification through date of birth
9.2 Minor Detection If we detect we have collected data from minors under 16:
- Immediate deletion of account and associated data
- Contact with legal guardians if possible
- Implementation of additional preventive measures
9.3 User Responsibility Users declare and guarantee that they:
- Are over 16 years old
- Provide truthful information about their age
- Do not provide access to minors under 16
10. Changes to Privacy Policy
10.1 Modifications Carmen AI reserves the right to modify this privacy policy when necessary to:
- Comply with legislative changes
- Improve clarity and transparency
- Reflect changes in our processing practices
10.2 Change Notification Minor changes: Update in application without specific notification
Substantial changes affecting your rights:
- Email notification to registered users
- Prominent notification in application
- 30-day grace period before application
10.3 Versioning
- Each version includes last update date
- Change history available upon request
11. Supervisory Authority
11.1 Right to Lodge a Complaint You have the right to lodge a complaint with the supervisory authority, especially in the Member State of your habitual residence, place of work, or place of alleged infringement.
11.2 Spanish Supervisory Authority Spanish Data Protection Agency (AEPD)
- Website: www.aepd.es
- Phone: 901 100 099 / 912 663 517
- Address: C/ Jorge Juan, 6, 28001 Madrid
12. Contact and Data Protection Officer
12.1 General Contact For general privacy inquiries:
- Email: contacto@carmenai.org
- Subject: "Privacy Inquiry"
12.2 Data Protection Officer (DPO) For specific data protection matters:
- Email: contacto@carmenai.org
- Subject: "DPO Attention"
12.3 Response to Inquiries
- Response time: Maximum 30 days
- Languages: Spanish and English
- Office hours: Monday to Friday, 9:00 to 18:00 (CET)
By using Carmen AI, you confirm that you have read, understood, and accept this Privacy Policy in its entirety.
This policy forms an integral part of our Terms and Conditions of Use.
