Privacy Policy

This policy explains what personal data we process at Polimake, what for, on what legal basis, for how long and with whom we share it, in accordance with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Spanish Organic Law 3/2018 (LOPDGDD). The basics are at the top; the details follow.

Basic information

1. Controller

NEBULAR MEDIA SLU (owner of the Polimake brand) Tax ID B56931686 · Calle Platería 6, Piso 2B, 30004 Murcia, Spain Data protection contact: dpo@polimake.com

2. When we are controller and when we are processor

• We are the controller of the data we process for our own purposes: your account, billing, security, support, communicating with you, measuring the website and ads, and our professional contacts. This policy covers that data.
• We are a processor of the personal data you upload about other people: your clients, the people who appear in your images and videos, or your team members. In that case you decide, as controller, and we process it only to provide the service to you, under the Data Processing Agreement, which forms part of the Terms of service.

3. What we use your data for, on what basis and for how long

Blocking. When data is no longer needed, before deleting it we block it if the law requires us to keep it: it remains available only to judges, courts, the Public Prosecutor and the competent authorities, until liabilities lapse (art. 32 LOPDGDD). Then we delete it.

We do not process special categories of data for our own purposes.

4. Artificial intelligence

• Where we use Google's Gemini:
  • in the design agent, to understand what you ask and create the designs;
  • in the cloud, to analyze the images you upload and generate the tags and descriptions you later find them by. From that analysis we build a search-by-meaning index (semantic search), hosted in the EU;
  • in the photo demo at polimake.com/hi, to analyze the photo you choose. That photo is not stored.
• Paid tier and no training. We use Gemini under Google's paid terms. Under them, Google does not use what we send it (instructions, files or responses) to train or improve its models. It only logs it for a limited time, to detect and prevent prohibited uses, and it may cache it transiently in any country. Google acts as a processor.
• We do not train either. We never use your files or what the AI generates for you to train artificial intelligence models.
• On your computer. The desktop app transcribes audio on your device with Whisper: the audio never leaves your computer. Its AI is your own Claude account (from Anthropic) or Codex account (from OpenAI): what you share with them is governed by your contract with those companies and does not go through our servers.
• Connected assistants. If you connect ChatGPT, Claude or another assistant to your projects, that assistant accesses what you authorize, and is governed by its own terms and privacy settings.
• No automated decisions. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

5. Whom we share data with

Providers that process data on our behalf (processors). All of them have signed a data processing agreement with us under Article 28 GDPR and may only use the data to provide their service to us.

To charge paid plans we use Stripe (Stripe Payments Europe, Ltd., Ireland): it processes payment data on our behalf and, for its own fraud-prevention and financial-regulation obligations, as a controller. To send you service emails we use an email delivery provider, under a data processing agreement and with the same safeguards; if you want to know which one, ask us at dpo@polimake.com.

Ad networks. When you sign up, we tell the ad network that brought you, to know which campaigns work. We also share data with them if you accept marketing cookies or tick the optional checkbox on a resource form. Each one decides what it does with the data, as controller under its own terms; in some cases we are joint controllers with them for the transmission.

We send ad networks your hashed email (SHA-256), your IP address, your browser and the ad click identifier. Never your content.

Other recipients:

• The social networks you decide to publish to from Studio (YouTube, Instagram, TikTok or LinkedIn) receive what you publish and your connection data. Each network is the controller of that data under its own terms.
• The people you share content with, through invitations or links, see what you share.
• The assistants you connect see what you authorize.
• The authorities, when a law requires us.

We do not sell or rent your data.

6. International transfers

Your files, your account and everything we process are stored and processed in the European Union. The only exception today is sign-in (Auth0), which is in the USA and which we are moving to the EU. When a provider processes data outside the European Economic Area, it does so under the EU-U.S. Data Privacy Framework (DPF), if the company participates, or under the standard contractual clauses approved by the European Commission (Decision 2021/914), with supplementary measures where needed. You can ask us for a copy of those safeguards at dpo@polimake.com.

7. Professional contacts from public sources

If you are a professional in the creative or communications sector, we may hold your professional contact details even if you did not give them to us.

• Where they come from: publicly available sources, such as company websites and professional directories.
• What data: first and last name, job title, company, professional email and phone, company website, sector and town.
• What for: to know the companies in the sector and, where it makes sense for your professional activity, to introduce Polimake to them. We will not send you commercial communications by email without your consent. Before any direct marketing we check advertising opt-out registers, such as the Spanish Lista Robinson.
• Legal basis: our legitimate interest (art. 6.1.f GDPR), which the law presumes for professional contact data used only to reach you at work (art. 19 LOPDGDD).
• Your right to object: write to dpo@polimake.com and we will delete your data, keeping only the minimum needed not to include you again.
• For how long: until you object or, at most, 2 years without any professional contact with you.
• Notice: we inform you of all this within one month of obtaining your data or at our first communication with you, if sooner.

8. Minors

Polimake is for people aged 18 and over and is not aimed at minors. If we find out that an account belongs to a minor, we close it and delete its data. If you know of a case, let us know at dpo@polimake.com.

9. Your rights

You can exercise these rights at any time, free of charge, by writing to dpo@polimake.com:

• access your data;
• rectify inaccurate data;
• erase it when it is no longer needed;
• object to processing based on our legitimate interest and, always, to direct marketing;
• restrict processing;
• port your data in a structured format;
• withdraw your consent, without affecting what was done before.

We reply within one month, which may be extended by two further months in complex cases (we would tell you). We will only ask you to prove your identity if we have reasonable doubts about who you are.

If you are not satisfied, you can complain to the Spanish Data Protection Agency (AEPD, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es).

10. Security

We apply technical and organizational measures appropriate to the risk: encrypted communications (TLS), role-based access control with least privilege, logging of sensitive operations, regular backups, and hashed summaries instead of IP addresses where they are enough. Our team only accesses your data when needed. If we suffer a security breach, we will notify the AEPD within 72 hours and tell you if it poses a high risk to you.

11. Cookies

Today we only use necessary cookies: the website stores or reads nothing optional in your browser, which is why you see no cookie notice. If we ever add analytics or marketing cookies, we will ask you first with a notice. The details are in the cookie policy. Inside the app, product usage measurement uses no cookies and stores nothing in your browser (section 3).

12. Changes to this policy

If we change this policy, we update its date. If the change is relevant, we notify you by email or in the app before it applies.

Applicable version. This text is an English translation. If the versions differ, the Spanish version prevails.

---

Related documents: Terms of service · Data Processing Agreement · Cookie policy · Legal notice