Privacy Policy

1. Data controller

• Owner: Facundo Martin Vega
• Tax ID (NIF): Z2932527D
• Address: Luis Lamarca 22, Valencia, Spain
• Contact email: legal@toolstudio.es
• Website: https://toolstudio.es

2. What data we process

• Account: email address, name (optional) and password. Your password is never stored in clear text, only an irreversible hash.
• Sign-in with Google: the email, name and profile picture that Google shares with us. We never receive your Google password.
• Files you upload to the tools (images, PDF, EPS, SVG, documents, video…): processed only to return the result to you.
• Technical data: IP address and server logs needed for security and abuse prevention.
• Subscription: if you buy ToolStudio Pro, Stripe handles the payment. We never see or store your card details, only your subscription status.

3. Purposes and legal basis

• Creating and maintaining your account and keeping you signed in: performance of the service you request.
• Processing your files with the tools: performance of the service you request.
• Sending verification and password-recovery emails: performance of the service. We do not send marketing without your consent.
• Managing the subscription and invoicing: performance of a contract and legal obligation.
• Security, abuse limiting and fraud prevention: legitimate interest.

4. What happens to your files

Files are processed on our servers and deleted once the result is delivered, or shortly after. We do not review them, share them or use them to train AI models.

5. Cookies and local storage

• Session cookie (technical, necessary): keeps you signed in. It is httpOnly and secure, and lasts 30 days if you choose to stay signed in.
• Browser local storage: keeps your free-trial usage and preferences, such as language, on your device.
• If you sign in with Google, Google may set its own cookies under its privacy policy.
• We currently use no advertising or third-party analytics cookies. If that changes, we will ask first.

6. Who we share data with (processors)

• Vercel Inc.: website hosting.
• Hetzner Online GmbH: servers where files are processed and accounts are stored (data center in Germany, European Union).
• Resend: delivery of verification and password-recovery emails.
• Google Ireland Ltd.: sign-in with Google.
• Stripe Payments Europe Ltd.: collecting the Pro subscription, once active.
• We do not sell your data. Some of these providers may process data outside the European Economic Area under GDPR safeguards (standard contractual clauses or adequacy decisions).

7. Retention

• Account: for as long as you keep it. If you ask us to delete it, we do, except for what the law requires us to keep.
• Billing data: for the period required by tax and commercial law.
• Technical server logs: the minimum time needed for security.

8. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to legal@toolstudio.es. We reply within one month. If you believe we have mishandled your data you can complain to the Spanish Data Protection Agency (www.aepd.es).

9. Children

ToolStudio is not directed at children under 14. If you believe a child has given us data, write to us and we will delete it.

10. Security

We apply reasonable technical measures: encrypted connections (HTTPS), hashed passwords, revocable sessions and rate limits. No system is infallible, but we work to protect your data.

11. Changes to this policy

We may update this policy. The current version, with its date, is always published here, and we will notify you of important changes.