Privacy Policy
Last updated: October 2026 – Version 1.0
This Privacy Policy explains how AI Psychologist collects, uses, keeps and protects users' personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). Please read it carefully before using our services. It applies to the website https://za.psychologistai.ai and all its services.
1. Data controller
| Controller | CEDIA Investigación y Desarrollo, S.L. (trading as AI Psychologist) |
| NIF / VAT number | B93806404 |
| Address | Av. Aragón 30, 46021 Valencia, Spain |
| Activity | AI-based virtual assistant for emotional well-being |
| support@psicologoia.ai | |
| Website | https://za.psychologistai.ai |
| Applicable law | GDPR (EU) 2016/679 · LOPDGDD 3/2018 |
2. Data we collect and why
We collect different categories of data depending on how the user interacts with the platform:
2.1. Registration and account data
- Name or username.
- Email address.
- Password (stored encrypted, never in plain text).
- Date of registration and last login.
2.2. Usage and conversation data
- Content of the conversations with the AI assistant.
- History of interactions on the platform.
- Technical session data (IP address, device type, browser, operating system).
- Behavioural data on the platform (pages visited, session time).
Special category data – health data (art. 9 GDPR): conversations on the platform may contain information about the user's emotional, psychological or mental health. The GDPR classifies this data as a special category, which requires a higher level of protection.
The legal basis for processing it is the user's explicit consent (art. 9.2.a GDPR), given through a separate checkbox at registration. Users may withdraw this consent at any time without affecting the lawfulness of previous processing.
AI Psychologist does not use this data to make clinical decisions or diagnoses, and does not share it with health systems, insurers, employers or any unauthorised third party.
2.3. Billing and payment data
- Data needed to manage the subscription (processed by Stripe – AI Psychologist does not store card numbers).
- Payment and invoice history.
2.4. Browsing data and cookies
- Own and third-party cookies (see section 7 and the Cookie Policy).
- Meta Pixel for measuring advertising campaigns (see section 5).
- Web analytics data.
2.5. Data we do NOT collect
- We do not knowingly collect data from people under 18.
- We do not store credit card data (handled entirely by Stripe).
- We do not collect biometric data or precise geolocation data.
3. Purposes and legal bases
Each processing activity has a specific purpose and a specific legal basis under article 6 GDPR:
| Purpose | Data | Legal basis (art. 6 GDPR) |
|---|---|---|
| Managing registration and account access | Email, password, username | Performance of a contract (art. 6.1.b) |
| Providing the AI assistant service | Conversations, session data | Performance of a contract (art. 6.1.b) + explicit consent for health data (art. 9.2.a) |
| Managing subscriptions and payments | Billing data, payment history | Performance of a contract (art. 6.1.b) + legal obligation (art. 6.1.c) |
| Transactional communications (registration confirmation, payment notices, etc.) | Performance of a contract (art. 6.1.b) | |
| Commercial communications and newsletter | Email, name | Consent (art. 6.1.a) + art. 21 LSSI |
| Analysing and improving the service | Anonymised usage data | Legitimate interest (art. 6.1.f) |
| Personalised advertising on Meta (Facebook/Instagram) | Browsing data, Meta Pixel, audience lists | Consent (art. 6.1.a) through cookie management |
| Compliance with legal obligations (tax, accounting) | Billing data | Legal obligation (art. 6.1.c) |
| Security, fraud prevention and abuse detection | IP, session data, logs | Legitimate interest (art. 6.1.f) |
4. Data processors and international transfers
To provide the service, AI Psychologist works with the following providers, which act as processors under article 28 GDPR:
| Provider | Function | Country / seat | GDPR safeguards |
|---|---|---|---|
| Anthropic, PBC | Processing of conversations (Claude AI model) | USA / multi-region | DPA + Standard Contractual Clauses (SCCs), modules 2 and 3 |
| Hostinger International Ltd. | Hosting of the platform and web infrastructure | Lithuania (EU) | Within the EEA – no international transfer |
| Stripe, Inc. | Payment processing and subscription management | USA / EU office in Ireland | DPA + SCCs + PCI-DSS certification |
| Brevo (Sendinblue SAS) | Transactional emails and commercial communications | France (EU) | Within the EEA – no international transfer |
| Meta Platforms Ireland Ltd. | Advertising on Facebook and Instagram (Meta Pixel, audiences) | Ireland (EU) / USA | DPA + SCCs + EU-US Data Privacy Framework |
4.1. International data transfers
Some of these providers involve transfers of data outside the European Economic Area (EEA), mainly to the United States. These transfers are based on the Standard Contractual Clauses adopted by the European Commission (Implementing Decision 2021/914) and, in Meta's case, also on the EU-US Data Privacy Framework, adopted by European Commission adequacy decision of July 2023.
4.2. Data retention by Anthropic (API)
AI Psychologist uses the Anthropic API under commercial terms (not a consumer account). Under these terms, Anthropic deletes conversation inputs and outputs within a maximum of 7 days of receipt or generation and does not use API data to train its AI models. Exceptionally, if a conversation is flagged by abuse detection systems, retention may be extended to up to 2 years under Anthropic's acceptable use policy.
5. Social media advertising – Meta Ads
AI Psychologist uses Meta Ads (Facebook Ads and Instagram Ads) to promote its services. This involves the following technologies:
5.1. Meta Pixel
The Meta Pixel is a piece of JavaScript code that AI Psychologist installs on its website. When a user visits the site and has accepted marketing cookies, the pixel collects information about their behaviour (pages visited, actions taken, conversions) and sends it to Meta Platforms for the following purposes:
- Measuring the effectiveness of advertising campaigns (conversions, cost per acquisition).
- Creating Custom Audiences to show ads to users who have already visited the site.
- Creating Lookalike Audiences to reach new users with profiles similar to current ones.
- Optimising ad delivery towards users more likely to convert.
Important: the Meta Pixel should only be activated if the user has given prior consent to marketing cookies. If the user rejects marketing cookies, the pixel must not run and no data will be sent to Meta. Users can withdraw their consent at any time.
5.2. Custom audiences and remarketing
AI Psychologist may share with Meta, in encrypted form (SHA-256 hash), lists of email addresses of users who have given express consent to receive commercial communications. This practice is called Custom Audiences from Customer List and allows specific ads to be shown to those users on Facebook and Instagram.
Users can object to this practice at any time by writing to support@psicologoia.ai or directly from the ad settings of their Facebook account.
5.3. Joint controllership with Meta
In relation to the use of the Meta Pixel, AI Psychologist and Meta Platforms Ireland Ltd. act as joint controllers under article 26 GDPR, in accordance with the Controller Addendum signed with Meta. For more information on how Meta processes data, see Meta's Privacy Policy.
5.4. Express restriction: health data and advertising
AI Psychologist does not use or share with Meta any data from the conversations held on the platform, or any data that could reveal the user's mental or emotional health. The Meta Pixel works only at the level of browsing behaviour (visits, clicks, conversions) and never accesses the content of conversations. This restriction is absolute.
6. Commercial communications and email marketing
AI Psychologist uses Brevo (Sendinblue SAS), a company based in France (EU), to send electronic communications to its users. Brevo acts as processor and has a GDPR-compliant DPA.
6.1. Types of communications
- Transactional communications: registration confirmation, account verification, payment notices, subscription renewal notices and password resets. These are necessary for the performance of the contract and do not require additional consent.
- Commercial communications: newsletters, promotions, service news and useful content on emotional well-being. These require the user's prior, express consent (art. 21 LSSI) and can be cancelled at any time through the unsubscribe link in each email or by writing to support@psicologoia.ai.
6.2. Data processed by Brevo
To send emails, Brevo receives and processes the email address, the user's name and technical delivery metadata (open rate, clicks, bounces). No conversation data is sent to Brevo.
6.3. Opting out of commercial communications
Users can unsubscribe from commercial communications at any time without giving a reason, through:
- The "Unsubscribe" link at the bottom of every commercial email.
- A direct request to support@psicologoia.ai.
- The preference settings in their account.
7. Cookies and tracking technologies
The website uses its own and third-party cookies. The main categories are:
| Category | Purpose | Examples | Consent |
|---|---|---|---|
| Technical / necessary | Basic operation of the site, user session, security | Session cookie, CSRF token | Not required (art. 22.2 LSSI) |
| Analytics | Aggregated analysis of traffic and user behaviour | Google Analytics / own analytics tool | Required |
| Marketing / advertising | Conversion measurement, remarketing, custom audiences | Meta Pixel (_fbp, _fbc) | Required |
| Preferences | Remembering user settings (language, interface preferences) | Interface settings cookies | Required |
For detailed information on the cookies used, their duration and the third parties involved, please see our Cookie Policy.
8. Retention periods
| Data | Retention period | Reason |
|---|---|---|
| Account data (email, name) | Duration of the contractual relationship + 5 years after closing the account | Legal obligation (limitation period for civil actions) |
| Conversation history (platform) | While the account is active, or until deletion is requested | Provision of the service |
| Conversations on Anthropic's servers | Maximum 7 days (commercial API) | Anthropic's retention policy for API customers |
| Billing data | 5 years from the date of the invoice | Tax obligation (Spanish General Tax Law 58/2003) |
| Security and access logs | 12 months | Legitimate interest in security + art. 12 LSSI |
| Email marketing data (subscribers) | Until consent is withdrawn or the user unsubscribes | Consent (revocable) |
| Marketing cookie data (Meta Pixel) | Maximum 90 days for _fbp / _fbc cookies | Meta Platforms policy |
9. Your rights
Users may exercise the following rights against AI Psychologist as controller at any time:
| Right | What it means |
|---|---|
| Access | Confirmation of whether your data is being processed, and access to it. |
| Rectification | Correction of inaccurate or incomplete data. |
| Erasure | Deletion of your data when it is no longer necessary or you withdraw consent. |
| Restriction | Suspension of processing in certain cases. |
| Portability | Receiving your data in a structured, commonly used format to send it to another controller. |
| Objection | Objecting to processing based on legitimate interest or for direct marketing. |
| Withdrawal of consent | Withdrawing your consent at any time without affecting previous processing. |
| Not to be subject to automated decisions | Requesting human intervention in decisions taken solely by automated systems that significantly affect you. |
How to exercise your rights: send an email to support@psicologoia.ai stating the right you wish to exercise and attaching a copy of your identity document. We will reply within a maximum of 30 days of receiving the request.
Complaint to the AEPD: if you consider that the processing of your data does not comply with the law, you have the right to lodge a complaint with the Spanish Data Protection Agency: www.aepd.es.
10. Security measures
AI Psychologist applies appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with article 32 GDPR:
- Encryption of data in transit with TLS 1.2 or higher (HTTPS).
- Encryption of data at rest (databases and backups).
- Passwords stored with secure hash functions (bcrypt or equivalent).
- Access to data restricted to staff with a justified need to know.
- Two-factor authentication for administrative access.
- Regular security audits and vulnerability management.
- A documented procedure for responding to security breaches.
If a security breach poses a risk to users' rights and freedoms, AI Psychologist will notify the AEPD within a maximum of 72 hours of becoming aware of it and will inform the affected users without undue delay, in accordance with article 34 GDPR.
11. Minors
The service is intended exclusively for people aged 18 or over. By registering, users expressly declare that they are of legal age. AI Psychologist does not knowingly collect data from minors. If a user is found to be under 18, the account will be closed immediately and the data deleted.
Under article 7 of the LOPDGDD, processing the data of children under 14 requires the consent of their parents or legal guardians.
12. Changes to this Privacy Policy
AI Psychologist reserves the right to modify this Privacy Policy to adapt it to new legislation, case law or changes in the services provided. Any substantial change will be communicated to users by email at least 15 days before it takes effect. The updated version will always be available on the website, showing the date of the last update.
13. Applicable law and jurisdiction
This Privacy Policy is governed by Spanish law and by European data protection rules. For the resolution of any dispute relating to it, the parties submit to the jurisdiction of the courts and tribunals corresponding to the user's domicile in Spain, without prejudice to the user's right to lodge a complaint with the AEPD.
© AI Psychologist – CEDIA Investigación y Desarrollo, S.L. All rights reserved.