Privacy policy

• Controller: Plaka Studio S.L. (Bixlow)
• Tax ID (NIF): B21978960
• Address: Plaza de Camilo Díaz Baliño, 17, Bajo, 15704 Santiago de Compostela (A Coruña), España
• Privacy contact: bixlow@plakastudio.com

• Account: email, profile name, language, workspaces, projects and permissions.
• App usage: sign-in records, project activity and AI usage (tokens consumed).
• Content you give us: workflows, briefs, hypotheses, attachments and conversations with the AI assistant.
• Billing: billing and plan details. Stripe handles card data; Bixlow receives payment references and status, not full card numbers or security codes.
• Contact and leads: what you send through the contact form, demo requests or the blog's email capture.
• Consent evidence: date, accepted version, IP address and browser.
• Browsing: IP address, browser and website and app interaction data when analytics is configured, subject to the options and operation described in the Cookie policy.

The assistant sends messages, history and project context needed for each request to the AI provider. We retain conversations and usage logs. If observability is enabled, metrics and identifiers are also recorded; input and output capture may record content when expressly enabled.

• Providing the service and managing your account, projects and plan.
• Authenticating you and protecting the service against abuse and fraud.
• Charging, invoicing and meeting accounting and tax obligations.
• Answering your questions and support or demo requests.
• Diagnosing problems and improving the product; analytics using non-essential storage depends on your consent.
• Sending you product news and marketing communications, if you agree.

• Contract and requested pre-contractual steps: registration, service delivery, support, billing and demo requests. When you represent a business, we use your professional contact details on the legitimate interest of managing that relationship.
• Legal obligation: accounting and tax obligations and legally binding requests.
• Legitimate interest: protecting accounts and systems, preventing abuse, diagnosing errors and defending claims, balancing those purposes against your rights.
• Consent: marketing communications and non-essential analytics storage. You may withdraw it without affecting prior processing.

Reading this policy does not consent to all processing. Data needed for an account or subscription is required to provide those functions; marketing is optional and declining it does not prevent service use.

We do not sell your data. We use AWS for hosting in Europe, an email provider, Stripe for payments and Anthropic for AI to deliver the service; we use Google for analytics on our website and app when configured. The providers and subprocessors page describes their functions and details awaiting confirmation.

Their roles differ: Stripe may act as an independent controller for its legal obligations, fraud prevention and certain payment services. Authorised workspace members can access shared content according to their permissions. We may also disclose data to authorities when legally required.

International providers may process or access data outside the European Economic Area. A company’s or server’s location does not guarantee that all access takes place there. Each transfer requires a valid mechanism: an applicable adequacy decision or safeguards such as standard contractual clauses, with any necessary assessments and supplementary measures. The EU-US Data Privacy Framework only applies to currently certified entities and covered processing. Contact bixlow@plakastudio.com for information about countries, applicable mechanisms and a copy of safeguards, subject to necessary confidentiality protections.

• Account and content: for as long as needed for the relationship and service. Deleting your account does not mean deleting shared project content that must remain available to other authorised members. Data processed on a customer’s behalf is governed by the DPA.
• Billing and business records: for the applicable statutory periods; business records generally require six years of retention, subject to other periods or interruptions of limitation periods.
• Acceptance, security and claims evidence: for as long as needed to demonstrate obligations and address liabilities, with restricted access where appropriate.
• Enquiries: until resolved and, where appropriate, for the period needed to manage the relationship or potential claims. Marketing: until consent is withdrawn; minimal suppression evidence may be retained to honour the withdrawal.
• Cookies and browser storage: as described in the Cookie policy.

Backups and logs require their own deletion cycles; deleting an account does not mean all copies disappear instantly.

You may request access, rectification, erasure, restriction, portability or objection, where applicable, by contacting bixlow@plakastudio.com. You do not need an account: we only request proportionate additional information if there are reasonable doubts about your identity. We respond within one month; if complexity or the number of requests requires up to two further months, we will inform you during the first month. You may withdraw consent at any time.

You may complain to the Spanish Data Protection Agency (www.aepd.es) or the competent supervisory authority without first having to exhaust a complaint with us.

Bixlow is a service for professionals and is not aimed at anyone under 18. If we learn that we have received a minor's data, we will delete it.

We apply technical and organizational measures such as encryption in transit, role-based access control, per-customer isolation in the database (row-level security) and encryption of Bixlow Functions secrets. No system is infallible: if a breach affects you, we will tell you as the law requires.

We only send marketing communications with your consent. You can withdraw it by contacting bixlow@plakastudio.com; marketing messages must also offer a simple, free way to unsubscribe. Opting out of marketing does not affect necessary messages about security, billing or operation of your service.

When a customer installs Bixlow, we process pseudonymous browser identifiers, experiment variants, events, conversions, URLs, referral information, technical data, IP addresses and approximate network-derived location on their behalf. A random identifier does not make that data anonymous. The customer determines goals, audiences and any additional data it configures.

Address requests about a customer’s website to its operator; if you send them to us, we will assist under the DPA. Segmentation and tests can personalise what a visitor sees; customers must assess whether their configuration involves profiling or automated decisions with significant effects and meet the resulting obligations.

If we change this policy materially, we will notify you by email or in the app. The date of the last update appears above.

To exercise your rights or ask about this policy, write to bixlow@plakastudio.com.