Data controller: CEDIA Investigación y Desarrollo, S.L. (Psychologist AI)
Contact: support@psicologoia.ai
Scope: the website https://in.psychologistai.ai and all its services.
This Privacy Policy describes how Psychologist AI collects, uses, stores and protects users' personal data, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). Please read it carefully before using our services.
| Controller | CEDIA Investigación y Desarrollo, S.L. |
|---|---|
| VAT / NIF | B93806404 |
| Address | Av. Aragón 30, 46021 Valencia, Spain |
| Trade name | Psychologist AI (Psicólogo IA) |
| Activity | Virtual emotional wellbeing assistant based on artificial intelligence |
| support@psicologoia.ai | |
| Website | https://in.psychologistai.ai |
| Applicable rules | GDPR (EU) 2016/679 · LOPDGDD 3/2018 |
We collect different categories of data depending on how the user interacts with the platform:
Special category data — health data (art. 9 GDPR): conversations held on the platform may contain information about the user's emotional, psychological or mental health state. The GDPR classifies this data as a special category, which implies reinforced protection.
The legal basis for processing it is the user's explicit consent (art. 9.2.a GDPR), given by means of a separate checkbox at registration. The user may withdraw this consent at any time without affecting the lawfulness of prior processing.
Psychologist AI does not use this data to make clinical decisions or issue diagnoses, and does not share it with health systems, insurers, employers or any unauthorised third party.
Each processing operation has a specific purpose and a specific legal basis under article 6 GDPR:
| Purpose | Data processed | Legal basis (art. 6 GDPR) |
|---|---|---|
| Managing registration and account access | Email, password, user name | Performance of a contract (art. 6.1.b) |
| Providing the AI assistant service | Conversations, session data | Performance of a contract (art. 6.1.b) + explicit consent for health data (art. 9.2.a) |
| Managing subscriptions and payments | Billing data, payment history | Performance of a contract (art. 6.1.b) + legal obligation (art. 6.1.c) |
| Sending transactional communications (registration confirmation, payment notices, etc.) | Performance of a contract (art. 6.1.b) | |
| Sending commercial communications and newsletters | Email, name | Consent (art. 6.1.a) + art. 21 LSSI |
| Analysing and improving the service | Anonymised usage data | Legitimate interest (art. 6.1.f) |
| Personalised advertising on Meta (Facebook/Instagram) | Browsing data, Meta Pixel, audience lists | Consent (art. 6.1.a) through cookie settings |
| Compliance with legal obligations (tax, accounting) | Billing data | Legal obligation (art. 6.1.c) |
| Security, fraud prevention and abuse detection | IP, session data, logs | Legitimate interest (art. 6.1.f) |
To provide the service, Psychologist AI works with the following providers, which act as data processors under article 28 GDPR:
| Provider | Function | Country / seat | GDPR safeguards |
|---|---|---|---|
| Anthropic, PBC | Processing of conversations (Claude AI model) | USA / multi-region | DPA + Standard Contractual Clauses (SCCs), modules 2 and 3 |
| Hostinger International Ltd. | Platform hosting and web infrastructure | Lithuania (EU) | Within the EEA — no international transfer |
| Stripe, Inc. | Payment processing and subscription management | USA / EU office in Ireland | DPA + SCCs + PCI-DSS certification |
| Brevo (Sendinblue SAS) | Transactional emails and commercial communications | France (EU) | Within the EEA — no international transfer |
| Meta Platforms Ireland Ltd. | Advertising on Facebook and Instagram (Meta Pixel, audiences) | Ireland (EU) / USA | DPA + SCCs + EU-US Data Privacy Framework |
Some of the providers listed involve a transfer of data outside the European Economic Area (EEA), mainly to the United States. These transfers are covered by the Standard Contractual Clauses adopted by the European Commission (Implementing Decision 2021/914) and, in the case of Meta, also by the EU-US Data Privacy Framework, adopted by adequacy decision of the European Commission in July 2023.
Psychologist AI uses the Anthropic API under commercial terms (not a consumer account). Under these terms, Anthropic deletes conversation inputs and outputs within a maximum of 7 days of receipt or generation, and does not use API data to train its AI models. In the exceptional case that a conversation is flagged by abuse detection systems, retention may be extended to up to 2 years under Anthropic's acceptable use policy.
Psychologist AI uses Meta Ads (Facebook Ads and Instagram Ads) to promote its services. This involves the following technologies:
The Meta Pixel is a piece of JavaScript code that Psychologist AI installs on its website. When a user visits the site and has accepted marketing cookies, this pixel collects information about their behaviour (pages visited, actions taken, conversions) and sends it to Meta Platforms for the following purposes:
Important: the Meta Pixel should only be activated if the user has given prior consent to marketing cookies. If the user refuses marketing cookies, no data should be sent to Meta. The user may withdraw consent at any time (see the Cookie Policy).
Psychologist AI may share with Meta, in encrypted form (SHA-256 hash), lists of email addresses of users who have given express consent to receive commercial communications. This practice is called Custom Audiences from Customer List and allows specific ads to be shown to those users on Facebook and Instagram.
The user may object to this practice at any time by writing to support@psicologoia.ai or directly from the ad settings of their Facebook account.
In relation to the use of the Meta Pixel, Psychologist AI and Meta Platforms Ireland Ltd. act as joint controllers under article 26 GDPR, in accordance with the Controller Addendum agreed with Meta. For more information on how Meta processes data, please see Meta's Privacy Policy.
Psychologist AI does not use or share with Meta any data from conversations held on the platform, or any data that could reveal the user's mental or emotional health. The Meta Pixel operates exclusively at the level of browsing behaviour (visits, clicks, conversions) and never accesses the content of conversations. This restriction is absolute.
Psychologist AI uses Brevo (Sendinblue SAS), a company based in France (EU), to send electronic communications to its users. Brevo acts as a data processor and has a GDPR-compliant DPA.
To send emails, Brevo receives and processes: email address, user name and technical delivery metadata (open rate, clicks, bounces). No conversation data is transmitted to Brevo.
The user may unsubscribe from commercial communications at any time without giving reasons, through:
The website uses its own and third-party cookies. The main categories are described below:
| Category | Purpose | Examples | Consent |
|---|---|---|---|
| Technical / necessary | Basic operation of the site, user session, security | Session cookie, CSRF token | Not required (art. 22.2 LSSI) |
| Analytics | Aggregated analysis of traffic and user behaviour | Google Analytics / own analytics tool | Required |
| Marketing / advertising | Conversion measurement, remarketing, custom audiences | Meta Pixel (_fbp, _fbc) | Required |
| Preferences | Remembering user settings (language, interface preferences) | Interface settings cookies | Required |
For more detailed information about the cookies used, their duration and the third parties involved, please see our Cookie Policy.
| Data category | Retention period | Justification |
|---|---|---|
| Account data (email, name) | Duration of the contractual relationship + 5 years after cancellation | Legal obligation (limitation period for civil actions) |
| Conversation history (platform) | While the account is active, or until deletion is requested | Provision of the service |
| Conversations on Anthropic servers | Maximum 7 days (commercial API) | Anthropic retention policy for API customers |
| Billing data | 5 years from the date of the invoice | Tax obligation (Spanish General Tax Law 58/2003) |
| Security and access logs | 12 months | Legitimate interest in security + art. 12 LSSI |
| Email marketing data (subscribers) | Until consent is withdrawn or the user unsubscribes | Consent (revocable) |
| Marketing cookie data (Meta Pixel) | Maximum 90 days for _fbp / _fbc cookies | Meta Platforms policy |
The user may at any time exercise the following rights against Psychologist AI as controller:
| Right | What it means |
|---|---|
| Access | Obtain confirmation as to whether their data is processed and access it. |
| Rectification | Request the correction of inaccurate or incomplete data. |
| Erasure | Request the deletion of their data when it is no longer necessary or consent is withdrawn. |
| Restriction | Request the suspension of processing in certain cases. |
| Portability | Receive their data in a structured and commonly used format to transmit it to another controller. |
| Objection | Object to processing based on legitimate interest or for direct marketing purposes. |
| Withdrawal of consent | Withdraw consent at any time without affecting prior processing. |
| Not to be subject to automated decisions | Request human intervention in decisions taken solely by automated systems that significantly affect them. |
How to exercise your rights: by sending an email to support@psicologoia.ai stating the right you wish to exercise and attaching a copy of your identity document. We will reply within a maximum of 30 days of receiving the request.
Complaint to the AEPD: if you consider that the processing of your data does not comply with current regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency: www.aepd.es
Psychologist AI applies appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with article 32 GDPR:
In the event of a security breach that poses a risk to users' rights and freedoms, Psychologist AI will notify the AEPD within a maximum of 72 hours of becoming aware of it, and will inform the affected users without undue delay, in accordance with article 34 GDPR.
The service is intended exclusively for people aged 18 or over. By registering, the user expressly declares that they are of legal age. Psychologist AI does not knowingly collect data from minors. If a user is found to be under 18, their account will be cancelled immediately and their data erased.
In accordance with article 7 LOPDGDD, the processing of data of children under 14 requires the consent of their parents or legal guardians.
Psychologist AI reserves the right to modify this Privacy Policy to adapt it to new legislation, case law or changes in the services provided. Any substantial change will be communicated to the user by email at least 15 days before it comes into force. The updated version will always be available on the website with the date of the last update.
This Privacy Policy is governed by Spanish law and by European data protection regulations. For the resolution of any dispute relating to it, the parties submit to the jurisdiction of the courts and tribunals corresponding to the user's domicile in Spain, without prejudice to the user's right to lodge a complaint with the AEPD.
© CEDIA Investigación y Desarrollo, S.L. — Psychologist AI. All rights reserved.
