Privacy

Data controller

PENDIENTE: razón social, tax ID PENDIENTE: CIF/NIF, registered at PENDIENTE: domicilio social. To exercise your rights or ask anything about this text: PENDIENTE: correo de contacto.

What data we process and why

Only what's needed for the service to work and to be able to charge for it:

• Your account: email address and password (stored hashed, never in the clear). Legal basis: performance of the contract.
• Your billing: name, tax address, VAT number if you provide one, and the email you paid with. Card details are handled by Stripe and we neither see nor store them. Legal basis: performance of the contract and tax obligations.
• What you configure: brands, domains, prompts, keywords, competitors. Normally company data, not personal data.
• Publishing credentials: if you connect a WordPress, its keys are stored encrypted with a key that lives only on the server.
• Service usage: which AI features you've used and how many tokens they cost, so we can show you the breakdown and reconcile consumption. Legal basis: legitimate interest in running the service.
• Waiting list: if you left your email before we opened, we keep the email and which plan interested you. Legal basis: consent, revocable by writing to us.

Who we share it with

We don't sell data to anyone and we don't use it for advertising. We work with these providers, each for one specific thing:

• Supabase — database and authentication. Everything above lives here. Region: PENDIENTE: región de Supabase (p. ej. eu-central-1).
• Vercel — application hosting and running the scheduled tasks.
• Stripe — payments, invoices, and the portal where you manage your subscription. Receives your billing and payment data.
• OpenAI, Anthropic, and Google — receive the prompts being measured and the text being generated. We don't send them your email, your name, or your payment details.
• DataForSEO — receives the keywords and the location from which Google should be queried.

Transfers outside the EU

Some of those providers are in the United States. Transfers rely on the European Commission's standard contractual clauses and, where applicable, the EU-US adequacy framework.

What actually leaves the EU are the prompts and the generated text; your account data stays in the database, in the region noted above.

Cookies

Panoramma carries no analytics, no pixels, no third-party cookies, and no advertising. That's why you won't see a cookie banner: there's nothing to consent to.

The only cookie used is your session cookie, the one that saves you from logging in again on every page. It's strictly necessary and it goes away when you log out.

How long we keep it

As long as you have an account. If you close it, we delete your data within 30 days, except billing information, which we keep for the years tax rules require.

Waiting-list emails are deleted whenever you ask us to, or when they stop being relevant.

Your clients' data

If you're an agency and you add your clients' brands, you are the controller for that data and we are the processor. Write to PENDIENTE: correo de contacto and we'll sign the processing agreement required by article 28 of the GDPR.

The report and intake links you share with your clients work with a token and no account. Whoever has the link sees the report: treat them as what they are, addresses best not published.

Your rights

You can ask us for access to your data, its correction, its deletion, restriction of processing, portability, and you can object to processing based on legitimate interest. Just write to PENDIENTE: correo de contacto.

If you think we've handled it badly, you can complain to the Spanish Data Protection Agency (aepd.es).

Changes

If we change anything significant we'll flag it in the panel before it takes effect. The date above says when it was last reviewed.