Who to contact
The legal name and postal address of the controller will appear here after confirmation. For privacy questions or requests, contact:
hola@diloprimero.appYour account and conversations
This notice covers the Dilo Primero website and iPhone app. When you sign in with Google or Apple, we receive a provider identifier and your email address when supplied. We use these to secure your account and associate purchases with you. We do not receive your Google or Apple password.
On iPhone, Apple App Attest helps verify that requests come from our app. We process installation and attestation-key identifiers for security; these can be associated with your account.
To run the conversation and give feedback, we send your situation, voice and conversation text to OpenAI. Microphone audio travels directly to OpenAI. Our server temporarily holds the situation and conversation state. This processing provides the service you request; refusing microphone access means a voice conversation cannot start.
We do not make an audio archive of ordinary calls. An optional research recording is a separate choice, described below. AI feedback is a suggestion for you to consider, not an automated decision with legal or similarly significant effects.
Purchases and internal metrics
Polar handles web payments as merchant of record. Apple handles App Store payments, with RevenueCat helping us verify iPhone purchases. They process the payment details; we receive transaction identifiers, product, amount, currency and payment or refund status. We do not receive your full payment-card number.
Our server keeps records of purchased conversations, reservations, starts, active time, completion and refunds. These records can be linked to your account. They let us deliver what you bought, prevent duplicate spending, handle refunds and understand service usage and costs. They do not contain the words you say.
These operational records are separate from optional usage sharing. Account, payment and call administration rely on providing our contract with you; accounting relies on legal obligations. Reliability, fraud prevention and proportionate internal service measurement rely on legitimate interests.
Website statistics
We use Simple Analytics for anonymous website statistics. In its cookieless configuration, it measures page views, referrers, campaign tags, broad device information, language, approximate country, time on page and scroll depth. It does not store visitor IP addresses or use persistent visitor identifiers, fingerprinting or cross-site tracking.
This anonymous measurement does not use an opt-in toggle. It is separate from the optional product events below. We do not send conversation content, account details or payment details to Simple Analytics.
Optional product events
If you enable Share usage data, we collect fixed events such as opening an example, starting or retrying a call and viewing feedback, plus timing and any readiness answer you choose. A random journey identifier links these events. This stream excludes audio, words, account identifiers and receipts.
This choice uses your consent and is off by default. You can turn it off here at any time to stop future events. It applies to this browser; the iPhone app has its own setting. It does not control purchase records, Simple Analytics or research recordings.
Privacy choices
No audio, words or account details. Optional.
Only if you join research
We use UserTold for voluntary usability tests. If you accept an invitation, the study explains what will be captured before it starts: interview audio and transcript, your answers, and relevant page interactions. Screen sharing requires a separate permission on supported devices. UserTold processes the study for us and may use de-identified information to improve its processing, as explained in its privacy notice.
You can decline a study or stop participating without affecting your purchased conversation. Contact us to withdraw research consent or request deletion, with the study name and approximate date so we can find your session. Stopping recording does not automatically erase an existing recording.
The browser also offers a separate choice to share one practice conversation for research. Only if you select it, we store both voices, the situation and transcript privately for up to 30 days. This is not a UserTold interview, and it is not enabled by the usage-data setting. Research uses consent; withdrawal does not affect processing that was lawful before withdrawal.
The iPhone setting “Save transcript for review” saves your situation and conversation text privately on our server for 30 days, without audio. It defaults on in Debug and TestFlight builds and off in App Store builds. You can change it in Settings for your next conversation; test-build choices do not carry over to App Store builds. Previously saved text remains until it expires or is deleted.
What stays on your device
The website saves your current preparation draft in browser storage so it survives reload, sign-in and checkout. Completion or sign-out removes it; you can also clear this site's storage. An abandoned draft can remain until you remove it. Saved or downloaded phrase cards stay on your device until you delete them. Sharing a card sends it to the destination you choose. Device backups may keep copies.
Essential sign-in cookies last up to 30 days; the temporary login cookie lasts 10 minutes. Your chosen language is stored for one year. We also store your optional usage preference and temporary journey state. Clearing browser data removes these choices and may sign you out.
If you opt into a browser research recording, unuploaded audio parts may temporarily use browser storage. Uploaded parts are removed locally; leftover parts expire after 45 minutes and are cleaned when you next open a conversation on this site.
How long data stays
Our live conversation state is deleted on completion, after five minutes disconnected, or at the room's 45-minute maximum lifetime. These are our application-state limits, not deletion promises for every provider, log or backup.
Optional product events are eligible for removal after 90 days and cleaned on the daily retention run. Optional browser research recordings expire after 30 days. UserTold study records remain until we delete them; any shorter study-specific period is stated in the invitation. Its recovery and backup periods are described in UserTold's privacy notice.
We keep your account profile while you have an account. Account deletion removes the profile and revokes sign-in sessions, but does not erase financial records needed for purchases, refunds, fraud prevention, tax obligations or legal claims. We retain support correspondence while resolving your request and any related dispute.
Cloudflare hosts the service and processes network and request metadata, including IP addresses, for delivery and security. Security logs and provider backups have their own retention. OpenAI's standard API abuse-monitoring retention is up to 30 days, with longer retention possible for legal or safety reasons. We do not promise zero retention or processing only in the EU.
Your choices and rights
You can ask for access, correction, deletion or a portable copy of your personal data, and request restriction or object to processing based on legitimate interests. You can withdraw consent at any time. Some records must remain for legal obligations or claims. We may need to verify your identity and normally respond within one month.
Use the account-deletion control where available, or email us. Deleting your account does not remove phrase cards you saved on your devices or data held independently by Apple, Google or payment providers. You can complain to your local data-protection authority; in Spain, this is the AEPD.
We use service providers only for the purposes described here. Some may process personal data outside the EEA, including in the United States. Applicable safeguards can include adequacy decisions or standard contractual clauses; contact us for details about the arrangements that apply to your data.
We do not sell personal data or use your conversations for advertising. Avoid including unnecessary identifying details about yourself or others. This product is intended for adults; contact us if you believe a child has provided personal data.
We will update this page when our practices change and seek fresh consent where required. The date on this page identifies this version.