1. Data controller
David Cancillo Martinez · Spanish ID/tax number 71509859F · Calle Caida 32, 24404 Ponferrada, León, Spain · contacto@infpodcast.com.
For privacy requests or to exercise your rights, use the contact form and select “Privacy and data” or “Rights and complaints”, or email contacto@infpodcast.com.
2. Data we process
- Account: name, verified email, Google account identifier, and profile image.
- Service activity: topics, settings, voices, scripts, images, audio, library, collections, progress, and downloads.
- Subscription: plan, status, customer and subscription identifiers, and billing periods. InfPodcast does not store full card details.
- Security and operations: IP address, user agent, technical logs, minute usage, generation attempts, and anti-abuse signals.
- Messages sent to support.
- Contact form: name, email address, subject, message, language, date, and an anonymised fingerprint of the IP address used for abuse prevention.
- If you allow experience measurement: a random tab identifier, language, device type, journey step, and LCP, INP, and CLS metrics. These events do not store your identity, IP address, or page URL.
3. Purposes and legal bases
- Account, podcast generation, library syncing, and subscription management: performance of a contract.
- Receiving and answering requests submitted through the contact form: consent and, depending on the enquiry, pre-contractual steps or our legitimate interest in supporting users and protecting their rights.
- Abuse prevention, security, troubleshooting, and aggregated metrics: legitimate interests in operating a safe and effective service.
- Tax, accounting, and lawful requests: compliance with legal obligations.
- Optional communications or future non-essential technology: consent, which may be withdrawn.
4. Service providers
- Cloudflare: Worker hosting, D1 database, R2 storage, security, and Turnstile.
- Google: account authentication.
- Stripe: payments, subscriptions, and customer portal.
- OpenAI: script and image generation where applicable.
- Fish Audio: speech synthesis and narration.
- Ahrefs Web Analytics: aggregated metrics without cookies or persistent identifiers.
5. International transfers
Some providers may process information outside the European Economic Area. Where this happens, safeguards required by law apply, such as adequacy decisions or standard contractual clauses, depending on the provider and processing.
6. Retention
- The session cookie expires after 30 days and can be closed sooner by signing out.
- Accounts and podcasts are retained while active or until deletion is requested.
- Usage, security, and transaction records are kept as needed to resolve incidents and meet legal obligations.
- Contact messages are retained while the enquiry is handled and for up to 24 months after it is resolved, unless a legal duty or claim requires longer retention.
- Optional experience measurement data is automatically deleted after 30 days.
- On account deletion, data is erased or anonymised unless retention is legally required or needed to defend claims.
7. Your rights
You may request access, correction, erasure, restriction, objection, and portability, and withdraw consent without affecting earlier processing. You can delete the account and export data from the profile or use the contact form.
You may complain to the Spanish Data Protection Agency at aepd.es or your competent supervisory authority.
8. Automation and security
AI generation is automated but does not make legal or similarly significant decisions about you. We use access controls, transport encryption, secure cookies, usage limits, and anti-abuse measures. No system is entirely infallible.
9. Changes
We update this policy when features, providers, or legal requirements change. Material changes will be communicated through reasonable means.