1. Data Controller

The data controller responsible for your personal data is:

2. What Data We Collect

2.1 Account Data

When you create an account, we collect your email address and, if you sign in with Google, your name and profile picture as provided by Google. If you use the app without registering, we create an anonymous session identifier with no personal data attached.

2.2 Brain Dump Content

When you submit a brain dump, the text you write is sent to our servers to be processed by an AI service (see Section 5). Your brain dump text is stored in our database so you can access your task history. Brain dump content is associated with your user account and protected by row-level security — no other user can access it.

2.3 Task Data

The tasks extracted from your brain dumps, their completion status, and daily summaries are stored in our database. This data is used solely to provide the service to you.

2.4 Usage Data

We track aggregate, anonymized usage metrics to improve the service: feature usage patterns, error rates, and performance data. We do not track individual behavior or build personal profiles for advertising.

2.5 Payment Data

Payment information (credit card numbers, billing addresses) is collected and processed exclusively by our payment processor, Lemon Squeezy LLC. We never receive, store, or have access to your full payment card details.

3. Legal Basis for Processing (GDPR)

We process your data under the following legal bases:

4. How Long We Keep Your Data

• Account data: retained while your account is active. Deleted within 30 days of account deletion.
• Brain dumps and tasks: retained while your account is active. For free accounts, brain dump history is limited to 7 days and automatically purged.
• Usage analytics: aggregated data is retained indefinitely. Individual session data is purged after 90 days.
• Payment records: retained for 5 years as required by Spanish tax law (Ley General Tributaria).

5. AI Processing — Anthropic (Claude)

Your brain dump text is sent to the API of Anthropic, PBC (San Francisco, USA) to extract and prioritize tasks using their Claude AI model. This is the core functionality of Dump3.

Key facts about this processing:

• Anthropic acts as a sub-processor of your data under our instructions.
• Anthropic does not use API data to train their models. This is confirmed in their API privacy policy.
• Your text is processed in real-time and is not permanently stored by Anthropic beyond what is needed for abuse prevention (up to 30 days).
• This transfer to the USA is covered by Anthropic's compliance with applicable data transfer mechanisms.

When you use Dump3, you will see a notice: "Processed by AI. We don't store or share your content." This refers to the fact that we store your brain dump in our database for your history, but Anthropic does not retain it for their purposes.

6. Third-Party Services

We use the following third-party services to operate Dump3:

7. International Data Transfers

Your data may be transferred to and processed in the United States by the third-party services listed above. These transfers are protected by:

• The EU-US Data Privacy Framework, where applicable.
• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Additional safeguards implemented by each provider (encryption in transit and at rest).

8. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access: request a copy of all personal data we hold about you.
• Right to rectification: request correction of inaccurate personal data.
• Right to erasure ("right to be forgotten"):request deletion of all your data. You can do this directly in the app via Settings > Delete my account.
• Right to data portability: request your data in a structured, machine-readable format.
• Right to restrict processing: request that we limit how we use your data.
• Right to object: object to processing based on legitimate interest.
• Right to withdraw consent: withdraw consent at any time for processing based on consent.

To exercise any of these rights, contact us at dump3app@gmail.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Espanola de Proteccion de Datos — AEPD) at www.aepd.es.

9. Account Deletion

You can delete your account at any time from the app (Settings > Delete my account). When you delete your account:

• All your brain dumps, tasks, and summaries are permanently deleted.
• Your profile and authentication data are removed.
• Any active subscription is cancelled automatically via Lemon Squeezy.
• Payment records are retained for 5 years as required by Spanish tax law, but are not linked to your identity after account deletion.

This process is immediate and irreversible. We cannot recover deleted data.

10. Security

We implement the following security measures to protect your data:

• All data in transit is encrypted using TLS 1.3.
• Database records are encrypted at rest by our infrastructure provider (Supabase).
• Row-Level Security (RLS) ensures that each user can only access their own data at the database level.
• API keys and secrets are stored as environment variables and never exposed to the client.
• Rate limiting protects against abuse and unauthorized access attempts.

11. Children's Privacy

Dump3 is not directed at children under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at dump3app@gmail.com and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you via email or through a notice in the app. The "Last updated" date at the top of this page indicates the most recent revision.

13. Contact

For any privacy-related questions or to exercise your rights, contact us at:

AD2Place Digital SL
Email: dump3app@gmail.com