Privacy policy

Controller

DFM SAAS Solutions SL

Tax ID (CIF)

B88901913

Address

Calle Rocío Dúrcal, nº 5, 18650 Dúrcal, Granada, España

Data protection contact

hola@dfmsaas.solutions

We process the following categories of data depending on your relationship with us:

• Account and service data (name, email, organisation, encrypted password, your activity on the platform): to provide and maintain the gramo.app service.
• Billing and payment data (tax details, subscription history): to manage your subscription and meet tax obligations. Payments are processed by Stripe; we do not store your full card details.
• Contact and marketing data (email, preferences): to send you communications, downloadable resources and news, when you have asked for them or agreed to receive them.
• Browsing and analytics data (cookies, product events): to understand how the site is used and improve it, only with your consent. See the Cookie policy.
• Purchase prices in aggregate form (amounts per product from the invoices you upload): only if you have expressly opted in, to work out market averages per product and tell you whether you pay above or below the usual price. Amounts are separated from your business before they go into the calculation, the figure for any individual business is never published, and neither you nor your suppliers are identified. It is optional, does not affect your use of the service, and you can switch it off at any time from your business settings.

• Performance of a contract (art. 6.1.b GDPR): providing the service and managing your account and subscription.
• Consent (art. 6.1.a GDPR): marketing communications, free resources, analytics and non-essential cookies. You can withdraw it at any time.
• Legal obligation (art. 6.1.c GDPR): accounting, tax and invoicing obligations.
• Legitimate interest (art. 6.1.f GDPR): platform security and fraud prevention.

We keep your data for as long as you have a relationship with us and, after that, for the periods required by law (for example, up to 6 years for accounting and tax obligations). Data processed on the basis of your consent is kept until you withdraw it.

We do not sell your data. To provide the service we use providers who act as data processors, with whom we have signed the contracts required by article 28 of the GDPR:

• Supabase, Inc.: Database, authentication and storage (EU / US (SCC)).
• Vercel, Inc.: Hosting and delivery of the application (EU / US (SCC)).
• Stripe Payments Europe, Ltd.: Payment and subscription processing (EU / US (SCC)).
• Resend, Inc.: Transactional email and free resources (US (SCC)).
• Twilio Ireland Ltd.: WhatsApp notifications (EU / US (SCC)).
• PostHog, Inc.: Product analytics (with consent) (EU / US (SCC)).
• Google Ireland Ltd.: Web analytics, Google Analytics 4 (with consent) (EU / US (SCC)).

Where any of these providers process data outside the European Economic Area, those transfers are covered by the Standard Contractual Clauses (SCC) approved by the European Commission or other appropriate safeguards.

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw any consent you have given, by writing to hola@dfmsaas.solutions and stating the right you wish to exercise.

If you believe your data is not being processed in line with the law, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), www.aepd.es.

We apply appropriate technical and organisational measures to protect your data, including encryption in transit and at rest, role-based access control and isolation of data between organisations (multi-tenant with row-level security).