Privacy Policy

The controller responsible for processing your personal data is:

• Contrata.ink
• support@contrata.ink
• Illes Balears, Spain

2.1 Account Data

When you sign up for Contrata.ink we collect your email address and an encrypted password. This data is necessary to provide the service (legal basis: performance of a contract, Art. 6.1.b GDPR).

2.2 Generated Contract Data

To generate your employment documents, you provide us with your business details (name, tax ID, address) and your employees' details (name, national ID, job category, salary, contract dates). This data is stored in your account so you can manage your document history.

Legal basis: performance of the service contract with you (Art. 6.1.b GDPR). You are the controller for your employees' data; Contrata.ink acts as a processor on your behalf.

2.3 Usage and Tracking Data

We log basic usage events (access to preview links, clicks on CTAs, signup date) to improve the service and measure the effectiveness of our marketing communications. IP addresses are stored only as an irreversible hash (SHA-256).

Legal basis: legitimate interest (Art. 6.1.f GDPR).

2.4 Payment Data

Payments are processed through Stripe. Contrata.ink does not store card details. Stripe acts as a processor under its own privacy and security policies (PCI DSS). We only retain the Stripe payment identifier and the transaction date.

If you use the feature for importing existing contracts, the uploaded document is automatically analyzed to extract the relevant data and is deleted from our servers immediately after analysis. We do not store the original file. We only retain the data extracted from the document, which is handled the same way as data for contracts generated directly on the platform.

Contrata.ink does not sell or transfer your data to third parties. We only share data with the following service providers, who act as processors:

• Supabase Inc. — data storage (servers in the European Union, eu-west region)
• Stripe Inc. — payment processing
• Resend Inc. — transactional email delivery
• AI model providers — text processing for document generation. Data is transmitted through specialized providers' APIs and is not used to train AI models.

All our providers are bound by GDPR-compliant data processing agreements.

Some of our service providers are based outside the European Economic Area. Transfers are carried out under the appropriate safeguards provided for under the GDPR, including the standard contractual clauses approved by the European Commission.

• Account data: while your account is active and for 3 years after closure, for legal and tax purposes.
• Contract data: while your account is active. You may delete it at any time from your dashboard.
• Payment data: 5 years from the transaction, for tax purposes.
• Tracking data (usage events): 12 months from collection.

As a data subject, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Request deletion of your data (right to be forgotten)
• Restrict or object to processing
• Data portability in a machine-readable format
• Withdraw your consent at any time

To exercise any of these rights, write to us at support@contrata.ink. We will respond within a maximum of 30 days.

If you believe the processing of your data does not comply with the GDPR, you have the right to file a complaint with the Spanish Data Protection Agency (aepd.es).

We apply appropriate technical and organizational measures to protect your data, including encryption in transit (TLS), password encryption (bcrypt), and restricted access to production data.

Contrata.ink only uses cookies that are strictly necessary for the service to function (authenticated user session). We do not use third-party tracking or advertising cookies.

For any questions about this policy or the processing of your data, you can contact us at:

support@contrata.ink

Contrata.ink — contrata.ink Illes Balears, Spain