Privacy Policy

The controller responsible for processing your personal data is:

• Contrata.ink
• support@contrata.ink
• Illes Balears, Spain

2.1 Account Data

When you sign up for Contrata.ink we collect your email address and an encrypted password. This data is necessary to provide the service (legal basis: performance of a contract, Art. 6.1.b GDPR).

2.2 Generated Contract Data

To generate your employment documents, you provide us with your business details (name, tax ID, address) and your employees' details (name, national ID, job category, salary, contract dates). This data is stored in your account so you can manage your document history.

Legal basis: performance of the service contract with you (Art. 6.1.b GDPR). You are the controller for your employees' data; Contrata.ink acts as a processor on your behalf.

2.3 Usage and Tracking Data

We log basic usage events (access to preview links, clicks on CTAs, signup date) to improve the service and measure the effectiveness of our marketing communications. IP addresses are stored only as an irreversible hash (SHA-256).

If you use the in-app help chat, we store your questions and the assistant's replies, along with your account email (if you are signed in) or a hashed IP address, to improve the assistant and to follow up on questions it could not answer.

Legal basis: legitimate interest (Art. 6.1.f GDPR).

2.4 Payment Data

Payments are processed through Stripe. Contrata.ink does not store card details. Stripe acts as a processor under its own privacy and security policies (PCI DSS). We only retain the Stripe payment identifier and the transaction date.

2.5 Error Monitoring

We use Sentry to record technical errors that occur while you use the service (for example, a failed document generation) so we can detect and fix them. These reports include the error message, the affected page and, if you are signed in, your account identifier. Sentry is configured to strip the contents of your forms and requests (business and employee details) before they are sent, and it does not record your screen or browsing session.

Legal basis: legitimate interest in keeping the service secure and reliable (Art. 6.1.f GDPR).

If you use the feature for importing existing contracts, the uploaded document is automatically analyzed to extract the relevant data and is deleted from our servers immediately after analysis. We do not store the original file. We only retain the data extracted from the document, which is handled the same way as data for contracts generated directly on the platform.

Contrata.ink does not sell or transfer your data to third parties. We only share data with the following service providers, who act as processors:

• Supabase Inc. — data storage (servers in the European Union, eu-west region)
• Stripe Inc. — payment processing
• Resend Inc. — transactional email delivery
• Functional Software, Inc. (Sentry) — technical error monitoring (data stored in the European Union)
• AI model providers — text processing for document generation. Data is transmitted through specialized providers' APIs and is not used to train AI models.

All our providers are bound by GDPR-compliant data processing agreements.

Some of our service providers are based outside the European Economic Area. Transfers are carried out under the appropriate safeguards provided for under the GDPR, including the standard contractual clauses approved by the European Commission.

• Account data: while your account is active and for 3 years after closure, for legal and tax purposes.
• Contract data: while your account is active. You may delete it at any time from your dashboard.
• Payment data: 5 years from the transaction, for tax purposes.
• Tracking data (usage events): 12 months from collection.

As a data subject, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Request deletion of your data (right to be forgotten)
• Restrict or object to processing
• Data portability in a machine-readable format
• Withdraw your consent at any time

To exercise any of these rights, write to us at support@contrata.ink. We will respond within a maximum of 30 days.

If you believe the processing of your data does not comply with the GDPR, you have the right to file a complaint with the Spanish Data Protection Agency (aepd.es).

We apply appropriate technical and organizational measures to protect your data, including encryption in transit (TLS), password encryption (bcrypt), and restricted access to production data.

Contrata.ink uses cookies that are strictly necessary for the service to function (authenticated user session). We also use Google Analytics to understand how visitors use our site and improve it, but only after you give consent via the cookie banner shown on your first visit. You can withdraw your consent at any time by clearing your browser's site data for Contrata.ink.

For any questions about this policy or the processing of your data, you can contact us at:

support@contrata.ink

Contrata.ink — contrata.ink Illes Balears, Spain