unblur

Version 2026-10-01

Privacy policy

DRAFT — Provisional text pending review by the law firm. This is not the final version and must not be published in production without the law firm's validation.

Version 2026-10-01

1. Data controller

  1. The controller of your data is unblurz S.L. (registration details on the Contact page, unblurz.me/contact), "unblurz".
  2. You can contact us about any privacy matter through the Contact page. [PENDING LAWYER: appointment of a data protection officer (DPO) and their contact details, if applicable.]
  3. This policy applies to creators (who use the app), buyers (who buy on the website without an account) and people who report content.

2. What data we process

2.1 Creators

  1. Identification and account: username, birth date, email, country and mobile number (verified by SMS).
  2. Identity verification (level 1): only the minimal result returned by our provider Didit: verification status, full name, birth date, document country, a fingerprint (hash) of the document number and the result of the facial comparison with other accounts. We never store images of documents or selfies.
  3. Tax and bank details: tax status, tax ID or VAT number, tax address, company name if a company, tax residence certificate if you provide it, and IBAN. The IBAN, tax ID, phone number and address are stored encrypted.
  4. Content and activity: files you upload, descriptions, prices, sales, royalties, settlements, moderation results, decisions and appeals.
  5. Device: identifiers for push notifications (device tokens), app version and technical session data.

2.2 Buyers

  1. Email, to send you access, the invoice and to support you.
  2. Country from your IP and card country, to apply your country's VAT and prevent fraud.
  3. Order data: content bought, amounts, payment method (without full card details, which the payment gateway processes), payment status and invoices.
  4. Access logs: date, IP and browser of each access to or download of the content bought.

2.3 People who report content

Reason and details of the report and, optionally, your email if you want to receive the answer.

3. Purposes and legal bases

  1. Providing the service and performing the contract (Article 6(1)(b) GDPR): managing the creator's account, publishing and selling their content, calculating and settling royalties; processing the buyer's payment, delivering the content and supporting them.
  2. Complying with legal obligations (Article 6(1)(c) GDPR): invoicing and tax obligations, withholdings, retention of accounting records, handling reports and Digital Services Act obligations, and cooperation with the authorities.
  3. Legitimate interest (Article 6(1)(f) GDPR): preventing payment fraud and duplicate accounts, protecting the security of the service, moderating content and defending ourselves against claims.
  4. Explicit consent (Article 9(2)(a) GDPR): processing of biometric data in identity verification, under the Consent to biometric verification.
  5. Marketing communications: only if you give us separate consent. We do not use the purchase email for marketing.

4. Automated decisions

  1. Content moderation (automated analysis of images, videos and PDFs) and some anti-fraud rules for payments are applied by automated means.
  2. If an automated decision affects you (for example, a link being blocked), you can ask for it to be reviewed by a person through the appeal system in the app or the Contact page, express your point of view and contest it.

5. Who we share data with

We share only the essential data with providers acting as data processors, under a signed contract:

  1. Redsys / BBVA and Stripe: payment processing.
  2. Holded: invoicing and accounting.
  3. Didit: identity and age verification.
  4. Amazon Web Services (AWS): hosting, file storage, automated moderation and video processing.
  5. Amazon SES: sending emails.
  6. Wise: paying settlements to creators.
  7. Twilio: mobile verification by SMS.
  8. Google (Firebase Cloud Messaging): app push notifications.

We also disclose data to the Spanish Tax Agency and other authorities when the law requires it, and to courts and law enforcement when they request it or when we report a crime.

6. International transfers

Some providers may process data outside the European Economic Area. [PENDING LAWYER: specify, for each provider, where the data is located and the applicable safeguard (adequacy decision, EU-US Data Privacy Framework or standard contractual clauses).]

7. How long we keep data

  1. Orders, invoices, self-bills, royalty statements and the royalty ledger: 6 years, as required by commercial and tax law.
  2. Access logs for content bought: 2 years.
  3. Identity verification data: for as long as the relationship with the creator lasts and, afterwards, for the limitation period of any actions that may arise (5 years by default).
  4. Reports: for as long as needed to handle them and, afterwards, to defend ourselves against possible claims.
  5. Content in cases reported to the authorities: for as long as the investigation requires.
  6. Other account data, for as long as the account exists.

8. Your rights

  1. You can exercise your rights of access, rectification, erasure, restriction, portability and objection by emailing the address given on the Contact page, from the email associated with your account or purchase. We may ask you to prove your identity.
  2. Creators: you can delete your account from the app. We anonymise your personal data and keep only what the law requires us to keep (section 7).
  3. Buyers: if you request erasure, we anonymise your orders; we keep them without identifying data for 6 years as required by tax law.
  4. You can withdraw your consent at any time, without affecting prior processing.
  5. If you are not satisfied with our answer, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es).

9. Security

  1. We encrypt sensitive data (IBAN, tax ID, phone number and address) and never include it in technical logs.
  2. Original files are never public: they are only served through short-lived signed links to people with valid access.
  3. Access links and magic links are stored as fingerprints (hashes), not in plain text.

10. Cookies

The public pages of unblurz only use technical cookies needed for the service to work (session, payment security, language and video access). We do not use third-party analytics or advertising cookies, so we do not ask for your consent to cookies. If this changes, we will ask you first.

11. Minors

unblurz is not directed at people under 18. Creators must be adults and we verify this before paying them. If we detect that a minor has given us data, we will delete it unless we must keep it by law.

12. Changes to this policy

We may update this policy. Each version is dated and, if the change is material, we will let you know.