Legal Notice and Privacy Policy

1. Data Controller

The controller responsible for processing personal data is WEB3 AND MARKETING CONSULTING LTD, with C.I.F.: 10431803Y, and registered address at Efesou, 9, Paralimni, 5280 Famagusta, Cyprus.

Contact: support@hablo.es

Data Protection Officer (DPO): gdpr@hablo.es

2. Purpose of Processing

The personal data collected will be processed for the following purposes:

• Management of the contractual relationship arising from the engagement of the AI personal agent service.
• Provision of the service: execution of tasks, automations, and communication with the agent.
• Sending communications related to the contracted service.
• Payment processing through Stripe.
• Handling enquiries and technical support.

3. Data Collected

The personal data collected are:

• Identifying data: name, email address, Telegram identifier.
• Payment data: handled entirely by Stripe. WEB3 does not store credit card data.
• Usage metadata: technical logs of the requests made to the AI models (date, model used, number of tokens, cost, latency). The content of conversations is not stored in the central database.
• Agent workspace data: the files that the user creates or that the agent generates in its workspace are stored on the server assigned to the agent.

4. Conversation Data

The conversations between the user and their agent are processed in real time by the AI models and pass through the infrastructure of Telegram or the web browser. WEB3 stores only technical metadata (timestamps, model used, number of tokens, cost) and not the content of the messages.

The agent may keep a temporary session history in its workspace in order to provide conversational context. These sessions are reset periodically.

The user must not share sensitive or confidential personal data, or third-party data, in conversations with the agent. WEB3 accepts no responsibility for the processing of personal data that the user voluntarily includes in their conversations.

5. Data Retention

Personal data will be retained for as long as the contractual relationship exists and for the period during which legal liabilities may arise: 6 years for accounting and tax data.

Agent workspace data will be retained for as long as the service is active. Following cancellation, it will be kept for 30 days to allow downloading, and will subsequently be deleted.

6. Legal Basis

The processing of your data is carried out on the basis of:

• The performance of the service provision contract.
• The free, specific, and informed consent of the data subject.
• The legitimate interest in fraud prevention and the security of the service.

7. Recipients and Sub-processors

The data may be disclosed to the following sub-processors, which are necessary for the provision of the service:

Provider	Function	Location
Hetzner Online GmbH	Server hosting	Germany (EU)
Stripe, Inc.	Payment processing	USA
Anthropic, PBC	Artificial intelligence models	USA
OpenAI, Inc.	Artificial intelligence models	USA
Telegram FZ-LLC	Communication channel	United Arab Emirates
Pexels (Canva)	Image search	USA

Additionally, if you give your consent for analytics or marketing cookies, Google services are used (Google Analytics 4 and Google Ads), based in Ireland (EU) and the USA. These transfers are covered by the EU-US Data Privacy Framework (see section 8). Details are set out in the Cookie Policy.

No data will be disclosed to any other third party except where required by law.

8. International Transfers

Some of the sub-processors indicated are located outside the European Economic Area (EEA). These transfers are carried out under:

• The Standard Contractual Clauses (SCCs) approved by the European Commission.
• The provider's adherence to the EU-US Data Privacy Framework, where applicable.

In all cases, appropriate safeguards are applied in accordance with Chapter V of the GDPR.

9. Rights

As a data subject, you may exercise the following rights:

• Right of access to your personal data.
• Right to rectification of inaccurate data.
• Right to erasure of your data.
• Right to restriction of processing.
• Right to object to processing.
• Right to data portability: you may request a complete copy of all the data held by your agent (workspace files, configuration, and metadata) in a downloadable format. WEB3 will provide such a copy within a maximum period of 30 days.
• Right to withdraw the consent given.

To exercise these rights, contact gdpr@hablo.es enclosing a copy of your identity document.

If you consider that the processing of your data does not comply with the applicable regulations, you may file a complaint with the competent data protection authority.

10. Security

The technical and organizational measures necessary to ensure the security of personal data have been adopted, including encryption in transit (TLS), per-tenant isolation, and token-based access control. Nevertheless, absolute security cannot be guaranteed.