Privacy Policy

This policy describes how Sologang processes the personal data of its users, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

Data controller

• Controller: Alfredo Omaña (brand "Sologang")
• Tax ID (NIF): 21495245C
• Address: Santo Isidra 31, 28041, Madrid, Spain
• Privacy contact: privacy@sologang.io

What data we process

Anonymous session and optional account linking

• A system-generated user identifier is created automatically when you first use Sologang.
• An email address is processed only if you choose to link your anonymous session to an email account.

Briefing, roadmap and the first Courtesy mission do not require an email address. If you choose Save progress, we use your email to send a confirmation link and provide account access and recovery. Confirmation links the email to your existing account. Without a linked identity, losing your browser session may prevent you from accessing your work. Linking an email does not subscribe you to marketing.

API keys (BYOK, "bring your own key")

If you connect keys from language-model providers, they are encrypted on your own device (device-bound AES-GCM) before persistent storage. When you validate a key or ask an agent to use it, the plaintext key is transmitted over encrypted HTTPS to a Sologang server-side route solely to relay the request to the provider you selected. Sologang does not persist the plaintext key in its database.

Product usage

• Conversations and messages you exchange with the platform's roles.
• Missions, roadmap and deliverables you generate.
• Your project profile (idea, sector, stage, country, product URL) that you provide.
• Usage records (tokens and cost) for spend control and billing.
• Actions prepared or executed in connected tools.
• Your plan or subscription tier.
• Security and abuse-prevention records, including an opaque user identifier, timestamps and hashed crawl targets.

Third-party connections (when you authorize them)

If you connect services such as GitHub or Slack, the credentials needed to execute the actions you authorize are encrypted server-side before storage. You can revoke these connections at any time.

Purpose and legal basis

• Providing the service (performance of a contract, Art. 6.1.b GDPR).
• Spend control and billing (contract / legal obligation).
• Security and abuse prevention (legitimate interest, Art. 6.1.f GDPR).
• Optional account linking, access and recovery, including confirmation emails requested through Save progress (performance of a contract, Art. 6.1.b GDPR).

Processors and providers

We use providers acting as data processors, with appropriate safeguards:

• Supabase (authentication and database).
• Vercel (hosting and infrastructure).
• Cloudflare Turnstile (bot and abuse prevention for protected actions, where enabled).
• Anthropic processes the brief, relevant project context and public website information for SoloGang-funded Courtesy diagnosis, roadmap, mission generation and review. An email address is not required to use Courtesy.
• Language-model providers to which you connect your own key (BYOK): processing takes place with your key and under your account with that provider.
• GitHub, Slack or other tools you connect voluntarily.

Some providers may process data outside the European Economic Area. Where an international transfer is subject to the GDPR, the applicable transfer requirements and the relevant provider's documented transfer mechanisms apply.

Retention

We keep account-linked data, including an optionally linked email, while your account is active or as needed to provide the service. When you delete your account, account-linked operational data is deleted. Funnel analytics events may remain after the user identifier has been removed, so they are no longer linked to the deleted account. Records that must be retained for legal, tax or billing obligations may be kept for the applicable retention period.

Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to privacy@sologang.io. You may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

Minors

The service is intended for adults or persons with legal capacity to enter into contracts.