This is an English translation provided for convenience. The Spanish version governs and prevails if the two differ.
Here we explain what data of yours we process, why, for how long and with whom, under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). In short: the minimum needed to provide the service, without selling anything to anyone and without tracking you.
1. Controller
- Controller: Antonio Rodríguez
- Tax ID (NIF): 45318520X
- Address: Calle Pintor Casilari Roldán 2
- Contact: hola@1h1app.com
This policy covers anyone who visits 1h1app.com and anyone who has an account with 1h1app Webs or the Pro access. If you are a visitor or customer of a website built with 1h1app (or an employee of that business), the controller of your data is that business: see section 9.
2. What data we process and why
2.1 Your account
Data: email, password (stored hashed, never in plain text), language, sign-up date, the status of your trial and subscription, the websites you create and their content.
Purpose: to give you access to the panel, publish your websites and notify you of what happens with your account.
Legal basis: performance of the contract (art. 6(1)(b) GDPR).
2.2 Billing
Data: your customer identifier in Stripe, plan, currency, amounts, charge dates and payment status. Stripe also holds your card details and whatever you give it for the invoice; we do not see your card.
Purpose: to charge the subscription and domains, issue invoices, handle failed payments and refunds.
Legal basis: performance of the contract and legal obligation (tax and accounting).
2.3 Domains
Data: the domain you request or connect, its status and, if you buy it, the payment. The domains we register go into our account with the registrar under our contact details: your data is not sent to the registrar.
Legal basis: performance of the contract.
2.4 Support
Data: the emails you send us and what you tell us in them.
Purpose: to help you.
Legal basis: performance of the contract or, if you are not yet a customer, our legitimate interest in replying to you.
2.5 Emails we send you
- Service emails (you cannot unsubscribe from them while you have an account): payment confirmation, renewal, failed payment, cancellation, website published, domain requested and ready, new messages and bookings from your website, password or email changed. Basis: performance of the contract.
- Commercial emails: the welcome email, the reminders that your trial ends in 3 and 1 days, the notice that it has ended and, if you turn it on, the daily summary of your website. We send them because you are a customer or are trialling the product (art. 21.2 LSSI, legitimate interest). Unsubscribing is free and easy: click the "Unsubscribe from these emails" link at the bottom of any of them (or your mailbox's "Unsubscribe" button), or write to hola@1h1app.com with "unsubscribe", and we stop sending them. We never pass your email to third parties for advertising.
2.6 Statistics for 1h1app.com (no cookies and no IP stored)
To know which pages are viewed, how long a visit lasts and which buttons are clicked, our own pages (not customers' websites) send our server the path, the time visible, how far you scroll and the name of the action ("view pricing", "open sign-up", etc.). This is how we do it:
- No cookies or local storage: the script writes nothing to your browser.
- No IP stored: it is not written to any table, either in full or truncated.
- A code that changes every day: to group the pages of a single visit, the server turns your IP and your browser into a code (an HMAC hash) using a key that changes every day and never leaves the server. The IP cannot be recovered from that code, and the next day you are a different code: nobody can follow you from one day to the next. Even so, we treat it as pseudonymised personal data, on the basis of legitimate interest (art. 6(1)(f) GDPR).
- What is stored: country (from a table downloaded on the server, IP to Country Lite by DB-IP, licensed CC BY 4.0; no external call is made), language, device type, browser family and operating system, referring domain, paths without parameters, and duration. If you are logged in, the visit is associated with your account so we can help you with the product, and your actions (sign-up, creating or publishing a website, opening checkout, paying, requesting a domain) are recorded with their minimum datum: website name, domain or amount.
- Deleted after 90 days. And not sent to anyone: everything is stored on our server.
2.7 Security and anti-abuse
We limit the number of sign-ups, login attempts and form submissions per IP address over short periods, in memory. Basis: legitimate interest in protecting the service.
2.8 Importing your website or your Google listing
If you give us the address of your old website, our server reads it to bring texts and photos into your new website. If you ask to import your business listing, we query Google Places with your business name and address. This only happens when you request it. Basis: performance of the contract.
2.9 AI writing
The editor has a feature to write the texts of your website from a sentence about your business, through the Anthropic API. It is not enabled today. If we enable it, what you type in that box will be sent to Anthropic (USA, with the safeguards of the Data Privacy Framework and standard contractual clauses) solely to generate the text, and we will reflect it here beforehand.
3. Who we share your data with
Only with those needed to provide the service, as processors or as recipients under a legal obligation:
- IONOS SE (Germany) — our server and email delivery. Data in the European Union.
- Stripe Payments Europe, Ltd. (Ireland), with Stripe, Inc. (USA) — charges, invoices and the billing portal. Stripe also acts as an independent controller to prevent fraud and meet its own obligations (see its policy).
- Porkbun LLC (USA) — domain registration. It does not receive your personal data, only the domain name and our contact details.
- Google LLC — Google Places, only when you import your listing and only with your business data.
- Public authorities, courts or law enforcement where the law requires it.
We do not sell data. There is no third-party advertising. There is no third-party analytics.
4. Transfers outside the European Union
Your data is stored in the EU. The exception is payment: Stripe may process data in the United States. Stripe, Inc. is certified under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) and additionally applies the Commission's standard contractual clauses. If you import your Google listing (section 2.8), the business name and address you type are sent to Google LLC (USA) only to look up the listing; Google LLC is also certified under the Data Privacy Framework. The domain registrar (USA) does not receive any personal data of yours.
5. How long we keep each thing
- Account and websites: while you have an account. If your trial ends or you cancel, the website is no longer published but the content stays in the editor so you can come back; you can request deletion whenever you want (section 7).
- Deleted website: 30 days in the trash, recoverable; then it is removed.
- Invoices and payment data: 4 years under tax obligations (art. 66 General Tax Law) and up to 6 under accounting obligations (art. 30 Commercial Code), even if you delete your account.
- Employee clock-ins (if you use that feature): 4 years from each record (art. 34.9 Workers' Statute), blocked, even if you delete your account.
- Visit statistics for 1h1app.com: 90 days.
- Support emails: while you have an account and up to 1 year afterwards, in case of any claim.
- Backups: database backups are overwritten after 14 days. Image backups are cumulative: a deleted photo may remain in the backup for longer; we are working on purging them automatically and, in the meantime, we delete it by hand if you ask us to.
6. Minors
1h1app Webs is for businesses and people over 18. We do not knowingly process data of minors; if you believe a minor has created an account, write to us and we will delete it.
7. Your rights
You can ask us for access to your data, to rectify it, erase it, restrict or object to a processing activity, and to take it with you (portability). Write to hola@1h1app.com from your account email; if you cannot, we will ask you for something that proves you are you. We reply within one month at most.
- Export your content: we send you your texts, photos and data (leads, bookings, orders, contacts, clock-ins) in reusable formats (JSON/CSV and images). Clock-ins can also be exported by you from the panel.
- Delete your account: we delete the account, the websites and their content. We keep only what section 5 says the law requires, blocked. If you have a domain registered by us, request the transfer first.
If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es, C/ Jorge Juan 6, 28001 Madrid).
8. Security
HTTPS everywhere; hashed passwords; secure session cookies; customers' Stripe keys encrypted (AES-256-GCM); request limits; server in the EU with restricted access; daily backups. If there were a breach affecting you, we would notify you and report it to the AEPD within the legal deadlines.
9. If you use a website built with 1h1app
Every website published with 1h1app belongs to the business that created it. If you leave a message, book, order, pay or clock in as an employee, the controller of your data is that business. 1h1app only hosts the data and processes it on the business's behalf, as processor, under the data processing annex of our terms. To exercise your rights, contact the business (its privacy policy is in the footer of its website); if you write to us, we will forward your request to it.
What happens technically on those websites: they use no cookies for visitors; the statistics the business sees are aggregated counters (day, page, country, device), with no IP or identifier; when you leave a message, the IP of the submission is stored only to stop spam, is not displayed and is deleted after 30 days; maps are served through our server, so the map provider does not receive your IP; payments are processed by Stripe in the business's account.
10. Changes
If we change this policy, we publish the new version with its date and, if the change is significant, we notify you by email.