Skip to content
Menu

Privacy Policy

Last updated · 13 October 2026

What personal data we process on iaoperators.com, why, on what legal basis, for how long, who it is shared with and how you can exercise your rights. This policy meets the information duty under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

1. Data controller

Owner
Luiz Fernando Costa Brazao (trade name: IA Operators)
Tax ID (NIF)
Y8219331L
Address
Málaga, Spain
Contact
info@iaoperators.com

We have not appointed a data protection officer because our activity is not among the cases that require one (art. 37 GDPR and art. 34 LOPDGDD). For any privacy question, write to the address above.

2. What data we process and why

Contact form

Data
Name, email, company, city (optional), the message you write and the IP address it is sent from.
Purpose
To answer your request and, if there is a fit, prepare a proposal. The IP is used only to limit abusive submissions.
Legal basis
Steps taken at your request before entering into a contract (art. 6.1.b GDPR) and, for the IP, our legitimate interest in protecting the form (art. 6.1.f).
Retention
12 months from the last contact if no relationship begins. If you become a client, for the duration of the relationship and then for the legal retention periods (6 years for commercial records).

Compliance tests (Ley 10/2025 and Verifactu) and GDPR diagnosis

Data
Your answers to the questionnaire, the result, the page you came from, campaign parameters (UTM) and a pseudonymized identifier calculated from your IP, browser and language. The IP itself is not stored. If you request the report: your email and your contact preferences.
Purpose
To calculate and show you the result, produce aggregate statistics and prevent duplicate or automated submissions. With your email, to send you the report and, if you tick the box, to contact you to discuss it.
Legal basis
Legitimate interest in providing the tool and measuring its use (art. 6.1.f GDPR). Sending the report and any follow-up contact: your consent (art. 6.1.a).
Retention
Answers: 24 months. Email: until you withdraw consent or after 24 months without interaction.

“The Second Bill of AI 2026” survey

Data
Your answers, language, technical device data (category and a pseudonymized fingerprint) and, optionally, your email, which is stored separately from the answers.
Purpose
To produce a study with aggregate results. Individual answers are not published. The email is only used to let you know about the results.
Legal basis
Your consent, given when you tick the boxes before submitting (art. 6.1.a GDPR).
Retention
Individual data: up to 12 months after the study is published; after that only aggregates are kept. Email: until we send you the results.

Browsing and security

Data
Technical server logs (IP, date, requested page and browser).
Purpose
To serve the site, detect errors and prevent attacks.
Legal basis
Legitimate interest in keeping the site secure and running (art. 6.1.f GDPR).
Retention
The short period set by the hosting provider for its logs.

Purchase of the VERI*FACTU Preparation Kit

Data
Email, name and, if you provide them, company, tax ID and billing address (collected by Stripe at checkout); order and payment identifiers; amount; access date; and, if you came from the test, the identifier of your result (not your answers). We never see or store your card details.
Purpose
To charge you, issue the invoice, give you access to the Kit through single-use links and send the emails needed for payment and access. Buying does not subscribe you to marketing communications.
Legal basis
Performance of the purchase contract (art. 6.1.b GDPR) and compliance with tax and accounting obligations (art. 6.1.c).
Retention
While access lasts and then for the legal retention periods for accounting and tax records (6 years).

Purchase and use of RGPD Ops Starter

Data
From the purchase: email, name and, if you provide them, company, tax ID and billing address (collected by Stripe at checkout); order and payment identifiers; amount; access dates; and, if you came from the diagnosis, the identifier of your result (not your answers). From use: the content you enter in your workspace (organisational information about your company: processing activities, providers, collection points, internal references and dates of requests and incidents, tasks assigned by role, references to evidence and reviews) and a change history that records the action, the date and the names of the fields, without their values. The tool does not ask for data about the people whose requests or incidents you manage and rejects emails, phone numbers and ID numbers in its text fields.
Purpose
To charge you, issue the invoice, give you access through single-use links, provide the service (store, display and export your workspace) and send the emails needed for payment and access. We do not use your workspace content for any other purpose or send it to artificial intelligence models. Buying does not subscribe you to marketing communications.
Legal basis
Performance of the contract (art. 6.1.b GDPR) and compliance with tax and accounting obligations (art. 6.1.c). If your workspace contains personal data of third parties, we process it as a processor on behalf of your company, under the processing terms included in the RGPD Ops conditions (art. 28 GDPR).
Retention
Workspace: while access lasts and up to 90 days afterwards (also after a full refund), so you can export it; then it is deleted. Order data: the legal retention periods for accounting and tax records (6 years).

We do not sell personal data or pass it to third parties for their own purposes, unless required by law. Form data is not used for advertising.

3. Providers with access to the data

To provide the service we use the following providers. Those acting as processors only handle the data on our instructions.

  • Vercel Inc. Site hosting and form processing. United States · processor
  • Supabase Inc. Database for the tests, the survey, the orders and the RGPD Ops workspaces. Servers in the European Union · processor
  • Stripe Payments Europe, Ltd. Payment and invoicing for the VERI*FACTU Preparation Kit and RGPD Ops Starter. Ireland (EU) · processor for payments
  • Resend (Plus Five Five, Inc.) Sending the contact form emails, the test reports and the access links for the Kit and RGPD Ops. United States · processor
  • Google (Gmail) Inbox where messages sent to info@iaoperators.com are received and handled. United States and EU
  • Google, Meta, LinkedIn and Ahrefs Measurement and advertising, only if you accept cookies. Details in section 7. EU and United States · see section 7

4. International transfers

Several of these providers are US companies or may access the data from there. In those cases the transfer relies on the EU-US Data Privacy Framework adequacy decision, where the provider is certified, or on the standard contractual clauses approved by the European Commission, which the providers include in their data processing agreements.

Answers to the tests and the survey are stored on servers in the European Union.

5. Automated decisions

The result of the compliance tests is calculated with fixed rules from your answers. It is indicative, has no legal effect on you and does not determine any decision that affects you. We do not take decisions based solely on automated processing within the meaning of art. 22 GDPR.

6. Your rights

  • Access your data and find out how we process it.
  • Rectify inaccurate data and have it erased when it is no longer needed.
  • Object to processing based on legitimate interest and ask for it to be restricted.
  • Receive your data in a structured format (portability).
  • Withdraw your consent at any time, without affecting the processing carried out before.

To exercise them, write to info@iaoperators.com with the subject “Data protection”, stating which right you are exercising. We will only ask for information to verify your identity if there are reasonable doubts about it. We reply within one month.

If you think we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

7. Cookies and similar technologies

Without your consent we only use what is strictly necessary for the site to work and to remember your cookie choice. Measurement and advertising load only if you click “Accept” in the notice; if you click “Reject”, none of them load.

  • Cookie preference (first-party) Remembers whether you accepted or rejected the notice. Stored in the browser's local storage. Technical, does not require consent. Key iaoperators_cookie_consent · until you delete it
  • Kit session (first-party) Keeps you signed in to the private Kit area after you use the access link. Only exists if you bought and signed in. Technical, does not require consent. __Host-vfk_session · up to 30 days or until you sign out
  • RGPD Ops session (first-party) Keeps you signed in to your RGPD Ops workspace after you use the access link. Only exists if you bought and signed in. Technical, does not require consent. The workspace also stores in the browser the last module you opened (rgo:view) and, during the visit, whether you already signed in (rgo:accessed) and the diagnosis context when going to checkout (rgo_ctx, no answers). __Host-rgo_session · up to 30 days or until you sign out
  • Google Tag Manager (Google Ireland Ltd.) Manager that loads the other tags after your consent. Does not set cookies of its own. Only after accepting
  • Google Analytics 4 (Google Ireland Ltd.) Audience measurement: page views, traffic sources and conversions. Analytics · _ga, _ga_* · up to 2 years
  • Google Ads (Google Ireland Ltd.) Ad conversion measurement and remarketing lists. Advertising · _gcl_au · 90 days
  • Meta Pixel (Meta Platforms Ireland Ltd.) Conversion and audience measurement for Facebook and Instagram ads. Advertising · _fbp, _fbc · 90 days
  • LinkedIn Insight Tag (LinkedIn Ireland U.C.) Conversion and audience measurement for LinkedIn ads. Advertising · li_sugr, bcookie, lidc, UserMatchHistory and others · between 1 day and 1 year
  • Ahrefs Web Analytics (Ahrefs Pte. Ltd.) Aggregate audience measurement. Analytics · Singapore · cookieless, according to the provider

Advertising cookies let us show you IA Operators ads on those platforms after you visit the site and measure whether an ad led to a contact request. For the Meta pixel, Meta Platforms Ireland acts as joint controller for the collection and transmission of that data.

You can change your choice at any time from the “Cookies” link in the footer, and delete cookies already set from your browser settings.

8. Minors

The site is aimed at businesses and professionals. We do not knowingly collect data from children under 14.

9. Security

We apply technical and organizational measures proportionate to the risk: encrypted connections, restricted access to the databases, separation of the email from the answers in the survey and pseudonymization of the origin of the test answers.

10. Changes to this policy

If we change how we process your data, we will update this page and its date. If the change affects processing based on your consent, we will ask for it again when necessary.