Privacy Policy
This Privacy Policy explains how AI POP Displays (operated by Bellot.ai, "we", "us") collects, uses, stores and shares personal data when you visit aipopdisplays.com or use the application.
We process personal data as a data controller under Regulation (EU) 2016/679 (GDPR) and the Spanish Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD).
Notice. This is the current draft of our policy. Some operational details (registered legal entity name, NIF, postal address) are being finalised before the public launch and will appear here in their final form before signups open to the public.
1. Who we are
- Operator: Bellot.ai
- Tax ID (NIF / CIF): to be confirmed before public launch
- Registered address: to be confirmed before public launch
- Privacy contact: privacy@aipopdisplays.com
- Supervisory authority: Agencia Española de Protección de Datos (AEPD). EU/EEA users may also lodge complaints with their local data protection authority.
2. What we collect and why
We only collect what we need to run the service. The categories below cover everything stored on our systems.
| Category | Data | Purpose | Legal basis |
|---|---|---|---|
| Account | Email, hashed password, display name, locale | Create and authenticate your account | Contract (GDPR art. 6(1)(b)) |
| Billing | Stripe customer ID, subscription status, plan, credit balance, last 4 of card (from Stripe), country, currency | Process subscriptions and one-off purchases | Contract |
| Generation inputs | Briefing text, sector / display-type / material selections, uploaded reference and product images, prompt history | Generate the renders you request | Contract |
| Generation outputs | Generated images, generation metadata, debit / refund ledger | Deliver the product, debug failures, prevent credit abuse | Contract; legitimate interest (anti-fraud) |
| Operational logs | IP address, user agent, request paths, error traces, timestamps | Security, abuse prevention, debugging | Legitimate interest (GDPR art. 6(1)(f)) |
| Analytics | Aggregated visit data (page, referrer, device class, country) — only with your consent | Measure traffic and feature use | Consent (GDPR art. 6(1)(a)) |
| Support | Messages you send us | Answer your questions | Legitimate interest |
We do not store payment card numbers, sell personal data, or perform automated decision-making with legal effect under GDPR art. 22.
3. How long we keep it
| Data | Retention |
|---|---|
| Account, generations, billing | While your account is active, plus 30 days after deletion request |
| Invoices and tax records | 6 years (Spanish Código de Comercio art. 30) |
| Operational logs | 90 days |
| Backups | Up to 30 days, then overwritten |
| Analytics | 14 months (only if consent granted) |
You can request deletion at any time (see §7). Statutory retention obligations (e.g. tax records) prevail over deletion requests.
4. Who we share it with (subprocessors)
We use the following processors. Each is bound by a data-processing agreement under GDPR art. 28.
| Processor | Purpose | Data location |
|---|---|---|
| Vercel Inc. | Application hosting, edge functions | EU (Frankfurt) + global edge |
| Supabase Inc. | Database, authentication, file storage | EU (Frankfurt) |
| Stripe Payments Europe Ltd. | Subscription billing, card processing | EU + US (SCCs) |
| Google Ireland Ltd. (Gemini API) | AI image generation from your briefings and uploads | EU + US (SCCs) |
| Google Ireland Ltd. (Google Fonts) | Web font delivery | Global edge |
| Google Ireland Ltd. (Analytics 4) | Traffic measurement — only when you consent | EU + US (SCCs) |
| Resend, Inc. (if used) | Transactional email delivery | EU + US (SCCs) |
Transfers outside the EEA rely on the European Commission's Standard Contractual Clauses (Decision 2021/914) plus, where applicable, supplementary technical measures (encryption in transit and at rest).
When you submit a brief, the briefing text and any uploaded images are sent to Google's Gemini API to generate the render. Google states it does not use API content to train its models. Generated images are stored in our Supabase project and remain visible only to you.
5. International transfers
Our primary processing region is the European Union. Where a processor performs additional processing in the United States or other third countries (notably Google for AI generation, Stripe for global card networks), the transfer is covered by SCCs and, for US processors certified to it, the EU–US Data Privacy Framework.
6. Security
- TLS 1.2+ in transit, AES-256 at rest (Supabase managed encryption).
- Row-level security on every database table — server code derives the user ID from the authenticated Supabase session, never from the client.
- Storage buckets are private; downloads use short-lived signed URLs.
- Card data never reaches our servers — Stripe's hosted Checkout collects it directly.
- API keys for AI generation are server-side only.
- Rate limiting and atomic credit accounting prevent replay and double-debit.
No system is perfectly secure. If you discover a vulnerability, please email abuse@aipopdisplays.com; we ask that you give us a reasonable window to fix the issue before disclosing it publicly.
7. Your rights
Under GDPR you have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — correct inaccurate or incomplete data.
- Erasure — request deletion of your account and associated data, subject to statutory retention obligations.
- Restriction — ask us to limit processing in certain situations.
- Portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interests.
- Withdraw consent — for analytics, you can withdraw consent at any time via the cookie preferences link in the footer.
- Lodge a complaint with the AEPD or your local DPA.
To exercise any of these rights, email privacy@aipopdisplays.com from the address on your account. We respond within 30 days (extendable by 60 days for complex requests, GDPR art. 12(3)).
8. Cookies and similar technologies
We use a minimum of strictly-necessary cookies (authentication, CSRF, locale, consent state) and one optional analytics cookie set (Google Analytics 4) that loads only after you grant consent. Full details — names, purposes, durations — are in the Cookie Policy.
We do not use advertising cookies, cross-site trackers, or fingerprinting.
9. Children
The service is not directed at children under 16 and we do not knowingly collect their data. If you believe a minor has created an account, email privacy@aipopdisplays.com and we will delete it.
10. Changes to this policy
When we change this policy materially we update the date at the top of the page and, for significant changes, send a notice to the email on your account. Continued use of the service after the change constitutes acceptance of the updated policy.
11. Contact
- Privacy questions: privacy@aipopdisplays.com
- Abuse / security: abuse@aipopdisplays.com
- General: hello@aipopdisplays.com