Privacy notice.

The short version.

Sekondo does not upload your documents. The bridge runs on your computer and talks to your Adobe application over a local connection. We hold only the data needed to sell you a licence, invoice it and support it.

1. Data controller.

• Company: Sekondo Solutions, S.L.U. (trading as Sekondo)
• Registered address: C/ Menta, 67, 14012 Córdoba, Spain
• Tax number (CIF): B05606629
• Commercial registry: Registration with the Commercial Registry of Córdoba (Spain) in progress. Incorporated by deed of 15 September 2026 granted before Florencia Tejeda Castillo, notary of Benalmádena (Málaga), under number 1185 of her protocol.
• Email: hola@sekondo.app

Data protection enquiries: privacidad@sekondo.app. We have not appointed a data protection officer because the conditions of article 37 GDPR do not apply.

2. Categories of data we process.

• Identification and contact: name, surname, email address, company name, country and, where applicable, tax number.
• Billing: plan, amounts, dates, invoice number, country of taxation and, if you enter them in My account for your invoices, name or company, tax ID and billing address, which we store encrypted. Card data is processed exclusively by our payment provider; we never see or store it.
• Licence: licence key, product and version, and an anonymous machine identifier derived by hashing, used only to count activated devices.
• Support: the content of the messages you send us and any technical details you choose to attach.
• Website: the web server keeps access logs including IP address, date, page requested and user agent, for security and diagnostics.
• Where your visit came from: the label of the ad or link that brought you here, which is attached to your request if you send us one.
• Customer review, if you send us one: your ratings, your text, your name, your profession, your city if you give it, and your email, which is not published.
• Free trial, if you ask for it: your email, the promotional code if you enter one, an identifier of the computer where you activate it and the activation date.
• Trial link by email, if you asked for it before 8 October 2026: your email and whether you wanted a reminder the next day.
• Student and teacher discount, if you ask for it: your academic email and, if you send it, the photo of your student card or enrolment.
• Advertising cookies, only if you accept them: see section 14.
• Newsletter, if you sign up: your email, your language, the date and time you signed up and confirmed, the IP address and browser you used, and the version of the text you accepted.

3. What we do not process.

We do not receive, store or analyse your documents, your layers, your images or the text of the instructions you give your AI assistant. That information does not pass through our systems. The instructions travel between you and your AI provider under your own agreement with them.

4. Purposes and legal bases.

5. Where the data comes from.

From you, when you buy, register, write to us or fill in a form. Except for the business prospecting in section 18, we do not buy lists and we do not enrich your data from third-party sources.

6. Retention.

• Account and licence: while you are a customer and for four years afterwards.
• Invoices and accounting: six years, under the Spanish Commercial Code, and four years for tax purposes.
• Support messages: three years from closure.
• Consent for communications: until you withdraw it.
• Server logs: thirty days.
• Photo of your card or enrolment: only until we have checked it; then it is deleted.
• Free trial: if you take out a plan, it becomes your account. If not, your email and your code, six months from the end of the trial, or from when you requested it if you never activate it; and a pseudonymised identifier of the email and of the computer (not anonymous), two years, only so that there is one trial per person.
• Email for the trial link: six months.
• Published review: for as long as it is published, or until you ask us to take it down. The email you send it from, only until we have checked that you are a customer.
• Newsletter: for as long as you stay subscribed. If you unsubscribe, we stop writing to you and keep, for three years, your email marked as unsubscribed so we never write to you again, and the proof that you signed up and unsubscribed.
• Free month code: until you use it; once you use it, it becomes part of your account.

7. Recipients and processors.

We share data only with providers acting on our instructions under a data processing agreement: our payment provider (Lemon Squeezy or Paddle, whichever appears on your receipt, acting as merchant of record), our email provider, and our hosting provider (Raiola Networks, S.L. (España)). We also disclose data when a law or a competent authority requires it. We never sell data.

We send the newsletter with Brevo SAS (France), which acts as a data processor under a data processing agreement. Brevo hosts the data in the European Union; if any of its providers processes it outside, section 8 applies.

If you accept the advertising cookies, Meta Platforms Ireland Ltd. and Google Ireland Ltd. receive data about your visit to this website and, in Meta's case, about your requests and purchases, as described in section 14.

For the business prospecting in section 18, the emails are sent by Instantly (USA), which acts as data processor under a processing agreement.

The website chat and support run on Zendesk, Inc. (USA), which acts as a processor under a data processing agreement.

8. International transfers.

Our providers process data within the European Economic Area wherever possible. Where a transfer outside the EEA is unavoidable, it is covered by an adequacy decision or by the European Commission's standard contractual clauses, with supplementary measures where appropriate.

Meta and Google may transfer the data from their cookies to the United States. Both are certified under the EU-US Data Privacy Framework, covered by the European Commission's adequacy decision of 10 July 2023.

Instantly processes the data in the United States. The transfer is covered by the European Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914) and the UK transfer addendum, both included in its data processing agreement.

Zendesk may process chat and support data in the United States. The transfer relies on the EU-U.S. Data Privacy Framework and the European Commission’s standard contractual clauses, set out in its data processing agreement.

9. Your rights.

You may request access, rectification, erasure, restriction, portability, and object to processing, as well as withdraw consent at any time without affecting the lawfulness of prior processing. Write to privacidad@sekondo.app, stating your request; we may ask for proof of identity. We answer within one month.

If you believe your rights have not been respected, you may complain to the Spanish Data Protection Agency, aepd.es, C/ Jorge Juan 6, 28001 Madrid.

10. Automated decisions.

We do not make automated decisions producing legal effects, and we do not profile you. If you accept the advertising cookies, Meta and Google may use them to show you ads under their own policies.

11. Security.

We apply technical and organisational measures appropriate to the risk: encryption in transit, access limited to those who need it, and periodic review. No system is completely secure, but we will notify you and the authority of any breach that requires it, within the legal deadlines.

12. Minors.

The service is not directed at people under eighteen and we do not knowingly collect their data.

13. Changes.

We may update this notice. Substantial changes are announced by email before they take effect.

14. Cookies.

This website sets no advertising or measurement cookie without your permission. The first time you visit, we ask you in a notice with two equal buttons, “Accept” and “Decline”; if you decline, the site works exactly the same. You can change your mind at any time from “Cookie settings”, in the footer of every page.

Our own, always on.

They are stored only in your browser and are never sent to us, except the origin label, which travels with your request only if you send one:

Advertising, only if you accept.

They tell Meta and Google that a visit came from one of our ads and whether it ended in a request, so we know which ads work and stop paying for the ones that do not.

With that measurement on, if you send us a request, ask for the trial or buy, our server also tells Meta directly, so that it counts once even if the browser never reports it. We send the date, the page, the amount if it is a purchase, your email and your customer number turned into a hash that cannot be read (SHA-256), the identifiers of the two Meta cookies in the table or the click ID from the ad, the browser type, an identifier for the operation and, for requests, the IP address. If you decline the advertising cookies, we send nothing.

Meta and Google process this data as controllers in their own right, under their policies: Meta and Google.

OpenAI Ads.

With your consent, we use the OpenAI Pixel to attribute new registrations to ChatGPT ads. It may collect click and browser identifiers and contact data normalized and hashed in your browser for advanced matching; those contact details are not sent in plain text. Cookies: __oppref (30 days) and __obref (365 days). The sekondo.openai preference remains in local storage until cleared. Withdraw consent through Configure cookies. We send events with future personalization opted out. OpenAI privacy policy. Registration does not confirm activation or payment.

Lemon Squeezy, affiliates.

With your consent, we load the Lemon Squeezy affiliate script (Lemon Squeezy is the platform that handles our payments) to know whether you arrived through the link of someone who recommends us and to credit them with the sale. It only acts if you arrive through one of those links and, while the cookie lasts, on every visit: it then calculates an identifier for your browser, sends it to Lemon Squeezy together with the page you are visiting and where you came from, and stores the ls_aff_ref cookie for up to 60 days. If you buy, that identifier travels with the payment. Withdraw consent through Configure cookies. Lemon Squeezy privacy policy.

Help chat. The chat runs on Zendesk, which stores cookies and local storage in your browser to keep the conversation going while you browse.

15. WhatsApp.

If you message Sekondo on WhatsApp, we process your number, your profile name and the messages, photos, voice notes and documents you send us, in order to help you. The legal basis is the performance of a contract, or steps you ask us to take before entering into one (art. 6.1.b GDPR).

An AI assistant answers first, and tells you so at the start. Anything it can't resolve is passed to a person on our team.

Two providers are involved: Meta Platforms Ireland Ltd., which runs the WhatsApp Business service, and Anthropic, which provides the AI model. Both act as our processors. Anthropic does not use your messages to train its models, and Meta does not use them for advertising. Anthropic may process messages in the United States under the European Commission's standard contractual clauses.

Voice notes you send us are transcribed by Mistral AI (France), acting as our processor, on servers in the European Union and without being used to train its models. That way the assistant can answer them.

We keep the conversation for three years after the last message, like the rest of our support, and then it is deleted automatically. If you'd like it deleted sooner, write to privacidad@sekondo.app or just ask in the chat.

16. Website chat.

The chat on sekondo.app runs on Zendesk, Inc. (USA), which acts as a processor under a data processing agreement (sections 7 and 8).

If you write in the chat, we process the messages you write and any details you choose to give us there, such as your name or email, to help you. The legal basis is the same as for WhatsApp (Art. 6(1)(b) GDPR).

An automated assistant answers you. Whatever it cannot solve, it invites you to email us.

So the conversation carries on when you change page or come back later, Zendesk stores cookies and local storage in your browser (section 14). They are only for the chat: we do not use them for measurement or advertising.

We keep the conversation like the rest of our support messages (section 6). If you want us to delete it sooner, write to privacidad@sekondo.app.

17. Newsletter.

If you sign up for Sekondo news, we use your email to send you Sekondo news, tips and exclusive offers. We use it for nothing else and give it to no one, except Brevo to send it.

You can sign up in two ways. On the website: you leave your email and click the sign-up button. Or by clicking the newsletter sign-up link in an email we have sent you: that click is the sign-up, because the link is personal and only works from your inbox; in that case the free-month code was already in that email and we do not send you another. In both cases we keep the date, the time, your email, the IP address, the language, the browser and the text you accepted, as proof of your consent, for three years.

You can unsubscribe at any time with the link in every email, or by writing to privacidad@sekondo.app. Unsubscribing does not take away a free month you already have.

The free month is one per person and for new accounts only. To check this, we look at whether your email has already had a Sekondo subscription; we do nothing else with that information.

The open and click statistics Brevo gives us are anonymous: they do not tell us who opens each email or who clicks each link.

If you are a customer, we may also write to you about Sekondo news, as stated in section 4; every email includes its unsubscribe link.

18. Business prospecting of professionals.

If you work at a design, imaging or video agency, studio or school, we may write to your business email address to introduce Sekondo. This is separate from the news we send to customers (section 4) and from the notices for people who asked for them: here we mean people who do not know us yet.

• Controller: Sekondo Solutions, S.L.U.
• Purpose: to introduce Sekondo to you and offer you a trial.
• Legal basis: legitimate interest (art. 6.1.f GDPR and art. 19 of the Spanish LOPDGDD).
• Where the data comes from: professional directories and companies’ public websites.
• Data: name, job title, company, business email and country. The business email can be one from a free provider (gmail, hotmail…) if it is the one you use for your business.
• Retention: 3 years from the last contact with no reply. If you ask us not to write to you, we keep only your email in an exclusion list so that we never do it again.
• Your rights: you can object at any time by writing to hola@sekondo.app or by replying to the email, and exercise your rights of access, rectification, erasure, restriction and objection, as well as complain to the Spanish Data Protection Agency or to the authority in your country.