Privacy Policy

The data controller for Picacho is JEAR TECNICA S.A. (NIF A28847549), Paseo de la Castellana 259, 28046 Madrid, Spain. You can reach us using the contact details shown at the top of this page.

If you believe your data has been handled improperly, you can also lodge a complaint with the Spanish data protection authority (AEPD, aepd.es) or your local supervisory authority in the EU.

Account information: your email address and password (handled by our authentication provider), and optionally a username, company, and self-reported gender.

Character and content data: the character profiles you create (traits, reference images), the prompts you write, the images and videos generated for you, your notes, and your project organization.

Usage data: pages you visit and when, plus (once the app is deployed to production) an approximate country derived from your IP address, used to understand product usage.

Error reports: if the app hits a fault while you are signed in, we record an automatic report on your account — what went wrong, the page you were on, your browser and device, the browser's own identifier (user agent), and the technical trace, trimmed to 1,000 characters. Administrators read these to fix the fault, and they are deleted with your account. Nothing is recorded for signed-out visitors.

Cookies: small identifiers used to remember your theme and language, and — for logged-out visitors — an anonymous visitor ID for basic traffic analytics.

Payment information: payment details are collected and processed directly by our payment processor, Stripe. We never see or store your full card number — we keep only a reference to your Stripe customer and subscription so we can manage your plan.

To provide and operate the service — running the generation pipeline, storing your content, and keeping you signed in.

To maintain and improve reliability, including aggregate usage statistics about which features are used.

To communicate with you about your account.

To detect abuse and enforce our Terms of Service.

Prompts you submit are sent to third-party AI providers to draft, review, and generate your content. These providers process your prompt text — and, for image generation, a reference photo if you've added one — to produce a result. We don't control how these providers otherwise handle data beyond the terms of our agreements with them.

Generated images and videos are stored in our cloud storage and are only accessible to your account, and to Picacho administrators for support and safety purposes.

Some video models refuse photos of real people. If a character is you, you can choose to verify your face so those models can use your photos. It is optional, it is only offered for your own face, and saying no does not affect anything else in Picacho.

What happens: our provider BytePlus (BytePlus Pte. Ltd., Singapore), which runs the Seedance video models, records a short live face check on its own page to confirm that a real person is present (not a photo, a replay or a mask). After a successful check, BytePlus keeps one reference image of your face. Up to three photos of the character you choose are then sent to BytePlus and compared with that reference image to confirm they show the same person; photos that do not match are not used. The facial information involved is the images and video from the check and the facial features extracted from them.

Why: only so the video models accept your own photos in videos you create from your own account. Your verified face is never used for anyone else's videos, for profiling or for advertising, and is not shared beyond BytePlus, which processes it only on our instructions.

Consent and records: we ask for your explicit consent before the check starts, and we keep a record of when you consented and to which version of this notice.

Where and for how long: BytePlus stores your facial information in its Southeast Asia region, outside the European Economic Area. It is kept until you remove your verification on the character page or delete your account. Removing your verification, or deleting your account, deletes it at BytePlus; if BytePlus cannot be reached at that moment, we retry every day until it is done.

Your rights: you can withdraw your consent at any time on the character page, which stops the processing at once. To access, correct or delete your facial information, or for any other request about it, contact us at the support email shown in Settings — requests come to us, not to BytePlus.

We use cookies for essential functionality — staying signed in, remembering your theme and language — and for basic, privacy-conscious analytics, such as page views and approximate country, so we can understand how the product is used. We do not sell this data.

We share data with the service providers who help us run Picacho: our database, authentication, and file storage provider; our hosting provider; our AI generation providers; and, once enabled, our payment processor. We do not sell your personal information to third parties.

We keep your account and content for as long as your account is active. If you delete your account from Settings, your profile, characters, generations, notes, and projects are permanently deleted. Anonymized traffic records that can't be linked back to you may be retained for analytics.

You can view and edit your account details, change your password, and permanently delete your account at any time from Settings. Picacho is operated from Spain, so the EU General Data Protection Regulation (GDPR) applies to how we process your personal data: you have the rights of access, rectification, erasure, restriction, portability, and objection. To exercise any of them, contact us at the support email shown in Settings and we'll respond within the timeframes the GDPR requires. You also have the right to lodge a complaint with the Spanish data protection authority (AEPD) or the supervisory authority where you live.

Picacho is not directed at, and may not be used by, anyone under 18. We do not knowingly collect information from minors.

We use industry-standard practices — encrypted connections, access controls, and row-level security on our database — to protect your information. No method of storage or transmission is 100% secure.

We may update this policy as the product evolves. We'll update the date above whenever we do.

Questions about this policy? Reach us at the support email listed in Settings.