Privacy Policy

PAIQ RAAS, S.L. ("PAIQ", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal data when you use our platform at paiq.io.

Company details:
PAIQ RAAS, S.L.
NIF: B27677392
Málaga, Spain
hello@paiq.io

1. Who This Policy Applies To

This policy applies to:

• Account holders — Instagram creators and businesses who register for PAIQ
• Website visitors — anyone who accesses paiq.io
• Message senders — individuals who send DMs to an Instagram account managed by PAIQ (see Section 6 for the specific legal basis applied to senders)

2. What Data We Collect

We collect the following types of personal data:

Account information

• Name and email address (when you register)
• Billing information (processed by Stripe — we do not store card details)
• Instagram account identifiers (username, account ID)

Instagram message data

• DM content that you authorise PAIQ to process on your behalf
• Sender information from incoming messages (as permitted by Instagram's API and Meta's platform policies)

Usage data

• How you interact with the PAIQ dashboard
• Feature usage and settings preferences
• Log data (IP address, browser type, access times)

3. How We Use Your Data

We use your data to:

• Provide and operate the PAIQ service
• Process and generate AI-powered responses to your Instagram DMs
• Personalise your AI agent to match your communication style
• Send you account-related emails (billing, security, updates)
• Improve our platform and fix issues
• Comply with legal obligations
• Support: when you contact us from the dashboard, we use your message, your email address, the account owner's email address, an account identifier, the business name, plan and interface language to answer you (Art. 6(1)(b) GDPR; for a team member who is not the account owner, our legitimate interest in supporting our customers, Art. 6(1)(f) GDPR). Messages reach our mailbox through Resend, which keeps sent emails for up to 30 days; the copy in our mailbox is kept for 1 year after the last message, or 6 years for messages about billing, payments, refunds or cancellations (art. 30 Código de Comercio), then deleted.
• Preventing repeat use of introductory offers. When an Instagram account is connected during an Agent Trial or an invited free trial, we keep a coded value derived from that account's Instagram ID with a secret key, not the ID itself, so that the same Instagram account cannot use the offer again. We keep it for 13 months after the Instagram account is connected (at least 12 months after the trial ends), even if the PAIQ account is deleted. Legal basis: our legitimate interest in preventing abuse of the offer (Art. 6(1)(f) GDPR).

We do not sell your data to third parties. We do not use your data or your followers' data for advertising. Customer data is never used to train any third-party AI model (see Section 7).

4. Automated Decision-Making and AI Processing

PAIQ uses artificial intelligence to draft and send replies to Instagram DMs on your behalf. You should know:

• AI-generated replies are produced based on the configuration and Skills you set up in your PAIQ account
• You retain full control: you can review, pause, override, or disable automated replies at any time via the dashboard
• We do not make solely automated decisions producing legal or similarly significant effects on data subjects within the meaning of Article 22 GDPR
• Escalation logic is designed to route sensitive interactions (complaints, refund requests, legal threats) to you for human handling: the assistant pauses on that conversation and you reply from the dashboard.

If you have questions about how a specific reply was generated, contact hello@paiq.io.

5. Legal Basis for Processing (GDPR Article 6)

We process your data under the following legal bases:

• Operating the PAIQ service for account holders: Contractual necessity — Art. 6(1)(b)
• Processing incoming DMs from senders: Legitimate interest — Art. 6(1)(f), to enable the account holder to reply on their own behalf
• Service improvement, security, fraud prevention: Legitimate interest — Art. 6(1)(f)
• Marketing emails: Consent — Art. 6(1)(a)
• Billing records, tax compliance: Legal obligation — Art. 6(1)(c)

6. Processing of Message Senders' Data

When a third party sends a DM to an Instagram account managed by PAIQ, we process their message content and Instagram identifiers to enable a reply. We rely on legitimate interest (Art. 6(1)(f) GDPR): the sender has voluntarily contacted the account, the account holder has a reasonable interest in replying, and the processing is limited to what is strictly necessary for that reply.

In addition to the message itself, we save contact details you write in a message, such as your name, email address or phone number, so that the business you wrote to, and its team, can see them in its dashboard, and the owner of its account can download them. We do not use them for anything else.

When you send a direct message to a business that uses PAIQ, we also obtain your Instagram username, name and profile picture from Instagram, so that the business can see who wrote to it and its replies can greet you by name. We keep a copy with the conversation, refresh it at most every 7 days, and delete it together with the conversation. The owner of the business's account can also download your username with the conversation. Your name may be included in the text sent to the AI provider that writes the replies.

Senders may exercise the rights listed in Section 9 by contacting hello@paiq.io.

7. Data Storage, Security, and AI Subprocessors

All customer data is stored on servers located within the European Union (Hetzner, Germany).

We protect your data using:

• AES-256 encryption of off-site backups
• TLS encryption in transit
• Row-level security and tenant isolation in our database
• Access controls limiting who within PAIQ can access data
• Regular security reviews

AI processing: DM content is sent to our AI providers (OpenAI and Anthropic) via API for the sole purpose of generating replies. These providers may retain that content for up to 30 days to monitor for abuse or misuse of their services — or longer where their policies or the law require — and PAIQ does not direct or extend that retention. Under our commercial API terms with them, this content is not used to train their AI models. OpenAI and Anthropic provide this service to us through their Irish companies, OpenAI Ireland Limited and Anthropic Ireland, Limited. Where they process the content in the United States, they make that transfer themselves, under their data processing terms with us.

Instagram message data is processed in real time and is not retained longer than necessary to provide the service.

8. Data Sharing and Subprocessors

We share data only with vetted third-party providers necessary to operate the service. A live subprocessor list is published at paiq.io/subprocessors.

Categories include:

• Payment processing — Stripe (Ireland/US)
• Instagram API — Meta Platforms (Ireland/US)
• AI inference: OpenAI Ireland and Anthropic Ireland, via API, with processing that may extend to the United States; customer data is not used for model training
• Cloud infrastructure: Hetzner (Germany), with encrypted backups on Scaleway (France)
• Email and operational tooling — listed in full at paiq.io/subprocessors

Stripe processes payment data on our behalf as our payment processor; for some purposes, such as fraud prevention and compliance with its legal duties, Stripe acts as an independent controller under its own privacy policy.

International transfers (Chapter V GDPR): Where we send personal data to a provider outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses, supplemented where appropriate by additional technical measures, and on the EU-US Data Privacy Framework where the provider is certified under it. OpenAI, Anthropic and Stripe serve us through companies established in the EU; where they process data outside the EEA, they make that transfer themselves, under their own safeguards. Each provider and its transfer basis is listed at paiq.io/subprocessors.

Our email provider, Zoho, stores email in the EU; Zoho support staff in India may access it remotely for technical support, under Standard Contractual Clauses.

We do not share your data with advertisers, data brokers, or any third party for marketing purposes.

9. Your Rights Under GDPR

As a data subject, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — request deletion of your data ("right to be forgotten")
• Portability — receive your data in a structured, machine-readable format
• Restriction — ask us to limit how we process your data
• Objection — object to processing based on legitimate interest
• Withdraw consent — at any time, where consent was the legal basis
• Not be subject to solely automated decisions with legal or similarly significant effects (Art. 22)

To exercise any of these rights, contact us at: hello@paiq.io
We will respond within 30 days.

Right to lodge a complaint: You also have the right to lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD) — www.aepd.es — or with your local EU data protection authority.

10. Data Retention

We retain your data for as long as your account is active. Upon account deletion:

• Account data is deleted when the account is deleted, except an account identifier, the subscription record (plan, billing dates and the Stripe reference, with no name, email or card data), records of refunds (type of charge, amounts, dates, refund status and reason code, and Stripe references, with no name, email or card data), the checkout consent records described in this section, the coded Instagram value described in section 3, for 13 months after the Instagram account is connected, and, for an invited free trial, the record that an invitation was used (the inviting founder and the dates), for 6 years after the trial ends. The subscription record and the records of refunds are kept for 6 years after account closure (art. 30 Código de Comercio) as the billing records behind the invoices, then deleted. Invoices are kept for 6 years in the systems of our payment provider, Stripe.
• Contract acceptance and checkout consent records (the versions of the Terms and of the declaration you accepted, how and when you accepted, the language, your country, company name, email and tax ID, the price and renewal date shown at checkout, and the Stripe checkout reference, with no card data or IP address) are kept for 6 years after account closure (art. 30 Código de Comercio; Art. 17(3)(e) GDPR), then deleted
• Instagram message content, AI replies and contact details saved from messages are deleted at once when all data is deleted from the dashboard settings, or 30 days after Instagram is disconnected. If a free trial ends without a paid subscription, or a paid subscription ends without renewal, the Instagram connection, message content, AI replies, contact details saved from messages and leads are deleted 30 days after the trial or subscription ends. You can also ask at hello@paiq.io, and we will act within 30 days. Backups expire within a further 30 days.
• If no payment is completed within 7 days of creating an account, we send one reminder and then delete the account and all its data, including the record of the acceptance given when the account was created. If the first payment was refunded, we keep only the payment and refund records and the record of your acceptance at checkout, for as long as the law requires.
• Anonymised, non-identifiable usage statistics may be retained for service improvement

11. Children

PAIQ is not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have collected data from a minor, contact hello@paiq.io and we will delete it.

12. Cookies and local storage

We use only cookies and browser storage that are strictly necessary for the service you request, so no consent is required (art. 22.2 LSSI). We use no analytics or advertising cookies and no third-party tracking.

• Dashboard (app.paiq.io): sign-in cookies that keep you logged in and protect your account. The access cookie lasts 15 minutes and the refresh cookie 7 days, renewed while you use the dashboard. Both are deleted when you sign out. During Google or Instagram sign-in, a security cookie is used that expires within minutes.
• Website (paiq.io): the language you choose, saved in your browser's local storage (paiq-language).
• PAIQ Access (access.paiq.io): the language and theme you choose and the report access code you enter, saved in your browser's local storage (va-idioma, paiq-tema, va-codigo) so that your purchased report stays unlocked.

Local storage remains until you clear it in your browser settings. If we ever add analytics or other optional cookies, we will ask for your consent first and update this section.

13. Data Protection Officer

PAIQ RAAS, S.L. has assessed its obligations under Article 37 GDPR. Privacy and data protection questions can be addressed to hello@paiq.io, where they will be handled by the founders directly. We will appoint a formal Data Protection Officer if and when our processing activities meet the Article 37 thresholds.

14. Data Breach Notification

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the AEPD within 72 hours of becoming aware of it, and notify affected users without undue delay where the risk is high (Articles 33 and 34 GDPR).

15. PAIQ Access (access.paiq.io)

PAIQ Access (access.paiq.io). For the accessibility checker, PAIQ is the data controller for purchase data (buyer email and payment data, processed by Stripe; we do not store card data) and for the URLs submitted for analysis and the audit result. Reports are generated on demand and are not stored on our servers; the content of the analysed page, which may include third parties' personal data, is processed only transiently to generate the report and is not retained. If you choose to receive a report by email, the address and the attached report pass through our email provider (Resend), which retains delivery data for up to 30 days under its own terms, and are not stored by PAIQ. The browser holds only your language, theme and unlock code, on your device. PAIQ does not process personal data on behalf of PAIQ Access customers, including Agency subscribers, so no data processing agreement under art. 28 GDPR applies to that service. Legal bases: performance of a contract (art. 6.1.b GDPR) for the service and delivery, legitimate interest (art. 6.1.f) for security and abuse prevention, legal obligation (art. 6.1.c) for tax and accounting records.

16. Business outreach

Business outreach. Our founders sometimes contact businesses directly, for example by Instagram direct message, to ask whether PAIQ could be useful to them. For this we use public business information: the business name, Instagram username, town or area, website and booking platform, and the public detail we mention in our message. We keep a short record of our messages and the replies. Source: the business's public Instagram profile, website and public listings. Legal basis: our legitimate interest in offering our service to businesses (Art. 6(1)(f) GDPR; for sole traders, art. 19 of Spanish Organic Law 3/2018). If you do not reply, we delete the record 3 months after our message. If you tell us not to write again, we stop at once, delete the record and keep only your Instagram username on a do-not-contact list, for at most 2 years, so that we do not write to you again. You can object at any time by replying to our message or by writing to hello@paiq.io. Your other rights are in section 9.

17. PAIQ's own Instagram account (@hellopaiq)

PAIQ's own Instagram account (@hellopaiq). When you send a direct message to @hellopaiq, PAIQ RAAS, S.L. is the controller of your data. Our AI team member answers your messages and tells you, in its first reply, that the reply was generated by AI; a person from our team may also reply. We process your messages, your Instagram username, name and profile picture, any contact details you write in a message, and the contact record (lead) our dashboard creates from the conversation, to answer you and to tell you about PAIQ. Legal basis: steps taken at your request before a possible contract, when you ask about PAIQ's services (Art. 6(1)(b) GDPR); otherwise, our legitimate interest in answering the messages our account receives (Art. 6(1)(f) GDPR). To write the replies, the text of the conversation is sent to OpenAI Ireland Ltd. and, if that service fails, to Anthropic Ireland, Limited; they do not use it to train their models. The data is hosted by Hetzner Online GmbH in Germany, with encrypted backups at Scaleway in France. Instagram is operated by Meta, which processes your messages as an independent controller under its own privacy policy. We delete the conversation, and the data saved from it, 12 months after the last message; backups expire within a further 30 days. If you become a PAIQ customer, the data in your customer account is kept as described in section 10. You can object, or ask for access or deletion, at any time by writing to us on Instagram or to hello@paiq.io.

18. Changes to This Policy

We may update this policy from time to time. We'll notify registered users by email of material changes and update the "last updated" date above. Continued use of PAIQ after changes constitutes acceptance.

19. Contact

For any privacy-related questions or to exercise your rights:

hello@paiq.io
PAIQ RAAS, S.L. — NIF B27677392 — Málaga, Spain