Legal

Privacy Policy

How PAIQ RAAS, S.L. collects, uses, and protects your personal data.

Last updated October 8, 2026
Framework GDPR + LOPDGDD
Questions hello@paiq.io
Last updated: October 8, 2026  ·  Governing law: Spain (GDPR + LOPDGDD)

PAIQ RAAS, S.L. ("PAIQ", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal data when you use our platform at paiq.io.

Company details:
PAIQ RAAS, S.L.
NIF: B27677392
Málaga, Spain
hello@paiq.io

1. Who This Policy Applies To

This policy applies to:

2. What Data We Collect

We collect the following types of personal data:

Account information

Instagram message data

Usage data

3. How We Use Your Data

We use your data to:

We do not sell your data to third parties. We do not use your data or your followers' data for advertising. Customer data is never used to train any third-party AI model (see Section 7).

4. Automated Decision-Making and AI Processing

PAIQ uses artificial intelligence to draft and send replies to Instagram DMs on your behalf. You should know:

If you have questions about how a specific reply was generated, contact hello@paiq.io.

5. Legal Basis for Processing (GDPR Article 6)

We process your data under the following legal bases:

6. Processing of Message Senders' Data

When a third party sends a DM to an Instagram account managed by PAIQ, we process their message content and Instagram identifiers to enable a reply. We rely on legitimate interest (Art. 6(1)(f) GDPR): the sender has voluntarily contacted the account, the account holder has a reasonable interest in replying, and the processing is limited to what is strictly necessary for that reply.

In addition to the message itself, we save contact details you write in a message, such as your name, email address or phone number, so that the business you wrote to, and its team, can see them in its dashboard, and the owner of its account can download them. We do not use them for anything else.

Senders may exercise the rights listed in Section 9 by contacting hello@paiq.io.

7. Data Storage, Security, and AI Subprocessors

All customer data is stored on servers located within the European Union (Hetzner, Germany).

We protect your data using:

AI processing: DM content is sent to our AI providers (OpenAI and Anthropic) via API for the sole purpose of generating replies. These providers may retain that content for up to 30 days to monitor for abuse or misuse of their services — or longer where their policies or the law require — and PAIQ does not direct or extend that retention. Under our commercial API terms with them, this content is not used to train their AI models. OpenAI and Anthropic provide this service to us through their Irish companies, OpenAI Ireland Limited and Anthropic Ireland, Limited. Where they process the content in the United States, they make that transfer themselves, under their data processing terms with us.

Instagram message data is processed in real time and is not retained longer than necessary to provide the service.

8. Data Sharing and Subprocessors

We share data only with vetted third-party providers necessary to operate the service. A live subprocessor list is published at paiq.io/subprocessors.

Categories include:

International transfers (Chapter V GDPR): Where we send personal data to a provider outside the European Economic Area, we rely on the European Commission's Standard Contractual Clauses, supplemented where appropriate by additional technical measures, and on the EU-US Data Privacy Framework where the provider is certified under it. OpenAI, Anthropic and Stripe serve us through companies established in the EU; where they process data outside the EEA, they make that transfer themselves, under their own safeguards. Each provider and its transfer basis is listed at paiq.io/subprocessors.

Our email provider, Zoho, stores email in the EU; Zoho support staff in India may access it remotely for technical support, under Standard Contractual Clauses.

We do not share your data with advertisers, data brokers, or any third party for marketing purposes.

9. Your Rights Under GDPR

As a data subject, you have the right to:

To exercise any of these rights, contact us at: hello@paiq.io
We will respond within 30 days.

Right to lodge a complaint: You also have the right to lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD) — www.aepd.es — or with your local EU data protection authority.

10. Data Retention

We retain your data for as long as your account is active. Upon account deletion:

11. Children

PAIQ is not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have collected data from a minor, contact hello@paiq.io and we will delete it.

12. Cookies and local storage

We use only cookies and browser storage that are strictly necessary for the service you request, so no consent is required (art. 22.2 LSSI). We use no analytics or advertising cookies and no third-party tracking.

Local storage remains until you clear it in your browser settings. If we ever add analytics or other optional cookies, we will ask for your consent first and update this section.

13. Data Protection Officer

PAIQ RAAS, S.L. has assessed its obligations under Article 37 GDPR. Privacy and data protection questions can be addressed to hello@paiq.io, where they will be handled by the founders directly. We will appoint a formal Data Protection Officer if and when our processing activities meet the Article 37 thresholds.

14. Data Breach Notification

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the AEPD within 72 hours of becoming aware of it, and notify affected users without undue delay where the risk is high (Articles 33 and 34 GDPR).

15. PAIQ Access (access.paiq.io)

PAIQ Access (access.paiq.io). For the accessibility checker, PAIQ is the data controller for purchase data (buyer email and payment data, processed by Stripe; we do not store card data) and for the URLs submitted for analysis and the audit result. Reports are generated on demand and are not stored on our servers; the content of the analysed page, which may include third parties' personal data, is processed only transiently to generate the report and is not retained. If you choose to receive a report by email, the address and the attached report pass through our email provider (Resend), which retains delivery data for up to 30 days under its own terms, and are not stored by PAIQ. The browser holds only your language, theme and unlock code, on your device. PAIQ does not process personal data on behalf of PAIQ Access customers, including Agency subscribers, so no data processing agreement under art. 28 GDPR applies to that service. Legal bases: performance of a contract (art. 6.1.b GDPR) for the service and delivery, legitimate interest (art. 6.1.f) for security and abuse prevention, legal obligation (art. 6.1.c) for tax and accounting records.

16. Changes to This Policy

We may update this policy from time to time. We'll notify registered users by email of material changes and update the "last updated" date above. Continued use of PAIQ after changes constitutes acceptance.

17. Contact

For any privacy-related questions or to exercise your rights:

hello@paiq.io
PAIQ RAAS, S.L. — NIF B27677392 — Málaga, Spain