Privacy Policy
Last updated: 13 October 2026
1. Who we are
Groundstop is operated by Begoña Prats Escobar, sole trader (empresaria individual), NIF 43117147J, C/ Lepant 270, bajos, 08013 Barcelona, Spain. Contact for any privacy matter: hola@groundstop.eu.
This policy covers two different roles. For data about our own users we act as controller. For data contained in the events your agents send us we act as processor on your behalf, under our Data Processing Agreement.
2. Data about our users (we are controller)
| Data | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|
| Account email, sign-in method, password hash | Create and secure your account | Performance of contract (6.1.b) |
| Acceptance date and version of Terms/DPA | Evidence of agreement | Legal obligation and legitimate interest (6.1.c, 6.1.f) |
| Billing data, if a paid plan is offered | Invoicing and tax records | Contract and legal obligation (6.1.b, 6.1.c) |
| Technical usage data (IP address, request logs, errors) | Security, abuse prevention and reliability | Legitimate interest (6.1.f) |
| Service emails you request (confirmation, password reset) | Account operation | Performance of contract (6.1.b) |
We do not sell personal data, do not use advertising trackers and do not profile users.
3. Data processed on behalf of users (we are processor)
Your automations send event payloads (action, target, amount, status and optional details). These may include personal data of your own customers. You decide what is sent and why; we process it only to provide the service: storing the log, evaluating your rules, sending the alerts you configure and, if you add your own AI key, generating summaries with the provider you choose.
4. Data minimisation and redaction
By default, before anything is stored or sent to an AI provider, Groundstop automatically redacts email addresses (keeping a hint such as m***@gmail.com), phone numbers, payment card numbers, IBANs and national ID numbers, truncates long text fields to 500 characters and removes large content such as email bodies, HTML, base64 data and attachments. You can disable redaction in Settings; if you do, you are responsible for the data you send.
5. Retention
- Event logs, pre-action checks and alerts: deleted automatically after the period you choose (7, 30 or 90 days; 30 by default).
- Account data: kept while your account exists and deleted immediately when you delete it.
- Billing records, if any: kept for the period required by Spanish tax law.
- Infrastructure backups maintained by our hosting provider may persist for a short rotation period before being overwritten.
6. Subprocessors and recipients
We use a limited set of providers to host and run the service. The current list is on the Subprocessors page. Notification channels (Slack, Discord, Telegram) and AI providers (OpenAI, Anthropic, Google) only receive data if you configure them, under your own account.
Web fonts are hosted with Groundstop and served by our hosting infrastructure, not by a separate font provider.
7. International transfers
Our database is hosted in the European Union (Ireland). Some providers are established in the United States or may access data from outside the EEA. Where this happens, transfers rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.
8. Your rights
You can request access, rectification, erasure, restriction, portability and object to processing based on legitimate interest. Most rights can be exercised directly in Settings ("Export my data" and "Delete my account"); otherwise write to hola@groundstop.eu. We answer within one month.
If you are a customer of one of our users, please contact that business first: they are the controller of your data. We will assist them in answering your request.
You have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or your local supervisory authority.
9. Security
Encryption in transit (TLS) and at rest, encrypted storage of AI keys, per-agent secret tokens, row-level access control and automatic deletion. Details on the Security page.
10. Changes
We will notify material changes by email or in the app before they take effect.