Privacy Policy

GoGufi, S.L. (CIF: B24836421) ("Gufi", "we", "us") operates the Gufi platform at gufi.dev. Gufi is an AI-powered platform that helps you build business software. This Policy explains how we handle your data, in compliance with the GDPR, Spanish Organic Law 3/2018 (LOPDGDD), and Law 34/2002 on Information Society Services (LSSI-CE).

Contact: hello@gufi.es · GoGufi, S.L., CIF: B24836421, Madrid, Spain.

Account info: Name, email, and password when you register.

Business data: Everything you create in your workspace — modules, tables, records, views, dashboards, automations, and websites. Each company's data is fully isolated; no other company can access it.

AI conversations: Your prompts and chat history with Gufi AI, used to provide the service and maintain context.

Payment info: Processed by Stripe. We never store card details.

Technical data: IP address, browser, device type, and usage metrics collected automatically.

• Provide and operate the platform
• Process your AI requests to build software
• Process payments
• Improve the service
• Prevent fraud and ensure security
• Comply with legal obligations

We do not use your data for advertising. We do not use your business data or prompts to train AI models that benefit other customers.

We do not sell your data. We share data only with:

• Anthropic — AI processing (they do not train on your data)
• Stripe — payment processing
• Infrastructure providers — hosting within the EU
• Authorities — only when required by law

All providers are bound by data processing agreements.

Your data is stored in the European Union. When data is processed outside the EU (e.g., AI processing), we use EU Standard Contractual Clauses to ensure adequate protection.

We use encryption in transit and at rest, strict access controls, and isolated storage per company. We will notify affected users within 72 hours of any confirmed data breach.

You can access, correct, delete, restrict, port, or object to the processing of your data. Contact hello@gufi.es and we'll respond within 30 days. You can also complain to the Spanish Data Protection Agency (AEPD).

We keep your data while your account is active. After deletion: personal and business data are removed within 30 days, backups within 90 days, and billing records as required by law.

In accordance with Art. 22.2 of the LSSI-CE, we use strictly necessary cookies for authentication and session management, which do not require consent. We do not use advertising, analytics, or third-party tracking cookies. If we introduce non-essential cookies in the future, we will request your informed consent before activating them.

In accordance with Art. 21 of the LSSI-CE, we will not send you commercial emails unless you have given your prior consent or there is a pre-existing contractual relationship. In either case, every email includes an easy and free unsubscribe mechanism. You can revoke your consent at any time by contacting hello@gufi.es or using the unsubscribe link.

Gufi is not intended for anyone under 16. If we learn we have collected data from a minor, we will delete it promptly.

We may update this Policy. Material changes will be notified 30 days in advance by email or in-app. Current version always at gufi.dev/privacy.