Legal document

Privacy policy

Last updated: 28 September 2026

This policy explains what data we process when you use Esboza (esboza.com and chat.esboza.com), what for, who we share it with, where it is stored and what control you have over it.

1Who is responsible

The controller of your data is Esboza, a service provided from Spain. For any privacy matter, write to us at soporte@esboza.com.

Esboza is a document agent: you talk to it, it reads the documents you give it (including long and scanned ones), creates new documents —solved assignments with screenshots, reports, guides, presentations, posters and other formats—, edits your Word, Excel or PDF files and saves each delivery as a version in your Library.

2What data we process

The data you give us

The data generated when you use the service

• Technical data: IP address, browser, operating system and language.
• Usage data: which features you use, when, the status of your jobs and your plan usage, which we need in order to measure and charge it.

We don't ask you for special categories of data (health, beliefs, biometric data, etc.). If a document of yours happens to contain them, upload only what is needed for what you are asking.

3Why, and on what basis

We don't build profiles for advertising or combine your data with other sources for that purpose.

4How the AI works with your documents

To answer you and make your documents, Esboza sends the necessary content to providers of artificial intelligence models: OpenAI (chat, document reading, web search and image generation) and Anthropic (writing, reviewing and planning the images of some documents, and reading scanned documents). We use them through their paid API, as data processors: they process the content to return a result to us and don't use it to train their models.

• Web search. When the agent searches the internet, the provider builds the query from your message. Don't include personal data in what you want it to search for.
• Index of your documents. To find passages in long documents, the text of your documents is stored in a private search index for your account at OpenAI. It is deleted when you delete the document or the account, and expires by itself after 30 days without use.
• The sandbox. To edit your files, calculate or convert, the agent works in an environment isolated to your conversation, which closes by itself after a few minutes without use.
• Nobody on our team reads your documents unless you ask us for help with a specific one.

Esboza doesn't make automated decisions with legal effects on you (Article 22 GDPR): what it generates is content that you review and decide to use.

5Memory and context

So that you don't have to explain everything in every conversation, Esboza keeps context about your work in your account:

• The notes and agenda that the agent writes down when you ask it to or when your work needs it (for example, a commitment or a person you work with).
• What you write in “About me”, which the agent takes into account in your conversations. You can edit it or turn personalisation off in Settings.
• A copy of the messages you write, so the agent knows what you are working on and which documents you mean.

If you store names or other details of third parties, do so only when you have a legitimate reason. All of this is deleted when you delete your account.

6Providers

We don't sell your data or your content, or use them to provide services to others. They are processed only on our behalf and under contract by these providers (the list is also in Providers):

We may also share data with professional advisers (legal, tax or accounting) when we need to, and with authorities if a law or a court order requires us to. If Esboza merges, is sold or is acquired, your data will pass to the new owner, which will remain bound by this policy or by a new one we will tell you about beforehand.

7Transfers outside the EU

The AI providers are in the United States, and Stripe and Google may process data there. In those cases the transfer relies on the EU-US Data Privacy Framework, when the provider is certified, or on the European Commission's Standard Contractual Clauses.

8How long we keep it

• Conversations, documents, versions and templates: while your account is active, so you can come back to them.
• What you delete goes to the bin, where you can recover it for 30 days; after that it is erased along with its files.
• The search index of your documents expires after 30 days without use and is deleted along with the document.
• The working files the agent leaves when running code are deleted after 14 days; the sandbox, after a few minutes without use.
• The download links for your documents expire within a few hours.
• If you delete your account we delete your documents, conversations, memory and profile data within 30 days at most.
• Invoices and accounting data: for as long as tax and commercial law requires, even if you have deleted your account.

9Security

Your data travels encrypted (HTTPS) and is stored encrypted at rest. Each document is only accessible from your account, and technical access is limited to those who need it to run the service. If you share a conversation with a link, anyone with that link can see it until you remove it.

No system is invulnerable. If a breach posed a risk to your rights, we will notify the supervisory authority within 72 hours of becoming aware of it and let you know when the law requires it.

10Your rights

You can at any time ask for access to your data, its rectification, erasure or portability, restriction of processing, object to it or withdraw your consent. Write to us at soporte@esboza.com and we will reply within one month (extendable by two more in complex cases, letting you know). You can do many things yourself: download your documents, delete them or delete your account.

If you think we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es).

11Cookies

We use two kinds of cookies and browser storage:

Google Analytics cookies are only set if you accept them in the cookie notice. Without your consent, the website uses Google's consent mode: it may send signals without cookies or identifiers to count visits in aggregate. Outside the European Economic Area, the United Kingdom and Switzerland, analytics is on by default and you can turn it off in the same notice. The chat doesn't use analytics.

You can change your choice at any time from the cookie notice or block cookies in your browser.

12Minors

Esboza is not aimed at children under 16 and we don't knowingly collect their data. We apply 16 in every country, the default threshold in Article 8 GDPR. If we learn that an account belongs to someone under that age, we will delete it.

13Changes and contact

We will update this policy when the service or the law changes. If the change is significant, we will let you know in the service or by email before it applies. The date above is always that of the version in force.

For any question about your data: soporte@esboza.com.

See also the Terms of service.