Privacy Policy

At LicitaHub (operated by Recisur S.L., Spain) we are committed to protecting your privacy. This policy explains what data we collect, how we use it and your rights.

1. Data Controller

Recisur S.L. · privacy@licitahub.com

2. Data We Collect

• Account data: name, email address and password (bcrypt-hashed).
• Organisation data: company name, tax ID and country.
• Usage data: saved tenders, configured alerts, uploaded documents, pipeline activity.
• Technical data: IP address, browser type, OS, access logs.
• Payment data: processed entirely by Stripe. LicitaHub does not store card numbers or bank details.

3. Purposes and Legal Basis

• Service provision (contract performance, Art. 6.1.b GDPR).
• Transactional communications (legitimate interest, Art. 6.1.f): alert notifications, action confirmations.
• Marketing (consent, Art. 6.1.a): newsletters, only if explicitly accepted.
• Legal obligations (Art. 6.1.c): invoicing, tax records.
• Security and fraud prevention (legitimate interest, Art. 6.1.f).

4. Recipients and Sub-processors

• Supabase Inc. (USA) — Database and authentication. EU Standard Contractual Clauses.
• Stripe Inc. (USA) — Payment processing. PCI DSS Level 1 certified.
• Anthropic PBC (USA) — AI analysis of tenders. Anonymised data.
• Vercel Inc. (USA) — Web hosting. EU Standard Contractual Clauses.

We do not sell your data or share it for advertising purposes.

5. International Transfers

Transfers outside the EEA are carried out with appropriate safeguards under Art. 46 GDPR (Standard Contractual Clauses or EU adequacy decisions).

6. Retention Periods

• Active account data: for the duration of the contractual relationship.
• After account deletion: anonymised within 30 days; audit logs retained 12 months.
• Billing data: 5 years (Spanish tax law).

7. Your Rights (GDPR)

Send requests to privacy@licitahub.com with a copy of your ID:

• Access — obtain a copy of your data.
• Rectification — correct inaccurate data.
• Erasure ("right to be forgotten").
• Restriction of processing.
• Data portability — receive data in structured format.
• Objection — to processing based on legitimate interest.
• No automated decision-making — AI analysis is advisory only.

You may lodge a complaint with your national data protection authority. In Spain: AEPD.

8. Security

We apply appropriate technical and organisational measures: TLS 1.3 encryption in transit, encryption at rest, role-based access control, multi-factor authentication for administrators, audit logs and periodic security reviews.

9. Minors

LicitaHub is intended exclusively for professionals and businesses. We do not knowingly collect data from persons under 18.

10. Changes to This Policy

We will notify material changes by email at least 30 days in advance.