1. Controller and privacy roles
Owner: GATAVIA GLOBAL, S.L. · Spanish tax ID B05722335 · Calle Rascafría, 67, escalera 11, 28670 Villaviciosa de Odón, Madrid, Spain · info@gatavia.com
Privacy enquiries: info@gatavia.com.
Gatavia acts as controller for data required to manage accounts, contracting, billing, support, security and its own operations. When an owner, manager or company adds personal data about guests, owners, clients or other third parties and determines the purposes of that processing, that customer acts as controller and Gatavia acts as processor under documented instructions.
2. Data we may process
- Identity and contact data
- Account, authentication, preferences and second-factor data where enabled
- Property, owner, guest, booking, income, expense, settlement and professional activity data where linked to an individual
- Documents, contracts, invoices, receipts and files voluntarily uploaded
- Support communications and privacy requests
- Technical and security data required to protect the service, including access logs, events, device, IP address or technical identifiers where appropriate
- Plan, billing and payment-status information; full card details are handled by Stripe
3. Purposes
- Create and protect accounts and sessions
- Provide Gatavia App, Gatavia Check, My Gatavia, Library, memberships and contracted services
- Manage bookings, owners, settlements, documents, financial analysis and requested tax functions
- Process documents only when the user requests extraction or analysis
- Manage purchases, subscriptions, billing, support and rights requests
- Prevent fraud, abuse, unauthorised access and security incidents
- Comply with legal obligations and handle liabilities
- Improve security, performance and operation
- Send marketing communications only where a valid legal basis exists
4. Legal bases
Depending on the processing, Gatavia relies on contract performance or pre-contractual steps, legal obligations, legitimate interests in security, fraud prevention and service improvement, or consent where required.
When Gatavia acts as processor for third-party data, processing is carried out for the customer controller under the data processing agreement and documented instructions.
5. Providers, subprocessors and transfers
Gatavia uses specialist providers including Supabase for database, authentication and storage; Vercel for hosting and application execution; Stripe for payments and subscriptions; Resend for transactional email; and OpenAI when a user invokes specific AI functions.
Only information necessary for each service is provided. Gatavia maintains an internal subprocessor inventory and reviews the relevant purpose, data categories and conditions.
Where processing or access involves third countries, Gatavia applies applicable safeguards such as adequacy decisions, standard contractual clauses or other lawful mechanisms.
6. Artificial intelligence and document analysis
Gatavia's financial AI is designed around data minimisation: primarily totals, ratios, comparisons and necessary categories are sent, while personal identifiers are avoided when they are not needed and certain identifiers accidentally entered in free-text questions are filtered.
When a user expressly requests extraction from an invoice, receipt or other document, the necessary file must be processed to read it. Gatavia limits file types and size, verifies ownership of the private file and configures OpenAI requests with store:false.
OpenAI states that business and API data is not used to train its models by default. Under standard API settings, certain data may currently be retained temporarily for up to 30 days for service delivery and abuse monitoring unless zero-data-retention settings apply. Gatavia does not claim zero retention unless it has been expressly enabled for the relevant service.
7. Security measures
Gatavia applies logical separation by user and account through row-level access policies, private storage for customer documents and temporary signed links for private file access.
Sensitive operations require an authenticated session and additional controls according to risk. My Gatavia supports TOTP two-factor authentication; once enabled, sign-in requires the second factor and certain irreversible actions require step-up verification. New passwords must contain at least 12 characters.
Integration credentials are not exposed to the browser, privileged function permissions are restricted, file types and sizes are limited, and internal logs are maintained for privacy requests and security incidents. No system can guarantee zero risk and controls are reviewed continuously.
8. Retention, account closure and erasure
Operational data is retained while needed to provide the service and manage the contractual relationship. Following an erasure request or termination, data that is no longer needed is deleted or anonymised, while information required by law or for legal claims is blocked or restricted.
Retention periods depend on the data category and applicable law. In Spain, business documentation may be subject to the general six-year retention duty under Article 30 of the Commercial Code, while tax law generally provides four-year limitation periods, subject to interruptions, investigations and special rules.
Gatavia maintains an internal retention schedule by data category and avoids automated deletion where a legal retention duty may apply.
9. Data subject rights
Where applicable, you may request access, rectification, erasure, objection, restriction, portability and withdrawal of consent by contacting info@gatavia.com. Reasonable identity verification may be required.
Gatavia records privacy requests with their date, type, status and audit trail so they can be handled within the applicable legal deadline. An account-deletion request also creates a privacy case and, where the user has enabled 2FA, requires step-up verification before submission.
You may also lodge a complaint with your competent data protection authority.
10. Professional managers and data processing agreement
Where a manager, company or owner uses Gatavia to process third-party personal data on its behalf, Gatavia formalises its processor role through a versioned data processing agreement.
Before access to modules involving owner or guest data, Gatavia may require acceptance of the current agreement. Acceptance is recorded with the user, account, version, date and acceptance method. A new applicable version requires renewed acceptance.
The agreement covers, among other matters, scope and duration, instructions, confidentiality, security, subprocessors, assistance with rights, incidents, return or deletion and audit rights.
11. Incidents and accountability
Gatavia maintains a structured security-incident register covering nature, severity, affected data, containment and risk assessment.
Where legally required, applicable notification procedures and deadlines are followed, including tracking the 72-hour supervisory-authority notification period where relevant.
12. Updates
This policy is updated when law, architecture, functionality, providers or security controls change. The update date identifies the current public version. Material changes to the data processing agreement are also managed through its own versioning and acceptance process.
13. YouTube API Services
Gatavia uses YouTube API Services solely to allow an authorised account to publish videos and Shorts to its own YouTube channel from Gatavia's internal publishing tools.
The connection uses Google OAuth 2.0 and, for uploads, Gatavia requests only the scope required to upload videos (youtube.upload). Gatavia does not use this integration to read private messages, manage advertising, sell data, or access channel information that is not necessary to complete an authorised upload.
To keep the connection active without requiring authorisation for every upload, Gatavia may securely retain the OAuth tokens strictly required for the integration. These tokens are used only to perform actions authorised by the account holder and are not sold or disclosed to third parties for advertising purposes.
Users can revoke Gatavia's access to their Google Account at any time from the third-party connections section of their Google Account. When authorisation is revoked or the integration is no longer required, Gatavia will delete or invalidate the stored credentials linked to that connection as soon as reasonably practicable, subject only to minimal technical records that may need to be retained for security or legal compliance.
Gatavia's use of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.
