Privacy policy

Last updated: 9-nov-2026

This policy explains what personal data we process, why, who we share it with and what rights you have. It covers two Thallein services:

• the thallein.com website and its contact form;
• GuionCreator, our tool for content creators.

The Spanish version is the one that prevails: Política de privacidad.

1. Who is the controller

The data controller is Thallein. GuionCreator is a Thallein service, so Thallein is also the controller of the data GuionCreator processes.

• Company name: Thallein Digital Solutions, S.L.
• Tax ID (NIF): B05650627
• Registered office: Avenida de la Aurora, nº 81, A derecho, 4º, 2, Málaga
• Email for privacy matters: legal@thallein.com

2. Thallein website (thallein.com)

Contact form

• Data: your full name, your email address, the reason for your inquiry and your message.
• Why: to answer you and, if you ask for it, to prepare a quote.
• How: the website does not store your message. It sends it by email, through Resend, to contacto@thallein.com, where we read it and answer you.
• Legal basis: if you ask us for a quote or a service, taking steps at your request before entering into a contract (article 6.1.b GDPR). For any other inquiry, our legitimate interest in answering whoever writes to us (article 6.1.f GDPR).
• Retention: one year from our last exchange, unless we start working together.

Spam protection (Google reCAPTCHA)

To check that a person, not a program, sends the form, the home page uses Google reCAPTCHA. Google receives technical data about your browser and device, such as your IP address, and may use cookies. We do this based on our legitimate interest in protecting the form from abuse (article 6.1.f GDPR). Google processes that data under its privacy policy and its terms of service.

Fonts

The website loads its fonts from Adobe Fonts and Google Fonts. When you open it, your browser connects to Adobe's and Google's servers, which receive your IP address and technical data about your browser.

Technical data about visits

The server that hosts the website may log technical data about each visit, such as the IP address, the date and the page requested, to serve it and for security (legitimate interest, article 6.1.f GDPR). Retention: 90 days at most.

thallein.com uses no analytics tools and no advertising cookies. Its only own cookie, form_data, keeps the result of a form submission for 60 seconds so it can be shown to you.

3. GuionCreator (guioncreator.com)

Your account

• Data: your name, your email address and your password. We only store a bcrypt hash of the password, never the password itself. We also store the date you signed up and whether you have completed the initial setup.
• Creator profile: what you tell us so that scripts sound like you: creator name, creator type, project and its description, target audience, tone, platforms, traits of your writing style (rules, sample phrases, what you never do) and production preferences.
• Why: to create and maintain your account and provide the service.
• Legal basis: performance of the contract you accept when you sign up (article 6.1.b GDPR).

The content you create

• Your projects (title, description, tags, platform, length, status, notes, dates and tasks) and your scripts, with their briefs and production notes.
• The context documents (PDF, TXT or Markdown) and drafts (Word, Markdown or text) you import. We store the text we extract from them, not the file.
• The files you upload, such as images, videos or audio.
• The videos GuionCreator generates from your scripts.
• If you dictate by voice, we send the audio to OpenAI to transcribe it and return the text to you. We do not store the audio.

We process this content to provide the service (performance of the contract, article 6.1.b GDPR).

Artificial intelligence

To generate and review scripts we send Anthropic, which provides the Claude AI model, the information each request needs: your creator profile, the project details, the brief, the context documents and drafts and, if you have connected YouTube, the titles and statistics of your videos.

If you set up your own key for an AI provider (Anthropic, OpenAI, DeepSeek, Groq or Google Gemini), we store the key encrypted and send that same content to the provider you choose, using your key. That provider processes the data under the contract you have with it.

Payments

• Payments are made with Stripe. You enter your card details on Stripe's pages and they never go through our servers.
• We share your email address and your user ID with Stripe. We store your Stripe customer and subscription IDs, your plan, its status and dates, the credits you buy and the history of refunds and disputes.
• If you open a dispute or a chargeback on a payment, the account may be suspended automatically. To handle refunds and disputes, our team receives an internal Discord alert with your user ID, your email address, the amount, the reason and the Stripe IDs.
• Legal basis: performance of the contract (article 6.1.b GDPR), compliance with our tax and accounting obligations (article 6.1.c GDPR) and our legitimate interest in preventing fraud and handling disputes (article 6.1.f GDPR).

YouTube connection

It is optional. If you connect your channel, Google gives us read-only access with the youtube.readonly and yt-analytics.readonly scopes. We only read data from your own channel:

• the channel's ID, name and image;
• your latest videos, with their title, thumbnail, date, views and likes;
• your videos' statistics: views, watch time, average view duration, percentage viewed, likes and dislikes, number of comments, shares, audience retention curve and traffic sources. We do not read the text of comments.

We use it to show you how your videos perform and so that new scripts learn from what works for you. We store the channel details, the access tokens (the long-lived one, encrypted) and the statistics you look up.

GuionCreator uses YouTube API Services. By connecting your channel you agree to the YouTube Terms of Service, and Google processes your data under its privacy policy. You can revoke access at any time from GuionCreator or from the Google security settings page.

LinkedIn connection

It is optional. If you connect your LinkedIn account, you grant us the openid, profile, email and w_member_social scopes. With them GuionCreator does three things:

• Identify your profile. We read your member ID, your name and your photo to show you which account you have connected. LinkedIn also returns your email address, but we do not store it.
• Post on your behalf. We only post when you ask us to from GuionCreator: text, text with a link or text with an image, with the visibility you choose (public or connections only). The image goes through our server only to upload it to LinkedIn and we do not store it. For each post we store the text, the visibility, the link, the content type, the project it belongs to and its LinkedIn ID.
• Show your posts' statistics. We look up the reactions (and their type), comments and shares of each post and, when LinkedIn gives us access, its impressions. To count reactions LinkedIn tells us who reacted: we only count reactions by type and do not store who reacted.

We use it so that you can post without leaving GuionCreator and see how your posts perform. We do not send your LinkedIn data to AI models, we do not sell it and we do not use it for advertising. We store the LinkedIn access tokens (the long-lived one, encrypted).

You can disconnect LinkedIn at any time from GuionCreator, and we then delete the access tokens. You can also revoke access from LinkedIn's privacy settings. The record of what you posted from GuionCreator and its statistics are kept in your projects while you have the account; if you want us to delete them sooner, write to us. LinkedIn processes your data under its own privacy policy.

Instagram connection

It is optional and works with professional accounts. If you connect your account, you grant us the instagram_business_basic and instagram_business_manage_insights scopes, and we read:

• your ID, username, account type, profile picture and number of followers;
• your latest posts, with their caption, link and number of likes and comments;
• the statistics of each post (impressions, reach, saves, shares and plays) and those of your account over the last 30 days.

We use it to show you how your posts perform. When you disconnect Instagram we delete the access token and the stored posts. The account statistics are kept while you have your GuionCreator account. Meta processes your data under its own privacy policy.

The YouTube, LinkedIn and Instagram connections are features you turn on, and we process them to provide the service (performance of the contract, article 6.1.b GDPR).

Technical data and logs

The servers log technical data about requests (IP address, date and path requested) and application logs, which may include your user ID and parts of the content you generate. We use them to run the service, find errors and for security (legitimate interest, article 6.1.f GDPR). Retention: 90 days at most.

Storage in your browser

GuionCreator uses no cookies and no analytics tools. It only stores in your browser what it needs to work: your session (vf_token, in localStorage, which expires after 7 days) and two interface preferences (rdk.kanban.collapsed and rdk.profile_progress.dismissed). Fonts are loaded from Google Fonts, which receives your IP address.

4. Who we share your data with

We do not sell your data or use it for advertising. We only share it with the providers we need to run the services, which process it on our behalf:

• Hetzner (Germany): hosting of both websites and of GuionCreator's files, in its Falkenstein data center (Germany).
• MongoDB Atlas (MongoDB, Inc., USA): GuionCreator's database.
• Resend (USA): delivery by email of the messages sent through the thallein.com form.
• BanaHosting (servers in the USA): the contacto@thallein.com mailbox, where form messages arrive.
• Google: reCAPTCHA and Google Fonts.
• Adobe: Adobe Fonts on thallein.com.
• Stripe: GuionCreator payments.
• Anthropic (USA): GuionCreator's AI model.
• OpenAI (USA): voice dictation transcription.
• Discord (USA): internal alerts about refunds and disputes.

When you connect YouTube, LinkedIn or Instagram, or use your own key for an AI provider, we exchange data with that company following your instructions. Each of them processes it as a controller, under its own privacy policy. We may also disclose data to the authorities when the law requires it.

5. International transfers

Some providers are in the United States or may process data there: Anthropic, OpenAI, Discord, Google, Adobe, MongoDB, Resend, BanaHosting and, depending on the case, Stripe, LinkedIn and Meta. Those transfers rely on the EU-U.S. Data Privacy Framework when the provider has joined it and, otherwise, on the standard contractual clauses approved by the European Commission. If you use your own key for an AI provider, the data goes to that provider's country; for example, DeepSeek is in China.

6. How long we keep your data

• Contact form messages: one year from our last exchange, unless we start working together.
• GuionCreator account and its content: while you have the account. If you ask us to delete it, we do so within 30 days, except for data the law requires us to keep.
• Payment and billing data: 6 years, as required by article 30 of the Spanish Commercial Code.
• YouTube, LinkedIn and Instagram access tokens: until you disconnect the account.
• Social media posts and statistics: while you have the account.
• Generated videos: while you have the account.
• Technical logs: 90 days at most.

7. Your rights

You can ask us to access, correct or delete your data, object to its processing or ask us to restrict it, and receive it in a format you can take to another service. Write to us at legal@thallein.com saying which right you want to exercise. If needed, we will ask you to prove your identity. We will answer within one month.

In GuionCreator you can also, yourself, edit your profile, delete projects and files, disconnect YouTube, LinkedIn or Instagram and export each project. To delete your account, write to us.

If you think we have not handled your data properly, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. Security

We use encrypted connections (HTTPS), we store passwords with bcrypt and we encrypt the long-lived YouTube and LinkedIn access tokens and the AI keys you give us.

9. Minors

GuionCreator is not intended for anyone under 18.

10. Changes to this policy

If we change this policy, we will publish the new version on this page with its update date. See also the legal notice.