Ulula Privacy Policy

Last updated: February 26, 2026

1. Data Controller

In accordance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD), we inform you that the personal data provided through the Ulula Platform will be processed by:

Controller: Sera Creativo (Ulula)
Address: Palencia, Spain
Contact email: frank@seracreativo.com

2. Purpose of Data Processing

Personal data will be processed for the following purposes:

Managing registration and access to the Platform.
Providing services contracted by the Business Client.
Managing billing, charges, and payments through certified external payment processors (see Section 4).
Storing and managing information in external cloud services such as Supabase, acting as a data processor.
Complying with applicable legal and tax obligations in Spain and the European Union, including anti-money laundering (AML) and counter-terrorist financing (CFT) regulations.
Verifying compliance with geographic restrictions and international sanctions applicable to payment services.
Improving service quality through internal statistics and usage analysis (anonymized data where possible).
Communicating news, updates, or incidents related to the service (notifications necessary for the correct provision of the service).

3. Legal Basis for Processing

Data processing is based on:

The execution of a contract (provision of the SaaS service).
Compliance with legal obligations (tax, accounting, anti-money laundering, and international sanctions regulations).
The legitimate interest of Ulula in improving service quality, maintaining Platform security, and preventing fraudulent activities.
Express consent in cases of sending commercial communications (if enabled).

4. Data Recipients

Data may be communicated to or processed by the following data processors, depending on the payment provider assigned based on the geographic location of the Business Client:

4.1 Payment Processors

The Platform uses a multi-provider payment architecture. The specific provider assigned to each Business Client is determined automatically based on their country of incorporation and tax domicile:

| Provider | Jurisdiction | Function | |----------|-------------|----------| | Stripe Payments Europe, Ltd. | Ireland, EU | Subscription and marketplace payment processing | | Redsys Servicios de Procesamiento, S.L. | Spain, EU | Card payment processing (Spanish market) | | PayPal (Europe) S.à r.l. et Cie, S.C.A. | Luxembourg, EU | Alternative payment processing | | Square (Block, Inc.) | USA (with SCCs) | POS and online payment processing |

Each payment provider acts as an independent data processor and operates under its own terms of service and privacy policies. Payment data is shared exclusively with the provider assigned to the Business Client; payment data is never shared between providers.

4.2 Cloud Infrastructure

Supabase Inc., as a data processor for data management and storage in the cloud, with servers located in the European Union (Frankfurt, Germany), under Standard Contractual Clauses approved by the European Commission.

4.3 Third-Party Services

Google LLC, for the services described in the "Integration with Google Services" section of this policy.

4.4 Authorities

In compliance with legal obligations, data may be communicated to the Tax Administration, anti-money laundering authorities, or other competent authorities in Spain and the EU.
No international data transfers outside the European Economic Area will be made unless required by law or with the express consent of the data subject, always ensuring adequate protection measures (Standard Contractual Clauses, adequacy decisions, or Article 49 GDPR derogations).

5. Integration with Google Services

Ulula integrates with several Google services to provide advanced functionalities to users. This section provides clear and transparent details about what Google data we access, how we collect, store, and use it.

5.1 Google Data We Access

The following specifies the exact types of Google user data our application may access:

Authentication and Profile Data

| Data Type | Google Permission | Specific Data Accessed | |-----------|------------------|----------------------| | Identity | openid | Unique Google user identifier | | Email | userinfo.email | Primary email address of the Google account | | Profile information | userinfo.profile | Full name, profile picture (URL), preferred language |

Google My Business Data (optional, businesses only)

| Data Type | Google Permission | Specific Data Accessed | |-----------|------------------|----------------------| | Business information | business.manage | Business name, address, phone, category, opening hours, description | | Posts | business.manage | Post content, images, publication dates | | Reviews | business.manage | Review text, rating, author name, date, responses | | Business photos | business.manage | Image URLs from the business profile |

Google Blogger Data (optional, only if connected)

| Data Type | Google Permission | Specific Data Accessed | |-----------|------------------|----------------------| | Blogs | blogger / blogger.readonly | Blog name, URL, description | | Posts | blogger / blogger.readonly | Title, content, publication date, author |

Google Calendar Data (optional, only if connected)

| Data Type | Google Permission | Specific Data Accessed | |-----------|------------------|----------------------| | Events | calendar | Event title, start/end date and time, description, location, attendees | | Calendars | calendar | Calendar name, time zone, color |

5.2 How We Collect Google Data

Authorization process:

Explicit consent: Before accessing any Google data, the user must initiate the connection process by clicking a clearly labeled button (e.g., "Connect with Google", "Sign in with Google").
Google consent screen: The user is redirected to Google's official consent screen, where they can see exactly what permissions they are granting.
Granular authorization: The user can choose which services to connect. Basic authentication (email, profile) is required to create an account, but additional services (Calendar, My Business, Blogger) are optional.
Token acquisition: After authorization, Google provides access tokens that Ulula uses to access the authorized data.

When data is collected:

Registration/Login: Email and basic profile are accessed to create or authenticate the account.
Service connection: Calendar, My Business, or Blogger data is accessed only when the user explicitly connects each service.
Scheduled synchronization: For connected services, periodic synchronizations are performed to keep data up to date (e.g., new reviews, event changes).

5.3 How We Store Google Data

Data we store:

| Category | What We Store | Where It's Stored | Duration | |----------|--------------|-------------------|----------| | Access tokens | Access token, refresh token | Supabase database (encrypted) | While the connection is active | | Identifiers | Google user ID, connected resource IDs | Supabase database | While the account exists | | Synced data | Business information, events, posts | Supabase database (EU) | While the connection is active | | Temporary cache | API responses for performance | Server memory | Maximum 24 hours |

Storage security measures:

Encryption at rest: All data is stored encrypted in Supabase with AES-256.
Encryption in transit: All communications use HTTPS/TLS 1.3.
Location: Data is stored on European Union servers (Frankfurt, Germany).
Restricted access: Only automated systems and authorized technical personnel can access stored data.
Secure tokens: Google tokens are stored separately and encrypted, never in plain text.

Data we do NOT store:

Google passwords (we never see or store them)
Full email content
Google Contacts
Google Drive data
Search history

5.4 How We Use Google Data

Specific uses by data type:

| Data | Primary Use | Secondary Use | |------|------------|---------------| | Email | Account identification, sending service notifications | Account recovery | | Name and photo | Display in user profile, personalize interface | Display in reservations/orders to the business | | My Business data | Bidirectional business information sync | Respond to reviews from Ulula | | Calendar events | Create reservations as events, sync availability | Send reminders | | Blogger posts | Publish business content to the connected blog | Display publication history |

Uses we do NOT make:

We do not sell data: Google data is never sold, rented, or commercialized to third parties.
We do not advertise: Data is not used to display personalized advertising nor shared with advertising networks.
We do not profile: We do not create behavioral profiles or predictive analytics with Google data.
We do not transfer to third parties: Google data is not shared with other companies, except for necessary data processors (Supabase for storage).

5.5 Sharing of Google Data

Data shared within Ulula:

Between user and business: When a user makes a reservation or order, the business can see the user's name and email.
Between team members: Business team members with appropriate permissions can see the Google data connected to the business.

Data shared with third parties:

| Third Party | Data Shared | Purpose | |-------------|-------------|---------| | Supabase Inc. | All stored data | Database infrastructure (data processor) | | None other | - | We do not share Google data with any other third party |

5.6 User Control and Revocation

How to view stored Google data:

Log in to your Ulula account.
Go to Settings > Account.
In the "Connected services" section you will see what Google data is connected.

How to disconnect Google services:

In Ulula: Go to Settings > Account > Connected services > "Disconnect".
In Google: Visit https://myaccount.google.com/permissions and revoke access for "Ulula".

What happens when you disconnect:

Access tokens are immediately deleted.
Synced data (e.g., copied business information) remains until the user deletes it or requests its deletion.
Ulula can no longer access new Google data.

Request data deletion:

Send an email to frank@seracreativo.com requesting the deletion of your Google data. We will proceed within a maximum of 30 days.

5.7 Compliance with Google Policies

Ulula complies with:

Google API Services User Data Policy, including Limited Use requirements.
Google APIs Terms of Service.
Google Privacy Policy.

Limited Use requirements we comply with:

We limit data use to providing or improving user-facing features.
We do not transfer data to third parties except as necessary to provide the service.
We do not use data for personalized advertising.
We do not allow humans to read user data except with explicit consent or for security/legal compliance.

6. Data Retention

Data will be retained for the duration of the contractual relationship with the Business Client. Once the relationship has ended, data will be kept blocked for the time necessary to comply with legal obligations:

6 years for tax and accounting documentation (Spanish General Tax Law and Commercial Code).
5 years for data derived from anti-money laundering obligations (Law 10/2010).
3 years for transaction data for claims purposes (general statute of limitations for personal actions under the Civil Code).

After these periods, data will be securely and irreversibly deleted.

7. User Rights

Users have the right to:

Access: Know what personal data is being processed.
Rectification: Correct inaccurate or incomplete data.
Erasure: Request the deletion of data when it is no longer necessary for the purposes for which it was collected.
Restriction of processing: Restrict processing under certain circumstances.
Objection: Object to the processing of their data.
Portability: Request the transfer of data to another service provider in a structured, commonly used format.

To exercise these rights, you must send a request along with a copy of your identity document to: frank@seracreativo.com. The maximum response time is 30 days. If unsatisfied with the response, the user may file a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

8. Data Security

Ulula adopts the necessary technical and organizational measures to ensure the security of personal data, including:

Encryption in transit (HTTPS/TLS 1.3) and at rest (AES-256)
Role-based access control (RBAC)
Storage in GDPR-compliant cloud services with servers in the European Union
Access monitoring and auditing
Security incident response procedures in accordance with Article 33 of the GDPR (notification to the supervisory authority within 72 hours)

9. Use of Cookies

The Platform may use technical cookies necessary for the operation of the service and, where applicable, analytical or third-party cookies (with prior user consent). Please refer to our Cookie Policy for more information.

10. Policy Updates

Ulula reserves the right to modify this Privacy Policy to adapt it to legislative, technical, or third-party service changes. Any changes will be visibly notified on the Platform with a minimum of 30 days' notice.