Privacy policy

This policy explains what personal data we process when you use Slibur or visit this website, why we use it, on what legal basis, who we share it with and what rights you have. We comply with the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights.

1. Data controller

• Company: SELSPY AGENCY S. COOP.
• Tax ID (NIF): F75988824
• Registered address: Paseo la Fuente 9, 4.º A, 30007 Murcia (Spain)
• Contact: contact@slibur.com

2. What data we process

• Account data: first name, last name, email address and password (stored with irreversible encryption), or your Google account identifier if you sign in with Google.
• Workspace data: brand name, website, competitors, prompts, language and country, members and invitations, and the tracking results.
• Billing data: plan, subscription status, amounts and Stripe customer and subscription identifiers. Your card details are handled directly by Stripe: we never see or store them.
• Messages: what you send us through the contact form or by email (name, email, topic and message).
• Technical data: IP address, browser type and access logs needed for the security and operation of the service.

3. Why we use it and on what legal basis

• To create and manage your account, provide the service and support you. Legal basis: performance of the contract.
• To charge subscriptions and issue invoices. Legal basis: performance of the contract and compliance with tax and accounting obligations.
• To send you emails about the service, such as access, invitations, trial reminders, payments, the weekly summary with its alerts and important changes. Legal basis: performance of the contract. You can turn the weekly summary off in Settings or with one click from the email itself.
• To reply to the messages you send us. Legal basis: your consent when you write to us.
• To protect the service against abuse and fraud, and to improve it with aggregated data. Legal basis: legitimate interest.
• To send you product news, only if you agree. Legal basis: consent, which you can withdraw at any time.

We do not make automated decisions with legal effects on you and we do not build profiles for advertising.

4. AI providers and prompts

To provide the service we send the prompts in your workspace to artificial intelligence providers: OpenAI (ChatGPT), whose answers we read on chatgpt.com through DataForSEO or request through OpenRouter, Anthropic (Claude), Google, through DataForSEO (Google AI Overviews) or the Gemini API, Perplexity and xAI (Grok). We also use AI models to analyse the answers and to prepare your improvements.

Prompts are questions about your industry, your products or your brand and never include personal data: we do not send your name, your email or any other account details. Please do not write personal data in them either.

Our free ChatGPT sources tool works without an account. The question you type goes to OpenAI’s moderation service and, through DataForSEO, to chatgpt.com, so please leave out anything personal. We store the reading for 7 days (the sources, the results and the searches ChatGPT ran, which can echo your question) with a fingerprint of the question, not its text, and a fingerprint of your IP address for 24 hours to apply the daily limit. The domain you type stays in your browser and never reaches us.

5. Who we share data with

Only with the providers that help us run the service. They act as data processors and we have signed the agreements the GDPR requires with them:

• Hosting of the application and database on servers located in the European Union.
• Stripe, to process payments and manage subscriptions and invoices.
• Resend, to send the service emails.
• OpenAI (through DataForSEO or OpenRouter), Anthropic, Google (through DataForSEO or the Gemini API), Perplexity and xAI, which process prompts as explained in the previous section. Some of these requests are routed through OpenRouter, which forwards them to the provider.
• Brand logos: our servers download the public icon of each brand's website to show it in the app and on this site. Your browser does not contact any third party for this.

If you choose to sign in with Google, Google provides us with your name and email to identify you. We do not sell your data. We only share data for advertising with Reddit, and only if you accept it (see the Cookies section). We will only disclose it to authorities when the law requires us to.

6. Affiliate program

If someone recommended Slibur to you

If you arrived through the recommendation of one of our affiliates (with their link or their code), we tell them that you subscribed, to which plan and the amount before VAT of each payment on which they earn their commission, never your personal details: they see you as a numbered customer (for example “Customer 3 · Growth”), without your name, your email or your brand. The legal basis is our legitimate interest in running the program and paying the commissions we owe. To prevent fraud in the program we also check, without seeing your card, whether the identifier Stripe gives us for the card you pay with matches one used by that affiliate. We keep the record of the recommendation, with the commissions it generated, for six years. The affiliate code travels in the address of the pages you visit: we do not store it on your device.

If you are an affiliate

• Data: your account data, country of residence, language, website or channel and alias; the customers attributed to you (without their personal data), your commissions, transfers and payouts; a fingerprint of your IP address when you join, to prevent fraud; and, only if you live in Spain, your tax details (whether you are self-employed or a company, legal name, tax ID, address and whether you are a new professional).
• Purposes and legal basis: running the program, attributing customers to you and calculating and paying your commissions (performance of the contract); issuing the self-billed invoices and meeting our tax obligations (legal obligation); and preventing fraud and abuse of the program (legitimate interest).
• Recipients: Stripe, which verifies your identity and your bank account in its own sign-up, as an independent controller, and sends you the payments; the Spanish Tax Agency (AEAT), in the returns the law requires; and our tax advisor, bound by confidentiality. Your identity documents and full bank details go to Stripe: we do not see them.
• How long we keep them: while you take part in the program. When you leave it, we delete your website or channel and your program settings, and keep your tax details, commissions, transfers, payouts and self-billed invoices for six years, as tax and commercial law requires.

7. International transfers

Some of these providers are based in the United States or may access data from there. In those cases the transfer relies on the EU-US Data Privacy Framework, when the provider is certified, or on the standard contractual clauses approved by the European Commission.

8. How long we keep it

• Account and workspace data: for as long as you have an account. When you delete it, we erase it within 30 days at most, except for backups, which are overwritten in their normal cycle.
• Billing data: for as long as tax and commercial law requires, generally up to six years.
• Contact messages: for as long as needed to help you and for two years at most.
• Technical logs: up to twelve months.

9. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw any consent you have given, by writing to contact@slibur.com from your account email. You can change or delete much of your data yourself from the dashboard.

If you think we have not handled your data properly, you can file a complaint with the Spanish Data Protection Agency (aepd.es).

10. Cookies

We use technical cookies needed for the service to work, such as the one that keeps you signed in and the one that remembers your language. These do not need your consent.

To show the website in your language and currency, we use the IP address of your request only to work out your country, on our own server and without saving it (country data: nro.net). The result stays in technical cookies (placton_lang and placton_cur) for 30 days, or for one year if you choose them yourself.

If you reach the sign-up page from one of our guides, we also save in a first-party cookie (placton_src, up to 30 days) which guide and which button you came from. It holds only those two words, nothing that identifies you, and it is deleted when you create your account, which then keeps them so we can count sign-ups per page.

We also count visits to the website with our own analytics, without cookies: each visit is grouped with a daily fingerprint (IP address, browser and date, encrypted with a secret) that does not identify you and cannot follow you from one day to the next. We store the page, the site you came from, your browser language, the type of device and, if you arrived through an affiliate link, that affiliate’s code (so they can see how many people visit through it). The legal basis is our legitimate interest in knowing how the website is used, and the data is kept for 12 months.

Only if you accept, we also use Google Analytics cookies (_ga and _ga_*, up to two years) to measure, in aggregate, how the website is used. Google Analytics is provided by Google Ireland Limited, which acts as our processor; data may be transferred to the United States under the EU-US Data Privacy Framework. If you reject them, nothing from Google is loaded.

Also only if you accept, we use the Reddit Pixel to measure our ads on Reddit. It sets Reddit cookies (_rdt_uuid and other _rdt_ cookies) and tells Reddit which pages of our website you visit, your IP address and browser details and, when it happens, that you created an account or paid and the amount. Our server also sends Reddit those two events, with its cookies, a hash of your IP address and your browser details, so they are not lost if your browser blocks the pixel. We do not send it your name or your email. Reddit handles this data under its own privacy policy and may transfer it to the United States. If you reject them, nothing from Reddit is loaded and our server sends it nothing. We do not use any other advertising cookies.

Change cookie preferences

11. Security

We apply reasonable technical and organisational measures to protect your data: encrypted connections (HTTPS), encrypted passwords, restricted access and backups. If a security breach affected your data, we would let you know and report it to the supervisory authority where required.

12. Minors

Slibur is aimed at professionals and businesses and is not intended for anyone under 18.

13. Changes to this policy

If we make significant changes to this policy, we will let you know by email or in the dashboard before they apply.