Last updated: September 28, 2026

Privacy Policy

This Privacy Policy explains how GuruSup Tech S.L. collects, uses, and protects personal data through the website gurusup.com (the "Website") and the GuruSup Brain service (section 10), in compliance with Regulation (EU) 2016/679 (GDPR) and Spain's Organic Law 3/2018 (LOPDGDD).

1. Data Controller

• Company: GuruSup Tech S.L.
• VAT number: ESB21975784
• Address: Calle Guillem de Castro 9, 7ª planta, 46007 Valencia, Spain
• Phone: +34 627 648 100
• Privacy contact: privacy@gurusup.com

2. Data Protection Officer

GuruSup Tech S.L. has not appointed a Data Protection Officer, as our processing activities do not meet the thresholds set out in Article 37 GDPR. For any privacy-related query, please contact privacy@gurusup.com.

3. Personal Data We Process

4. Recipients and Third-Party Processors

We share data only with processors that provide sufficient guarantees under Article 28 GDPR:

• HubSpot Inc. (USA) — CRM and lead management. Transfer: EU–US DPF.
• Google LLC (USA) — Analytics (GA4) and advertising. Transfer: EU–US DPF. Acts as independent controller for advertising. Email addresses submitted via forms are hashed with SHA-256 before being sent to Google Ads for enhanced conversion measurement.
• Meta Platforms Inc. (USA) — Advertising (Meta Pixel) and WhatsApp Business. Transfer: EU–US DPF.
• Mixpanel Inc. (USA) — Product analytics (EU endpoint). Transfer: Standard Contractual Clauses (SCCs).
• Vercel Inc. (USA) — Website hosting. Transfer: EU–US DPF.
• Microsoft Corporation (USA) — Session analytics (Clarity). Transfer: EU–US DPF.

We do not sell, rent, or trade personal data with third parties for their own marketing purposes.

5. International Data Transfers

Transfers to US-based processors are covered by the EU–US Data Privacy Framework (European Commission adequacy decision, July 2023) for certified companies, or by Standard Contractual Clauses (SCCs) where DPF certification is unavailable. Verify DPF certifications at dataprivacyframework.gov.

6. Data Retention

• Active leads: 2 years from last activity.
• Cold leads (no response): 2 years from submission.
• Closed deals (customers): contract duration plus 5 years (Spanish Commercial Code).
• Analytics data: maximum 14 months.
• Server logs: 90 days.
• Suppression list (opt-outs): retained indefinitely to prevent re-contact.
• Consent records: 3 years after consent is withdrawn.

7. Your Rights

Under GDPR and LOPDGDD you have the right to:

• Access (Art. 15) — obtain a copy of your personal data.
• Rectification (Art. 16) — correct inaccurate or incomplete data.
• Erasure (Art. 17) — request deletion of your data.
• Restriction (Art. 18) — limit processing in certain circumstances.
• Portability (Art. 20) — receive your data in machine-readable format.
• Object (Art. 21) — object to processing based on legitimate interest. We will stop unless we have compelling grounds.

Email privacy@gurusup.com with subject "Data Subject Request" and proof of identity. We respond within 30 days.

8. Supervisory Authority

You have the right to lodge a complaint with:

• Agencia Española de Protección de Datos (AEPD)
• C/ Jorge Juan, 6, 28001 Madrid — www.aepd.es — Tel.: 901 100 099

9. Children

Our services target business professionals and are not directed at persons under 16. We do not knowingly collect data from children. Contact privacy@gurusup.com to request immediate deletion.

10. GuruSup Brain

This section covers GuruSup Brain (app.brain.gurusup.com and its MCP server at mcp.brain.gurusup.com), including when you use it from Claude, ChatGPT or other AI clients.

Our role

For the content a customer connects or adds to Brain ("Workspace Data"), the customer is the controller and GuruSup acts as processor under Article 28 GDPR, following the customer's instructions and our agreement with them. For account, billing and usage data, GuruSup is the controller.

Data we process

• Account data: name, email, role, organisation and sign-in data. Legal basis: contract (Art. 6.1.b).
• Workspace Data from connected sources the customer chooses to connect, such as Slack (public and private channels and group messages, not one-to-one direct messages), Notion, HubSpot (deals, contacts, companies, sales emails), Google Workspace (Drive, Docs, Sheets, Calendar, Gmail), other CRMs, and files uploaded directly. This can include names, emails and other personal data of employees and of the customer's own contacts.
• What AI clients send us: the questions and search terms Claude, ChatGPT or another client sends to answer you, and any knowledge you ask it to save to Brain.
• Information requests: when Brain is missing an answer, it can ask a colleague on Slack or by phone call. We process that person's name, work contact details, the question and their answer. People can opt out of these requests.
• Usage and billing data: product events, technical logs and invoices.

Purpose

We use Workspace Data only to provide Brain to the customer: to build and keep up to date the company's memory, and to answer questions with the sources behind each answer. Each member only sees the knowledge their organisation's admins have granted them.

Processors for Brain

• Google Cloud (EU, europe-west1): hosting, database, file storage and secrets.
• MongoDB Atlas and Memgraph: application and knowledge-graph databases.
• OpenAI (USA): language models, embeddings and voice for phone requests.
• Anthropic (USA): language models used to organise the company's memory.
• WorkOS (USA): sign-in and organisation directory.
• Composio (USA): connections to third-party apps such as Google Workspace and CRMs.
• LiveKit (USA): phone calls for information requests.
• Pydantic Logfire: technical traces, with sensitive values scrubbed.
• PostHog (EU): product analytics.
• Stripe (USA) and Holded (Spain): billing and invoicing.

Transfers outside the EEA follow section 5.

Retention and deletion

• Workspace Data and the questions sent to Brain are kept while the customer's workspace is active.
• Disconnecting a source stops new capture. Knowledge already captured stays until the customer deletes it or asks us to.
• When a workspace is closed, we delete its Workspace Data, connections, memory and logs. Invoices are kept as required by law (section 6).
• Customers can ask us to erase specific content or restart their workspace at any time.

If your data reached Brain through your employer or a company you work with, you can exercise your rights with them, or with us at privacy@gurusup.com and we will pass the request on.

11. Updates

We may update this policy periodically. Material changes will be reflected in the "Last updated" date above.