Privacy Statement

Fundación Plaza de Castilla, CIF G84070945, C/ Serrano Anguita 13, 28004 Madrid. Data protection contact: privacidad@captaru.org.

Identification and contact data (name, email, organisation), tax data for invoicing, platform usage data, payment data handled through our provider and, with your consent, browsing and advertising-measurement identifiers (for example, Google Analytics/Ads identifiers and the Google Ads “gclid”).

To provide and manage the contracted services, issue invoices, offer grant recommendations, send service-related communications, and, with your consent, commercial communications (newsletter).

Performance of the contract or pre-contractual measures, compliance with legal obligations (e.g. tax), legitimate interest in improving and protecting the service, and consent for analytics and marketing cookies and for commercial communications (newsletter).

We retain data for as long as the relationship with the user exists and, thereafter, for the legally required periods (for example, tax and accounting regulations require invoices to be retained).

Usage records of the artificial intelligence services (date, agent, number of tokens and cost linked to your account, without the content sent) are kept for 24 months for billing and cost control. Captaru does not store the content of requests sent to AI providers; providers process it without retaining it.

We do not sell your data. We use providers acting as processors with appropriate safeguards: the Stripe payment gateway, hosting services and analytics and advertising providers (Google, Meta, LinkedIn and Microsoft) where you have consented to the relevant cookies. We only disclose data to third parties where legally required.

Some of these providers are located outside the European Economic Area (for example, in the USA). In those cases, transfers rely on adequacy decisions (such as the EU-US Data Privacy Framework) or standard contractual clauses, ensuring an adequate level of protection.

To provide recommendations, eligibility analysis, assisted drafting, translations and the help assistant, Captaru uses artificial intelligence providers acting as data processors: OpenRouter, Inc. (United States), which routes requests to model providers such as Google, Anthropic, OpenAI and TypeSafe (the JEV decision model); OpenAI (United States) for vector representations of your profile and of the calls; NaN Builders (content translations); Groq (United States) for transcribing training videos; and Bunny.net (European Union) for video hosting.

Transfers to the United States rely on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses included in each provider's data processing agreement. We configure requests so that providers do not retain the data (zero retention, except for the temporary technical storage needed to process the request) and do not use it to train their models. OpenRouter's list of sub-processors is available at trust.openrouter.ai.

We send those providers only the information each feature needs: the description of your entity and of what you are looking for, the projects and answers you write in the Grant Technician and in ideation, the documents you upload for analysis, the help assistant messages and the structured data of your profile (entity type, municipality, sectors, budget). Before sending them we remove your email address, name, tax ID, phone number and postal address.

Call recommendations, their order and the eligibility verdict ("you can apply", "almost a match", "not a match") are generated automatically from your profile. They are indicative, non-binding and have no legal effect: the decision to apply is always yours and the official terms of each call prevail. You can correct the criteria from "My profile", dismiss any recommendation and request a human review by writing to privacidad@captaru.org.

Content generated with artificial intelligence (dossiers, project ideas, documents, recommendation reasons, assistant answers) is identified as such on the platform.

When you analyse a call in the Grants Advisor from a website or a document and it was not in our catalogue, our team may review it. If it is a public call, we may add it to the catalogue so that other organisations can see it, only with the data of the call itself (title, funding body, deadlines, amounts and requirements), never with your data or your organisation’s. Until it is published, only your organisation can see it.

You may exercise your rights of access, rectification, erasure, objection, restriction, and portability by writing to privacidad@captaru.org. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss, or alteration.

To resolve issues that cannot be reproduced any other way, authorised Captaru staff may access the platform using your account and see the same as you do. The legal basis is our legitimate interest in providing the support needed for the service to work properly.

Every access requires a stated reason and is recorded with the identity of the person accessing, the date, the duration and the originating IP address. These records are kept for 24 months.

If you have any question about a particular access, write to privacidad@captaru.org.