Castellano · Català · Euskara · Galego · English
Version 1.3 of 24 October 2026
Informative translation. If there is any discrepancy, the Spanish text prevails.
CHOCOLATE FONDUE, SL (tax ID B63616197), C/ Eduard Toldrà, no. 15, Esc. 1, Planta BJ, Puerta 2, 08950 Esplugues de Llobregat (Barcelona, Spain). Contact for any privacy matter: hola@aplicia.es. We operate Aplicia, the service for finding grants and preparing applications.
Do not use the free-text fields or the assistant to write data about third parties or health data (names, diagnoses, medical documents): we do not need them.
| Purpose | Legal basis (GDPR, art. 6.1) |
|---|---|
| Find and assess grants, prepare the application and guide you to file it | Performance of the contract (b) |
| Charge the fee and the success fee | Performance of the contract (b) |
| Answering your questions with the file assistant and reading the documents you ask it to read | Performance of the contract (b) |
| Service notices (access link, deadlines, requests) | Performance of the contract (b) |
| Applying the partner code you arrived with and calculating that partner's remuneration | Performance of the contract (b) |
| Invoicing and accounting | Legal obligation (c) |
| Prove that you confirmed you have read this policy | Legal obligation and defence of claims (c, f) |
| Security and abuse prevention (request limit per IP) | Legitimate interest (f) |
| Assisting visitors in the open-website assistant | Legitimate interest (f) |
| Sending you news, grants and offers from Aplicia by email (only if you tick the box) | Consent (a) and art. 21 LSSI |
| To be able to prove your acceptance of the terms and of the authorisation to charge the card, we keep the date and time, a fingerprint of your IP, your browser, the version of the accepted text and its digital fingerprint (hash). | Performance of the contract (b) |
Except for the communications you consent to, we do not advertise or build profiles with your data, and we do not sell it.
Commercial communications: if you tick the corresponding box, we will send you news, grants and offers from Aplicia by email. Basis: your consent (art. 6.1.a GDPR and art. 21 LSSI). You can withdraw it at any time, without affecting the service you have contracted, using the unsubscribe link in each email or at hola@aplicia.es. We keep this preference until you withdraw it.
The assistant is an artificial intelligence, not a person. We use third-party language models to answer in the assistant, assess whether a grant fits you, draft the file's memo and, if you ask, read a document you upload. The assistant's answers are indicative: you do not decide anything on them alone, and no automated decisions with legal effects are taken about you.
File assistant (with your account). It receives what you write and the latest messages of that conversation, and this data from your file: number and phase, call title and code, estimated amount and estimated fee, status of the documents (under a generic name, never your file name), open deadlines and requests (identifier and deadline). It does not receive your tax ID or company name, email, phone, IBAN or payment data. Before sending your message we replace obvious patterns (ID numbers, IBAN, email, phone, card number) with «[dato oculto]»; the filter is not perfect.
Reading documents. If you ask Apli to read a document (PDF, Word .docx, Excel .xlsx, CSV, text or .eml email), we send the text extracted from that document (up to 12,000 characters) only for that answer. We replace any IBAN and card numbers. It does not read images. We do not keep the document text in the chat; Apli's answer does stay in your history and may quote parts of it. If the document includes other people's data (for example, employees) or health data, upload only what is needed and cover the rest: you decide what you upload.
File memo. It receives your company's sector and region, the call's public data and everything you include about the project (title, description, budget items and objectives). We replace the stored company name and tax ID with "the applicant", but we cannot detect other personal data you write in those texts: do not include it.
Provider. These processing activities are carried out on our behalf by Scaleway (France), a processor under a contract in line with Art. 28 GDPR, in its Paris region and without transfer outside the European Union. According to the provider, content is not used to train models and is not kept after processing; only if there is an unexpected technical error or malicious activity may the request content be kept for up to 2 weeks, in France, with access limited to Scaleway's internal AI team, solely to investigate and fix the problem. The provider also keeps technical usage data (calls, status codes, dates, token counts) linked to our project, without content. Scaleway also provides the service for the open web assistant (no account), which receives no data from any file: only what you write in it.
Do not use the assistant or free-text fields for third-party or health data that is not needed.
Only with providers acting on our behalf (processors, art. 28 GDPR):
We also consult public data (BDNS, commercial registers by tax ID) without sending them your personal data beyond the tax ID consulted. We do not pass your data to anyone else, except where required by law. We use no third-party analytics or advertising on the website.
If third-party data appears in an application (for example suppliers on the invoices you upload), we obtain it from you and use it only to prepare that application; those third parties receive no individual notice; this text is the information on how their data is processed, and they can exercise their rights at hola@aplicia.es.
Stripe (United States): collection of the fee and the success fee with the stored card. The transfer relies on the EU-US Data Privacy Framework and, if it ceased to apply, on the European Commission's standard contractual clauses. You can ask us for information on the safeguard applied at hola@aplicia.es.
Resend (United States): sending of service emails (access link, notices and charges). The transfer relies on the EU-US Data Privacy Framework and, if it ceased to apply, on the European Commission's standard contractual clauses.
If another provider processed data outside the EEA, the transfer relies on the safeguards of arts. 44 to 49 GDPR.
| Data | Period |
|---|---|
| Invoices, payments and tax records | 6 years from the date of the document |
| Unresolved or abandoned applications | 2 years from last activity |
| Inactive accounts | 1 year from last activity |
| Conversations with the file assistant (with account) | 12 months from last activity, with periodic deletion |
| Open-website assistant | 90 days from last activity |
| Technical logs | 1 year |
| Technical cookies | Up to 2 years |
| Hash of the IP used for the request limit | 24 hours |
| Questions the open-website assistant could not answer (emails, IBAN and tax IDs are filtered out, but we cannot guarantee no other personal data remains) | 90 days |
| Preference and proof of consent to commercial communications | Until you withdraw it; afterwards, proof of the withdrawal during the limitation period for claims |
| Proof of acceptance of the terms and the charge authorisation | The term of the contract plus the legal limitation periods |
After these periods, we delete or anonymise. If you ask for your account to be deleted, we unlink your identity from the applications and payments; these are kept without an identified holder for as long as tax law requires.
You may access, rectify, erase, object, restrict processing and request portability of your data. Write to us at hola@aplicia.es from your account's email; in the customer area you can also view, correct, export and delete your account data. We reply within 1 month (extendable to 2 if complex, notifying you within the first month). If you believe we have not handled your request properly, you may complain to the Spanish Data Protection Agency (www.aepd.es).
By registering you confirm that you have read this policy; we keep the date, IP and version. We only use technical storage necessary for the service to work (session and preferences).
We will publish changes on this page with the version date, and notify you by email if they are substantial.