Privacy policy

Who is responsible

[company name pending], tax number [tax number pending], [registered address pending], runs criterio.design and is responsible for the data described here. Write to hola@criterio.design about anything to do with your data.

What your team stores in a workspace (references, notes, comments, files) is the workspace's: it decides what goes in, and we process it on its behalf.

What we collect

• Your account: your name, email address and picture, as you give them or as Google, Apple or X hand them over when you sign in with them, and the language you use.
• Sign-in and security: the sessions you have open, with the IP address and browser of each, and the counters that stop abuse.
• What you save: the addresses, titles, screenshots, images, videos and texts of your references, your notes and comments, your projects and what they decide, and the brand files you upload.
• How you use the app: when you were last in and how much time you spent in each part of it.
• AI use: which AI actions ran in your workspace and what they cost, to apply your plan's limits.
• Feedback: what you send with the feedback tool, with the page it was about.
• The browser extension has its own page: criterio.design/extension/privacy.

What your references contain

A reference is often someone else's work: a site, a post, an image. A post saved from X carries its author's name, handle, picture and words, as X shows them in public. We keep that only so the workspaces that saved the post can see it.

If you are the author of something saved here and want it removed, the Terms say how to ask (criterio.design/terms).

Why we use it

• To give you the service you signed up for: your account, your library, your team. The basis is our contract with you.
• To write to you about your account: sign-in links, invitations and notices about the service. Also the contract.
• To keep the service secure and see how it is used, so we can improve it. The basis is our legitimate interest.
• To comply with the law when it obliges us.

We do not sell your data, show ads or build advertising profiles.

AI

Some features send content to language models: the screenshot and text of a site to tag it, your references and notes to draft a project's criteria, your words to search by meaning. The models are reached through OpenRouter and Typesafe, and run by providers such as Anthropic, Google, Mistral and DeepSeek.

We do not use your content to train models. Each provider processes it to return its answer, under its own terms.

Who we share it with

Only with the companies that run the service for us, each under a contract that limits what it can do with the data:

• Vercel: hosting, in Frankfurt.
• Neon: the database, in Frankfurt.
• Cloudflare: file storage.
• Resend: the emails we send you.
• OpenRouter, Typesafe and the model providers behind them: the AI features.
• Google, Apple and X: only if you sign in with them.

Some of them are outside the European Economic Area. Those transfers rely on the European Commission's standard contractual clauses or on the EU-US Data Privacy Framework.

A few things load straight from others: a site's icon comes from Google's favicon service, and a video from X, YouTube or Vimeo plays from their servers. They see your IP address when that happens, as on any page that embeds them.

Cookies

Only the ones the app needs to work: your session, your language and whether the sidebar is open. Your theme is kept in the browser's own storage. There are no analytics or advertising cookies, so there is no banner to accept.

How long we keep it

For as long as your account is open. When a reference is deleted, the files that were only its own go with it. When you ask us to close your account we delete it, and what only you owned, within 30 days; what belongs to a team's workspace stays with the team. Copies in backups expire on their own some days later.

Your rights

You can ask to see your data, correct it, delete it, take it with you, or limit or object to how we use it. Write to hola@criterio.design from your account's address and we answer within a month.

If you think we have handled your data badly, you can complain to the Spanish Data Protection Agency (aepd.es).

Who it is for

criterio.design is a tool for professionals. It is not meant for anyone under 16.

Changes

If this policy changes in a way that matters, we tell you by email or in the app before the change applies. The date at the top says when it last changed.