Who Controls Your Data
For the current MVP phase, Recala acts as the data controller for information collected through recala.co, including account credentials, onboarding inputs, publishing settings, and operational logs. If you need to exercise privacy rights during this phase, contact the team at hello@recala.co.
What We Collect
- Account data such as email address and authentication status.
- Onboarding and workspace data such as brand inputs, WordPress connection choices, and publishing preferences.
- Generated editorial data such as topics, outlines, drafts, thumbnails, and publish status.
- Technical and security data such as server logs, error traces, and anti-abuse signals.
Why We Process It
- To create, review, store, and publish authority content on your behalf.
- To authenticate users, secure workspaces, and prevent abuse.
- To operate support, troubleshoot incidents, and improve service reliability.
- To comply with legal obligations and maintain auditable operational records.
Legal Bases
- Performance of a contract or pre-contractual measures when you request or use the service.
- Legitimate interests in securing the platform, preventing misuse, and improving reliability.
- Legal obligations where retention or disclosure is required by law.
- Consent for non-essential analytics cookies, which load only if you accept them and can be withdrawn at any time.
Processors and International Transfers
Recala currently relies on infrastructure and processor services including Supabase for database and authentication, Netlify for web hosting and delivery, Google Gemini for AI content-generation tasks, PostHog for optional product analytics, and WordPress when you connect your CMS for publishing. Apart from PostHog, whose data stays in the European Union, these providers may process data outside Spain or the EEA under their contractual safeguards.
Retention
We keep account and workspace data for as long as your workspace remains active and for a limited period afterward where needed for security, support, and legal recordkeeping. If you disconnect a CMS or delete a workspace, we will remove or anonymize data unless retention is required for legal claims or security investigations.
Your Rights
Where applicable, you may request access, rectification, deletion, restriction, portability, or objection. You may also lodge a complaint with the Spanish Data Protection Authority if you believe your rights have been infringed.
Cookies and Analytics
Recala uses essential authentication-related cookies needed to keep users signed in. Alongside those, we use one optional analytics provider, PostHog, for product analytics: which pages are viewed, which features are used, and how the signup funnel performs. Nothing analytics-related loads until you accept it on the cookie banner. If you decline, the script is never downloaded and no analytics cookie is ever written.
PostHog data is processed in the European Union (eu.i.posthog.com) and retained for up to 12 months. Where you are signed in, we identify you to PostHog by your internal account ID only — never by email or name. We use no advertising networks, we do not sell or share analytics data with third parties, and session recording is disabled. You can withdraw consent at any time from the Cookie Policy, which sets out the full detail.