Who Controls Your Data
For the current MVP phase, Recala acts as the data controller for information collected through recala.co, including account credentials, onboarding inputs, publishing settings, and operational logs. If you need to exercise privacy rights during this phase, contact the team at hello@recala.co.
What We Collect
- Account data such as email address and authentication status.
- Onboarding and workspace data such as brand inputs, WordPress connection choices, and publishing preferences.
- Generated editorial data such as topics, outlines, drafts, thumbnails, and publish status.
- Technical and security data such as server logs, error traces, and anti-abuse signals.
Why We Process It
- To create, review, store, and publish authority content on your behalf.
- To authenticate users, secure workspaces, and prevent abuse.
- To operate support, troubleshoot incidents, and improve service reliability.
- To comply with legal obligations and maintain auditable operational records.
Legal Bases
- Performance of a contract or pre-contractual measures when you request or use the service.
- Legitimate interests in securing the platform, preventing misuse, and improving reliability.
- Legal obligations where retention or disclosure is required by law.
- Consent for non-essential analytics cookies, which load only if you accept them and can be withdrawn at any time.
Processors and International Transfers
Recala currently relies on these providers: Supabase for database and authentication (hosted in the European Union, Frankfurt); Railway for our application servers, which run in the European Union (Amsterdam, Netherlands); Netlify for web hosting and delivery; Cloudflare Turnstile for authentication abuse protection; AI model providers such as OpenAI and Google (Gemini) for research and writing tasks; Exa and Serper for web research; Stripe for payments; Holded for invoicing; Sentry for error monitoring; PostHog for optional product analytics; and WordPress when you connect your CMS for publishing. PostHog data stays in the European Union. The other providers may process data outside Spain or the EEA under their contractual safeguards.
Google Search Console Data
If you connect Google Search Console, Recala reads, read-only (Google scope webmasters.readonly), the
properties you choose and their daily search performance: clicks, impressions, click-through rate and average
position by date, query, page, country and device, plus URL inspection results for pages we publish. We store this
data in our database in the European Union (Frankfurt), visible only to members of your organization, to report the
search performance of your content and to plan new content. We never write to Search Console, never sell or share
this data, and never use it for advertising. Access tokens are encrypted at rest; disconnecting revokes the grant at
Google and deletes the tokens.
Recala's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Retention
We keep account and workspace data for as long as your workspace remains active and for a limited period afterward where needed for security, support, and legal recordkeeping. If you disconnect a CMS or delete a workspace, we will remove or anonymize data unless retention is required for legal claims or security investigations.
Your Rights
Where applicable, you may request access, rectification, deletion, restriction, portability, or objection. You may also lodge a complaint with the Spanish Data Protection Authority if you believe your rights have been infringed.
Cookies and Analytics
Recala uses essential authentication-related cookies needed to keep users signed in. Alongside those, we use one optional analytics provider, PostHog, for product analytics: which pages are viewed, which features are used, and how the signup funnel performs. Nothing analytics-related loads until you accept it on the cookie banner. If you decline, the script is never downloaded and no analytics cookie is ever written.
PostHog data is processed in the European Union (eu.i.posthog.com) and retained for up to 12 months. Where you are signed in, we identify you to PostHog by your internal account ID only, never by email or name. We do not use advertising networks or sell analytics data. PostHog processes analytics data for Recala, and session recording is disabled. You can withdraw consent at any time from the Cookie Policy, which sets out the full detail.