Privacy Policy
Last updated: November 3, 2026
1. Data Controller
BioMedCopywriting is operated by Mariia Poteshkina (VAT: ESZ0843401L), based in Spain.
2. Data We Collect
We collect and process the following personal data: • Email address: provided when you sign in with Google or register, used for account identification and communication. • Payment and invoice data: for each PayPal payment, the payer's name, e-mail, country and address as PayPal reports them, the PayPal order and transaction identifiers, the country you declare and the country of your IP address (evidence of the place of supply for VAT, Council Implementing Regulation (EU) No 282/2011), the result of the VIES check of a company's VAT number, and the invoice details you enter (name, address, tax number). Card data is entered only on PayPal's pages. • Content you create: projects, tasks, generated articles, uploaded reference documents, and project source files stored to provide our services. • Business entities: clients, products, themes, target groups, and content formats you create within the platform. • Google Drive data: access tokens and folder preferences when you connect Google Drive integration (optional). • Technical data: session cookies for authentication, server logs for error diagnosis.
3. Legal Basis for Processing
We process your data based on: • Contract performance — to provide the services you signed up for (Article 6(1)(b) GDPR). • Legitimate interest — for security, fraud prevention, and service improvement (Article 6(1)(f) GDPR). • Legal obligation — for tax and billing compliance (Article 6(1)(c) GDPR).
4. Third-Party Services
We share data with the following recipients: • PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg): payment processing. PayPal also processes your payment data as an independent controller under its own privacy statement. • European Commission, VIES service: check of a company's VAT number. • Google (US, EU standard contractual clauses): sign-in with Google and the optional Google Drive and Docs integration. • Anthropic (US): AI content generation with Claude. Your project content is sent for processing and is not used by Anthropic for training. • OpenAI (US): AI content generation and web search with ChatGPT. • Cloudflare (US, EU): delivery and protection of the site. The application, its database and our mail server run on servers we operate in the EU.
5. Cookies
We use only essential cookies required for authentication (Supabase session cookies). We do not use any analytics, advertising, or tracking cookies. See our Cookie Policy for details.
6. Your Rights
Under the GDPR, you have the right to: • Access — request a copy of all your personal data (available via Settings → Account → Export Data). • Rectification — correct inaccurate personal data. • Erasure — delete your account and all associated data (available via Settings → Account → Delete Account). • Data portability — receive your data in a structured, machine-readable format (JSON export). • Object — object to processing based on legitimate interest. • Withdraw consent — where processing is based on consent. To exercise these rights, use the in-app tools or visit our Contact page.
7. Data Retention
We keep your account data while your account exists. When you delete your account, your projects, documents and other content are removed. Invoices, payment records and the evidence of your country are kept for ten years from the invoice, as Spanish tax and commercial law and EU VAT rules require; they are kept even if you ask to delete your account.
8. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes via email or an in-app notification. The "Last updated" date at the top of this page indicates when the policy was last revised.
9. Contact
If you have questions about this Privacy Policy or wish to exercise your data protection rights, please use our Contact page.