Privacy policy
This policy explains what data Pictomaster handles, why, for how long and what rights you have. Regulation (EU) 2016/679 (GDPR) and the Spanish Organic Law 3/2018 (LOPDGDD) apply.
Pictomaster wears two hats, and each has its section:
- With the data of whoever uses the app — your account, your session — it is the controller.
- With the data a centre puts into it — its students, its projects, its photos — it is the processor: the controller is the centre, and the conditions are in the data processing agreement.
Controller
- Name: Moriagatte SCP
- Tax number (NIF): J19836667
- Address: Carrer Salmerón, 110, local 7, 08222 Terrassa
- Email: info@pictomaster.com
For any question about your data, write to that address.
1. Your account's data
What
| Data | Where it comes from |
|---|---|
| Email address | You, when you ask for a sign-in code |
| Name | You, if you set it in the settings |
| Sessions: IP address, browser, dates | Your browser, every time you sign in |
| Sign-in codes | Generated by us; they expire in minutes |
| Invitations | Whoever invites you: your address, who and when |
| Centres you belong to | Whoever makes you a member |
| Requests to the model | A record of each request: which centre, when, how many tokens |
| Billing details | The centre, if it takes a plan: name or company name, tax number, address and bank account |
| Acceptance of the terms | The date and the version you accepted when the account was made |
There are no passwords: you sign in with a code we send to your email.
Why, and on what basis
- To give you the service: the account, the sessions, the centres. Basis: performance of the contract (art. 6.1.b GDPR), that is, the terms of use.
- To keep the service safe: the session record, the request limits, the record of requests to the model. Basis: our legitimate interest (art. 6.1.f) in preventing abuse, which is what lets the service exist.
- To invoice and meet tax obligations: the billing details. Basis: the contract and legal obligations (art. 6.1.c).
- To write to you: only about the service — a code, a plan change, a change to these terms — never advertising. Basis: the contract.
For how long
- The account, as long as it exists. You can delete it by asking at the address above.
- Sessions, 30 days from the last time you sign in. Codes, a few minutes.
- The record of requests to the model, as long as the centre that made them exists: it is what counts its credits.
- Billing details, as long as tax law requires them to be kept.
2. The centres' data
A centre — a school, a practice, a family — puts into Pictomaster the data of its students: the name, the language of their pictograms, a vocabulary level and, if it wishes, a photo. It also puts in its projects: texts, documents, web pages, sentences and pictures of its own.
Of that data the centre is the controller: it decides what goes in, on what legal basis and for how long. Pictomaster handles it only to give the centre the service, following its instructions, as the data processing agreement says. If you are a student's family and want to exercise your rights over their data, ask the centre; if you do not know which it is, write to us and we will help.
Students' photos and the centres' pictures are kept in a private space: only the centre's members can see them, and no public address reaches them.
3. Who else is involved
Pictomaster runs on other companies' services, which process data on our behalf as sub-processors. None of them may use the data for anything else.
| Provider | What it does | Where |
|---|---|---|
| Cloudflare, Inc. | Hosts the app, stores photos and pictures, sends the emails | Worldwide network; based in the US |
| DigitalOcean, LLC | The database | ⟨regió⟩ |
| OpenRouter, Inc. | Carries the requests to the language model | US |
| Google LLC (through OpenRouter) | The language model that proposes words and sentences | US |
| ARASAAC (Government of Aragon) | The pictograms: receives the words we search for | Spain |
What the model receives. When a centre asks for a vocabulary or a sentence, the model is sent the text the words are to come from (a text, a document or a web page the centre chose), the sentence typed, the list of words the student already knows, and their level and language. No photo and no other data of the student is sent; their name only reaches it if the professional writes it in a sentence. ARASAAC receives only the words searched for.
Transfers outside the European Union. Cloudflare, OpenRouter and Google are in the United States. Transfers are made with the safeguards of article 46 GDPR: the European Commission's standard contractual clauses and, where the provider is certified, the EU–US Data Privacy Framework.
4. Security
All communication is encrypted (TLS). Sessions travel in a signed cookie. Photos and pictures are in a space with no public access. A centre's data is seen only by its members. The service's keys are stored encrypted. If there were ever a security breach affecting your data, we would tell you, and notify the authority, as the law requires.
5. Your rights
You can ask us for access to your data, to rectify it, erase it, restrict its processing, port it to another service or object to it. Write to info@pictomaster.com from your account's address and we will answer within a month at most. If you are not satisfied, you can complain to the Spanish Data Protection Agency (aepd.es).
6. Minors
Pictomaster is a tool for adults: professionals and families. No minor has an account. Students' data is there because the centre puts it there, under its own responsibility.
7. Changes
If this policy changes in anything that affects you, we will tell you by email or on sign-in. The version in force is the one of September 27, 2026.