Privacy Policy

1. Data controller

CIDIF.TECH is a service operated by FORCAST Desarrollo Tecnológico. For any question about this policy or the processing of your data, you can write to us at contacto@cidif.tech.

2. Data we collect

We collect the following information:

• Account data: name and email address, obtained when you sign up with Google or via magic link by email.
• Project and application data: the information you enter about your company, projects, and the funds you apply to.
• AI assistant content: the text and instructions you send to the formulation assistant.
• Usage and technical data: IP address, browser type, pages visited, and usage metrics via cookies and analytics.

3. How we use your data

We use your data to:

• Provide and maintain the service (authentication, project and application management).
• Offer the AI assistant for project formulation.
• Send you communications about your account, deadlines, and service notifications.
• Improve the platform, its security, and the user experience.
• Comply with legal obligations.

4. Legal basis

We process your data on the basis of the performance of the service contract, your consent (for example, for communications), and our legitimate interest in operating and improving the platform securely.

5. Third parties and processors

To provide the service we share data, to the extent necessary, with providers acting as data processors. For each provider we state what information it receives:

• Supabase — authentication, database, and storage software, running on our own infrastructure. This is where your account, company, project, and application data live.
• Google — sign-in via OAuth and, if you connect it, Google Calendar (see section 6). Google is the source of that data, not a recipient of any other information about you.
• Anthropic, OpenAI, and DeepSeek — AI processing for the formulation assistant. They receive only the content you enter into the platform: the messages you write to the assistant, the documents you attach to it, your company, project, and application data, and the public details of the relevant fund. They never receive data obtained from Google APIs (see section 6).
• Stripe — payment processing: the amount, the billing email, and the transaction identifiers.
• Brevo — transactional email delivery: your name and email address.
• Amazon Web Services (AWS) — infrastructure and database hosting.

We do not sell your personal data to third parties, and we do not share information obtained from Google APIs with any artificial intelligence provider.

6. Google Calendar data (Limited Use)

If you connect your Google Calendar from your profile, we access your Google data with the permissions you grant on the consent screen, and only for scheduling features:

• Read your calendars' busy blocks (free/busy) so we don't offer times when you already have something scheduled. We do not read your events' title, description or guests.
• List the calendars you can write to, so we know where to create events.
• Create, update and delete only the events for meetings and advisory sessions booked on CIDIF.TECH, including their Google Meet link.

The data we obtain from Google APIs — your busy blocks, the list of your calendars, and your email address — is used exclusively for scheduling features and is kept separate, technically as well, from the AI assistant: it is never sent to Anthropic, OpenAI, DeepSeek, or any other artificial intelligence provider, and it is never used to train models. The code that reads your calendar and the code that queries AI models are separate components and share no data. Access tokens are stored encrypted (AES-256-GCM) on our infrastructure, and of your events we keep only the identifier of the one we created, so we can delete it if you cancel. We do not use Google data for advertising, do not sell or transfer it to third parties, and no human reads it except with your explicit permission, for security purposes, or where required by law. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect the calendar at any time from your profile — which deletes the stored tokens — or revoke access from your Google account settings.

7. International transfers

Some of our providers process data outside your country of residence (for example, in the United States or the European Union). In those cases we apply appropriate safeguards to protect your information.

8. Data retention

We keep your data while you maintain an active account and for as long as necessary to meet legal, accounting, or dispute-resolution purposes. You can request deletion of your account at any time.

9. Your rights

You have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Request deletion of your data.
• Object to or restrict certain processing.
• Request portability of your data.

To exercise these rights, write to us at contacto@cidif.tech.

10. Security

We apply technical and organizational measures to protect your data, including encryption in transit (HTTPS), access control, and database-level security policies. No system is 100% secure, but we work to minimize risks.

11. Cookies

We use cookies and similar technologies to keep your session, remember preferences, and measure platform usage via analytics. You can manage cookies from your browser settings.

12. Minors

The platform is not directed at minors. We do not knowingly collect data from minors.

13. Changes to this policy

We may update this policy from time to time. We will publish the current version on this page along with its last-updated date.

14. Contact

If you have questions about this Privacy Policy or how we process your data, contact us at contacto@cidif.tech.