Bitácora Privacy Policy

Version 1.1 · Effective from October 18, 2026

This policy explains what personal data we process in Bitácora (the app, its phone version, the client portal and the bitacora.live website), for what purpose, with whom, for how long, and what rights you have.

The essentials:

• We do not sell your data, we do not use it for advertising and we do not use your content to train artificial intelligence.
• You choose and connect the AI that works on your projects. Only in the courtesy runs we give you do we use our own AI account.
• Your data is stored on servers in the United States.
• There are no advertising cookies. In the app we use no external analytics; on the public website we use Google Analytics, and it only sets cookies if you accept.
• You can download everything that is yours and delete your account from Settings.

---

1. Who processes your data

The controller is A.SMITH GROUP, EIRL, tax ID (RNC) 132654226, with registered address at Calle Miguel A. Piantini, Ed. 73, #101, San Carlos, Distrito Nacional, Dominican Republic (“we”).

• Email for anything related to your data: hola@bitacora.live
• Phone: +1 (829) 478-2023

• We have not appointed a data protection officer because it is not mandatory in our case.

We process your data with quality, lawfulness, fairness, security and purpose limitation, as required by Article 44 of the Dominican Constitution and Law 172-13. When we offer Bitácora to people in the European Union, the European Economic Area, Switzerland or the United Kingdom, we also apply the General Data Protection Regulation (GDPR) and recognize all its rights.

2. Two different roles

• Your data and your account’s data: we process it as controller. That is what almost all of this policy explains.
• The data of designers’ clients (the people a studio keeps in My clients or invites to its portal, their visits and their comments): the studio processes it as controller, and we process it only on its behalf, as processor. If you are a studio’s client and want to exercise your rights, write to the studio. If you write to us, we pass your request on to them.

3. What data we process and why

Your account

• Data: name, email, photo if you add one, language, time zone and how you sign in: with Google, with a code sent by email, or with a password (stored hashed, never in plain text).
• Purpose: creating your account, identifying you, providing the service and writing to you about your account.
• Legal basis: the contract you accept when you create the account.
• Sign in with Google: we only receive your name, your email, your profile photo and an account identifier. We do not access your Gmail, Drive, Calendar or any other Google data. Bitácora’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can remove access at myaccount.google.com/permissions.

Your projects

• Data: screens, sketches, logs (text and voice), documents, images, comments, version history and everything you upload or create. They may contain personal data you decide to include.
• Purpose: storing them, showing them to you, sharing them with whoever you decide and running what you ask for.
• Legal basis: the contract.

Your voice and dictation

• When you dictate, the audio is sent to OpenAI to turn it into text, using Bitácora’s account. OpenAI acts as our processor, does not use that audio to train its models and, according to its documentation, does not retain it in its transcription service.
• We store the audio with the log and delete it 30 days after the log is closed (applied, reviewed or discarded). The text stays in your project.
• While you dictate, your browser may show live text using its own speech recognition. In Chrome, this sends the audio to Google. You can turn it off in Settings.
• We do not use your voice to identify you: it is not biometric data.
• Only dictate your own voice or that of people who have agreed to be recorded.
• Legal basis: the contract.

Your vocabulary

Bitácora learns how you name things in your projects to understand you better when you dictate. That glossary never leaves your account, and you can view, correct and turn it off in Settings. An unused word is deactivated after 180 days and its statistics are deleted after 400. Legal basis: the contract.

The artificial intelligence you connect

• With the connector (MCP): your AI tool accesses Bitácora with the permission you give it (OAuth) and reads or changes what you ask. The content it reads goes through its provider (for example Anthropic, OpenAI or Cursor), which you choose and which is not our provider: its own policy applies. We do not access your conversations, history or that tool’s memory. We store the permission (as an encrypted fingerprint, not in plain text), the tool’s name, the date, the last use and the last function used. You can revoke it in Settings.
• With your API key: we store it encrypted and never show it in full. When you run a batch, our server sends the key’s provider (currently Anthropic) the necessary content: screens, logs, sketches and images in the batch. That use falls under your account with the provider and its terms; under Anthropic’s commercial terms, it does not train models on that content. You can delete your key at any time.
• Courtesy runs: if you use the runs we give you before connecting your AI, our server sends Anthropic, using Bitácora’s account, the necessary content of the run (screens, logs, sketches, images and files you ask it to use). In that case Anthropic acts as our processor: under its commercial terms, it does not train models on that content and deletes it within 30 days at most, except for what its safety systems flag.
• Legal basis: the contract, because you do it and that is what the service is for.

AI reports to improve Bitácora

The AI tool you connect may send us short technical reports when something in Bitácora gets in its way or when it sees an improvement (at most three per run and twenty per day). They include your account, the project, the run, the tool’s name and the last lines of what it was doing, without the content of your projects. We use them only to improve the product. After 12 months we remove everything that identifies you, and immediately when you delete your account. You can turn them off in Settings › AI. Legal basis: our legitimate interest in improving the service.

Your clients and your team

• My clients: the companies and people you keep, including those you import from your phone (only the contacts you choose, never your whole address book) or from a file: name, emails, phone, company, job title, link and notes. They are only used for your directory and for the notifications you decide to send. We never use them for anything else or share them. You are responsible for having a basis to process them (section 2).
• The portal: for anyone who opens a prototype we store their personal link (30 days), their session (90 days), which screens they viewed and when (365 days, or until the studio deletes that person) and their comments (while the project exists). The studio sees those visits and comments.
• Teams: members of a team see the name, email, photo and activity of the other members in the team’s projects (who dictated, ran, verified, handed off or changed something, and when), including invited people who have not yet accepted. If someone invites you, we receive your email from that person.
• Legal basis: the contract (and, for studios’ clients, whatever basis the studio has).

What you tell us about yourself

During onboarding you can tell us what you do. It is optional and you can change it. We use it combined with other people’s answers to understand who uses Bitácora and which features each profile uses. Legal basis: our legitimate interest in improving the product.

The amount of your projects

If you record how much you charge for a project, it is your private record. We also use it only added up with other people’s, in a way that identifies no one, as data on how the design market is moving. You can object by writing to us. Legal basis: our legitimate interest.

Use of the service, security and errors

• Usage: we count how each feature is used per person (runs, logs, glossary and similar) to operate and improve the service. We do not use external analytics services in the app.
• Activity log: sensitive actions on your account (signing in, account changes, teams, billing, archiving) are stored with the IP address for 365 days, for security and because Dominican law (Law 53-07) requires this kind of data to be kept for at least 90 days.
• Email sign-in code: we store the IP that requested it for 24 hours.
• Sessions: they store the browser you sign in from, not the IP. You can view and close them in Settings.
• Errors: we store app errors with their technical context (route, message, account and browser, without IP) using our own system: repeats for 30 days; a resolved error for 90 days from the last time it occurred.
• Server logs: IP address, page requested, date and browser, for 14 days.
• Usage limits: we count requests per IP and per account for a few minutes to prevent abuse.
• Legal basis: our legitimate interest in keeping the service secure and running, and legal obligation.

Payments

Payments are processed by Lemon Squeezy, which is the controller of its own payment data (your card, your billing address). We never see or store your card. Lemon Squeezy sends us back your email, your name, your country and the status of your subscription. Legal basis: the contract and our legal obligations.

Affiliate program

• If you arrive through an affiliate’s link: if you accept cookies in the website’s notice, a cookie remembers who invited you and when you opened the link (section 12). When you create your account, we record which affiliate brought you. From the click on the link we store a fingerprint of the IP (not the IP itself) for 90 days. Inside Bitácora the affiliate never sees your name or email, only counts. Legal basis: your consent for the cookie; our legitimate interest in paying correct commissions, for the rest.
• If you apply to be an affiliate: we store your answers (links to your channels, your line of work, a short description of what you do and who follows you, the approximate size of your audience and how you plan to recommend us) and the date and version of the terms you accepted. We use them only to assess your application and manage your participation. If we reject it, we keep them for 12 months and then delete them; if we accept you, while you are an affiliate and for the time needed to handle claims. Legal basis: pre-contractual steps and the contract.
• Commissions are paid by Lemon Squeezy from its Affiliate Hub, which has its own policy and shows affiliates whatever data it decides.

Emails

We send you account and security emails (always); notification emails (teams, billing, AI, weekly summary); and, as a Bitácora user, some about getting more out of it, for example when we give you runs to get started. All except account and security emails can be turned off in Settings or with the unsubscribe link in each email. We do not send third-party advertising, or marketing email to people who do not use Bitácora without their permission. Emails are sent through Resend, which receives your address and the content of each email. Legal basis: the contract; our legitimate interest for emails about using Bitácora, which you can turn off at any time; and your consent for any other marketing news.

Support

If you write to us, we keep the conversation to help you, for 2 years after the case is closed. Legal basis: the contract and our legitimate interest.

4. Who else sees your data

We do not sell or rent your data. We only share it with:

In addition:

• The people you decide: your team, your clients in the portal, whoever receives a delivery, and the AI tool you connect.
• Our team: whoever operates Bitácora sees account, usage and billing data. They only open a project’s content to give you support when you ask, to investigate a report or a security risk, or to comply with the law, and every access is logged with who, when and why.
• Authorities: we only hand over data when a law or a valid order requires it. We review each request, hand over the minimum necessary and, where the law allows, tell the person affected first. We only hand over the content of your projects, logs or comments with a court order or an equivalent legal obligation.
• If Bitácora changes hands (sale, merger), your data would pass to the new company under this same policy, and we would tell you in advance.

5. Your data outside your country

Bitácora is operated from the Dominican Republic and our servers and almost all our providers are in the United States. This is necessary to provide the service, and when you create your account we also ask for your express consent to it.

• If you are in Europe: when your data leaves the European Economic Area, the United Kingdom or Switzerland, we use the EU-US Data Privacy Framework with certified providers, and the European Commission’s standard contractual clauses with the rest (and as a backup). You can ask us for a copy of these safeguards.
• Access by US authorities: our providers are US companies and, under US laws (such as the CLOUD Act or Section 702 of FISA), US authorities can require them to give access to data they hold, even if it belongs to people from other countries. We cannot prevent this, but if a provider tells us about a request concerning Bitácora data, we will act as described in section 4.

6. How long we keep your data

If a law requires us to keep something, or if deleting it would harm someone else’s rights, we block it instead of deleting it and remove it when that obligation ends.

7. How we protect your data

Encrypted connections, passwords stored hashed, encrypted API keys, signed links that expire for prototype content, prototypes served from a separate domain (bitacora.id) so they cannot touch your session, usage limits, access logs, daily backups, and team access with additional verification. No system is infallible and we cannot guarantee absolute security.

If a security breach occurs that may put your data at risk, we report it to the relevant authorities within the period each law sets (72 hours in Europe; 3 business days in Brazil) and, if the risk is high, we tell you directly.

8. Your rights

You can ask us, free of charge, for:

• access: knowing what data of yours we hold and getting a copy;
• correction of anything that is wrong;
• deletion of your data;
• objection to our using it on the basis of legitimate interest, and restriction of its use;
• portability: taking it with you in a readable format (Take your things, in Settings, does this instantly);
• withdrawing your consent where that is the basis, without affecting what came before.

You can do many things yourself from Settings (correct, download, turn features off, delete your account). For anything else, write to hola@bitacora.live from your account email; we may ask you to prove who you are.

Deadlines. If you live in the Dominican Republic, we give you access within 5 business days at most and correct or delete within 10 business days at most, and we notify anyone we had shared that data with. In all other cases, we reply within one month at most; if the request is complex, we may need two more months and will tell you within the first month.

If you disagree with our reply:

• in the Dominican Republic, you can file a habeas data action before a court;
• in the European Union, you can complain to the data protection authority of your country (in Spain, the AEPD, aepd.es; in France, the CNIL, cnil.fr);
• in other countries, to the relevant authority.

We do not use your data to make automated decisions that significantly affect you.

9. If you live in the United States

We do not sell your personal data or share it for targeted advertising, as those terms are defined by the privacy laws of California and other states. Anyone, wherever they live, can exercise the rights in section 8, and we will not treat you worse for doing so.

“Do Not Track” and Global Privacy Control signals: we do not track your activity on other sites or let third parties do so through Bitácora, so these signals change nothing in our service.

10. If you are in Brazil

When we offer Bitácora to people in Brazil, we also apply the General Personal Data Protection Law (Law 13.709/2018, LGPD) and the Brazilian Civil Rights Framework for the Internet (Marco Civil, Law 12.965/2014).

• Contact for your data: write to us in Portuguese at hola@bitacora.live about anything concerning your data.
• Legal bases. We use those in Article 7 of the LGPD: performance of the contract (item V), our legitimate interest (IX), your consent (I) and compliance with legal obligations (II), as stated in each part of this policy. Processing your account data is a condition for providing the service: without it we cannot create your account.
• Your rights. In addition to those in section 8, you can ask us to confirm whether we process your data; to anonymize, block or delete data that is unnecessary or excessive; to tell you which public and private entities we share it with; and to explain what happens if you do not give your consent. We confirm immediately whether we hold your data and send you the full statement (origin, criteria and purpose) within 15 days at most. We handle other requests within the same period. If you disagree with our reply, you can go to the National Data Protection Authority (ANPD, gov.br/anpd) or to consumer protection bodies.
• Your data outside Brazil. Your data is stored in the United States and managed from the Dominican Republic, with the providers in section 4, to provide the service and for the periods in section 6. We send it to those countries because it is necessary to perform the contract you have with us (LGPD, art. 33.IX), and we protect it with the measures in section 7.
• Security incidents. If an incident may cause a relevant risk or harm to people in Brazil, we report it to the ANPD and to those people within 3 business days at most.
• Access logs. We keep the logs of access to Bitácora (IP address, date and time with time zone) for 6 months, in a secure environment with restricted access, because the Marco Civil (art. 15) requires it. We only hand them over with a court order.
• Age. In Brazil, Bitácora is only for people aged 18 or over.

11. Minors

Bitácora is not intended for people under 16 and we do not knowingly collect their data. If we learn that an account belongs to someone under 16, we close it and delete their data. If you think that is the case, write to us.

12. Cookies and storage in your browser

We use what is needed for the service to work and to remember your preferences. In addition, only if you accept them, an affiliate cookie and Google Analytics measurement cookies on the public website. There are no advertising cookies.

Local browser storage (these are not cookies and are not sent to our server):

• The app stores your interface preferences (language, sounds, list views and order, collapsed panels, notices already seen, the typing or dictation mode of each project). Some include a project identifier. It never stores keys, passwords or the content of your projects.
• While you sign in or sign up to apply as an affiliate, the app remembers that you have an application waiting to open, and deletes this when you submit or close it.
• The bitacora.live website stores the language you choose in the footer and, if you arrived through an affiliate link, the time of the discount notice.

The cookie notice. The first time you visit bitacora.live we ask you, in a small box, whether you accept optional cookies: Google Analytics measurement cookies and, if you arrived through an affiliate link, the affiliate cookie. “Accept” and “Reject” are equally easy. If you reject, or until you choose, neither is stored, and if they were there, we delete them. You can change your choice at any time with “Cookie preferences” in the website footer. We never turn on advertising cookies.

You can delete cookies and storage from your browser. If you delete the session ones, you will need to sign in again.

13. The bitacora.live website

• Logs: the server stores the IP, the page requested, the date and the browser for 14 days, for security and to detect failures.
• Google Analytics: the public pages of bitacora.live (not the app, the phone version, the portal or the panel) use Google Analytics to learn how many people visit them, where they come from and which pages they view. Until you accept measurement cookies, no Analytics cookie is stored in your browser and Google only receives visit pings without an identifier; if you accept, the _ga cookies are stored (section 12). Google does not store your full IP address. We use it only to improve the website, not for advertising. Google processes this data in the United States (under the EU-US Data Privacy Framework). Legal basis: your consent for the cookies; our legitimate interest for cookieless measurement. You can change your choice in Cookie preferences.
• Third-party fonts: the homepage animations that show sample screens request two fonts from Google Fonts, so your browser sends your IP to Google when you view them.
• Waitlists: if you sign up to be told about a new feature, we store your email, the feature, your language and the date, without your IP, only to notify you. We delete it when we tell you about the launch, after one year at most, or earlier if you ask.
• Links to other sites: the website links to third-party tools. When you follow them, those sites’ policies apply.

In prototypes: the screens a studio designs may load fonts or other third-party resources chosen by the designer (for example, Google Fonts). When you open those screens, your browser connects to those third parties.

14. Changes to this policy

If we change something minor, we update the version and date at the top. If the change affects how we use your data, we notify you by email and in the app at least 30 days in advance. We will never start using the data we already have for a new purpose without asking your permission first: we will not do it just by changing this text.

Previous versions are available at bitacora.live/privacy.

15. Contact

hola@bitacora.live · +1 (829) 478-2023 · A.SMITH GROUP, EIRL, Calle Miguel A. Piantini, Ed. 73, #101, San Carlos, Distrito Nacional, Dominican Republic.