Privacy Policy

Twintag Services SL, tax ID (NIF) B57728818, registered at Paseo del Prado 12, 7º Centro Izquierda, 28014 Madrid, Madrid, España, Spain, is the controller responsible for processing the data described in this policy. You can contact us at hola@severino.io.

• Account data: your Google identifier and email, used to sign in and verify your subscription.
• Subscription and payment data: your subscription status and the customer/payment identifiers Stripe returns to us. We never see or store your card number.
• Billing page content: when you search for invoices, the extension reads the text and structure of the provider's page (not screenshots) to locate the correct document. If the usual route fails, that content is sent to our backend, which may in turn forward it to an AI model provider to decide the next navigation step. Before it leaves your browser, the extension strips emails, card numbers (masked ones too), IBANs, phone numbers, Spanish tax IDs and API keys from that text. Passwords are never sent: a page's visible text doesn't include the value of password fields.
• Invoices (PDF): every downloaded invoice is saved on your computer. A copy is sent to our backend to extract the amount, currency, number and issue date (only the text is passed to the AI model, with the same sensitive data stripped) and, if you set it up, to forward it to your accountant. The PDF isn't stored in our database — only the extracted fields, the provider and the period.
• Analytics and support: we record usage events from the website and the extension (e.g. "search started", "invoice found") to improve the product, without the content of your invoices or your providers' pages. If you write to us through the support chat, we keep that conversation.
• Automatic-mode usage log: we store which provider, how many steps, and with what result an automatic-mode search ran, so we can limit its use and improve the saved routes for each provider.
• Your accountant's email and the invoices found: if you set your accountant's address, every invoice we find is automatically forwarded by email from an address unique to your account (not shared with other users), so invoices from different customers never get mixed up.

• Google, for signing in with your account.
• Stripe, to process the subscription payment.
• Our AI model provider, when the automatic invoice-search mode described above is triggered.
• AgentMail, to email the invoices found to your accountant's address.
• Vercel, as the hosting provider for our backend (EU, Frankfurt), and its AI Gateway to reach the AI model (Anthropic, USA).
• Neon, database hosted on AWS (EU, Frankfurt).
• PostHog, product analytics (EU).
• Crisp, support chat (EU).

We do not sell your data to third parties or use it for advertising purposes.

When a provider processes data outside the European Economic Area, the transfer relies on the safeguards provided by the GDPR: the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. The up-to-date detail for each service is on our security page.

We process your data to perform the subscription contract you accept by using Severino, and in the case of the automatic-mode usage log, also on the basis of our legitimate interest in keeping the service running reliably and controlling its cost.

We retain account and subscription data for as long as you keep an active subscription, plus the additional period required to comply with legal obligations (for example, tax-related ones). Page content sent in automatic mode isn't stored: it's used to decide the next step and discarded; we only keep the reusable route (URLs and selectors) and a log of steps and outcome. Invoice PDFs aren't stored in our database; your history (provider, period, amount, number and date) is kept for as long as you keep your account. If you enable forwarding to your accountant, the copy of the sent email is deleted from the outbox as soon as it's delivered.

You can request access, rectification, erasure, restriction of or objection to the processing of your data, as well as data portability, by writing to hola@severino.io. If you are in Spain, you can also file a complaint with the Spanish Data Protection Agency (aepd.es) if you believe our processing does not comply with applicable regulations; if you are elsewhere in the EU, you may contact your local data protection authority.

The extension operates only within your already-open session at each provider: it never enters or stores your passwords. It has access to no website when installed; it asks Chrome for permission for each provider you enable, and you can revoke it at any time. By design it blocks any click on buttons to pay, buy, change plan, cancel, delete or sign out, and on forms with a password or card field. Communications between the extension and our backend, and between our backend and Stripe/AgentMail/Google/our AI model provider, are encrypted in transit.

If we modify this policy, we will publish the updated version on this same page along with the update date.

For any questions about this privacy policy, write to us at hola@severino.io.