SOY AGORA PRIVACY POLICY

1. DATA CONTROLLER

Controller: DENISOV STUDIO 360

Trade name: Soy Agora

NIF/CIF: Y6505053I

Address: Santa Cruz de Tenerife, Spain

Privacy email: compadre@soyagora.es

Website: soyagora.app

The controller determines the purposes and means of the processing of personal data carried out through Soy Agora, except for processing for which a third party legally acts as an independent controller.

2. WHAT SOY AGORA IS

Soy Agora is a digital platform that integrates, among other features:

• user profiles;
• private messaging;
• channels and communication spaces;
• posts, photos and videos;
• galleries;
• file sharing and storage;
• personal documents;
• message translation;
• Artificial Intelligence agents;
• personalized AI agents;
• knowledge bases for agents;
• AI document and image analysis;
• voice features;
• 360° virtual tours;
• creation and publication of digital menus;
• services and tools for businesses;
• radio and multimedia content;
• Agora Coins;
• community features;
• moderation, reporting and blocking systems;
• notifications;
• VIP features;
• other tools that may be added to the platform.

Not all features are available to all users, devices or subscription plans.

3. DATA WE MAY PROCESS

Depending on the features used, Soy Agora may process the following categories of information.

3.1. Registration and account data

We may process:

• name;
• username;
• email address;
• internal user identifier;
• password stored using cryptographic protection mechanisms, where applicable;
• registration date;
• account type and status;
• standard user, VIP, administrator or other available role status;
• account settings;
• language;
• preferences.

3.2. Profile information

When the user chooses to include it in their profile, we may process:

• profile photo;
• display name;
• description or “About me” information;
• posts;
• photos;
• videos;
• virtual tours;
• personal AI agent;
• information the user chooses to make public;
• activity or information displayed on the profile according to the platform's settings.

The user is responsible for deciding what information they voluntarily provide in the public fields of their profile.

Information marked as public may be visible to other Soy Agora users.

4. MESSAGES AND COMMUNICATIONS

Soy Agora allows users to send direct messages, participate in channels and communicate with other users and Artificial Intelligence agents.

To provide these features, we may process:

• message content;
• sender and recipient;
• channel or conversation;
• date and time;
• attachments;
• images;
• audio;
• video;
• reactions;
• technical information needed to deliver, synchronize and display messages.

Content sent to other users will be accessible to its recipients.

Users should avoid sending confidential information, data in specially protected categories or third-party data through Soy Agora when they do not have sufficient legal grounds to do so.

5. ARTIFICIAL INTELLIGENCE

Soy Agora integrates agents and tools based on Artificial Intelligence.

When the user interacts with an AI agent, the following may be processed:

• questions and messages sent to the agent;
• conversation history and context;
• attachments;
• images;
• documents;
• information retrieved from the agent's knowledge base;
• preferences or memory associated with the user when this feature is enabled;
• information needed to generate the response.

Soy Agora's core Artificial Intelligence processing is carried out through private infrastructure managed for the platform.

As a general principle of its core architecture, Soy Agora does not use external public AI providers to process its agents' ordinary conversations.

This does not prevent certain features expressly requested by the user, such as Internet searches, from requiring communications with services available over the Internet.

6. LIMITATIONS OF ARTIFICIAL INTELLIGENCE

Artificial Intelligence systems may generate incorrect, incomplete, outdated, imprecise or inappropriate information.

Responses generated by AI agents are informational and should not automatically be considered professional advice.

In particular, unless expressly stated otherwise, agents' responses do not replace:

• medical advice;
• medical diagnosis;
• professional psychological assistance;
• legal advice;
• financial advice;
• tax advice;
• investment advice;
• specialized professional services.

The user should verify important information before making decisions based on a response generated by Artificial Intelligence.

Soy Agora does not guarantee the absolute accuracy of AI-generated responses.

7. USER-CREATED AI AGENTS

Authorized users may create and configure Artificial Intelligence agents and provide them with instructions, documents and knowledge bases.

The agent's creator is responsible for the content they add to it and must ensure they have the necessary rights and authorizations.

The user must not add to a knowledge base:

• unlawfully obtained information;
• third-party personal data without a sufficient legal basis;
• other parties' trade secrets;
• confidential documentation without authorization;
• content that infringes intellectual property rights;
• content whose use is prohibited by applicable law.

Soy Agora may remove or block agents or content when there are reasonable indications of unlawful use, infringement of rights, security risks or breach of the platform's terms.

8. DOCUMENT AND IMAGE ANALYSIS

Certain agents can analyze files submitted by the user.

These files may include:

• PDF;
• text documents;
• spreadsheets;
• presentations;
• photos;
• images;
• other supported formats.

To provide this feature, Soy Agora may extract text, interpret images and process the content using its Artificial Intelligence systems.

The user decides which documents to provide to the system.

We do not recommend uploading documents containing particularly sensitive information unless strictly necessary.

The user is responsible for having sufficient authorization to process documents containing third-party information.

9. PARTICULARLY SENSITIVE DATA

Soy Agora does not generally ask users to provide data belonging to special categories.

However, due to the open nature of chats, documents, AI agents and posts, a user may voluntarily enter information relating to:

• health;
• racial or ethnic origin;
• political opinions;
• religion or beliefs;
• trade union membership;
• biometric data;
• sex life or sexual orientation;
• other specially protected data.

The user should avoid entering this type of information unless it is necessary and they have an appropriate legal basis.

The existence of a free-text field or document upload feature does not constitute a request by Soy Agora to provide special categories of personal data.

10. AUTOMATIC TRANSLATION

Soy Agora may offer automatic translation of messages and other content.

Generating a translation requires processing the relevant text through the platform's translation systems.

Automatic translations may contain errors or differences in interpretation.

They should therefore not be used as the sole reference when an accurate translation has significant legal, medical, financial, administrative or professional consequences.

11. VOICE AND AUDIO

When the user uses voice messages or voice communication features with AI agents, Soy Agora may process:

• audio recordings;
• transcriptions;
• text generated from audio;
• AI responses;
• artificially generated audio.

Temporary files used exclusively for processing may be deleted once processing is complete.

When a recording forms part of a conversation, it may be retained for as long as necessary to allow playback within that conversation.

12. PERSONAL FILES AND DOCUMENTS

Soy Agora allows certain files and documents to be stored.

We may process:

• file name;
• type;
• size;
• creation or upload date;
• owner;
• folder;
• technical metadata;
• file content when necessary to provide a requested feature.

Private documents do not become public simply because they are stored in Soy Agora.

The user is responsible for maintaining independent backups of documents whose loss could cause significant harm.

Soy Agora should not be used as the sole filing system for critical documentation.

13. PHOTOS, VIDEOS AND GALLERIES

When the user publishes multimedia content, we may process:

• photos;
• videos;
• description;
• author;
• date;
• comments;
• reactions;
• views;
• reports;
• location information when that feature is used.

Published content may be visible to other users depending on the type of publication and the relevant settings.

The user guarantees that they have the necessary rights to the content they publish and, when identifiable third parties appear, that they have an appropriate legal basis for publication.

14. LOCATION

Some Soy Agora features may use location information.

Location may be used, for example, to:

• provide results relating to the user's area;
• discover nearby content;
• answer geographical questions;
• provide location-based services;
• enable certain AI agent features.

When an agent has location capability enabled, it may use the user's approximate location when necessary to respond to a request compatible with that feature.

Soy Agora will seek to apply the principle of minimization and use only the level of precision necessary for the relevant feature.

The user can control location permissions through their device's operating system where applicable.

15. IP ADDRESS, DEVICE AND SECURITY

To ensure the operation and security of the platform, we may process technical information such as:

• IP address;
• connection date and time;
• device type;
• operating system;
• Soy Agora version;
• technical identifiers;
• technical and error logs;
• information needed to detect abuse or unauthorized access.

Authorized administrators may have limited access to certain security information.

The platform may retain the latest available information about:

• device;
• IP address;
• approximate city and country associated with the connection.

Soy Agora does not intend to create a permanent history of the user's physical locations through this security feature.

16. APPROXIMATE GEOLOCATION USING IP

An IP address may allow an approximate estimate of the country or city from which a connection is made.

This information may be used for:

• security;
• abuse prevention;
• incident investigation;
• technical administration;
• account protection.

IP-based geolocation is approximate and may be incorrect, especially when using VPNs, mobile networks, proxies or other connection mechanisms.

17. MODERATION, REPORTS AND BLOCKING

Soy Agora provides tools designed to keep the community safe.

We may process information relating to:

• reports;
• reporting user;
• reported user;
• reported content;
• reason;
• date;
• moderation decisions;
• warnings;
• blocks;
• administrative actions.

Access to this information is limited to authorized staff or administrators when necessary.

We may retain certain records for as long as necessary to investigate abuse, resolve disputes, protect the platform or meet legal obligations.

18. AGORA COINS

Soy Agora may incorporate an internal system called Agora Coins.

To provide this feature, we may record:

• balance;
• transactions;
• date and time;
• amount;
• sender;
• recipient;
• reference or comment;
• content related to a transaction;
• transaction identifiers;
• administrative operations;
• audit logs.

The balance and personal history are not public, except for amounts or elements expressly indicated as public within a particular feature.

Authorized administrators may access information needed to administer, audit, investigate or correct transactions.

Agora Coins is an internal Soy Agora feature, and its processing will also be governed by the specific terms applicable to that feature.

19. DIGITAL MENUS AND PUBLIC CONTENT

Soy Agora allows digital menus to be created from photos or other content provided by the user.

Published menus may have a public webpage accessible via a link or QR code.

Information voluntarily included in a published menu may therefore be accessible without signing in.

The menu's creator is responsible for checking the following before publication:

• text;
• prices;
• photos;
• logos;
• contact details;
• commercial information;
• links;
• social media;
• information about products and services.

Automatic interpretation of photos using Artificial Intelligence may contain errors. The user must review the content before publishing it.

20. 360° VIRTUAL TOURS

Authorized users may create and publish virtual tours.

A published tour may be accessible through links, QR codes or embedding on external websites.

The user is responsible for the content included in the tour, including:

• photos;
• 360° images;
• text;
• logos;
• links;
• content embedded via iframe;
• commercial information.

When a user makes a tour public, they understand that this content may be viewed outside Soy Agora through the available publication methods.

21. RADIO, MUSIC AND MULTIMEDIA CONTENT

Multimedia features may record information needed to provide and improve the service, such as:

• content played;
• favorites;
• bookmarked content;
• preferences;
• interaction with multimedia elements.

Where it is not necessary to personally identify the user, we will endeavor to use only the minimum information needed to provide the feature.

22. NOTIFICATIONS

Soy Agora may send:

• in-app notifications;
• push notifications;
• operational communications;
• security notices;
• account-related notices;
• information relating to contracted features.

Push notifications may require the use of notification infrastructure provided by the device's operating system.

The user can change notification permissions from their device.

23. PURPOSES OF PROCESSING

Data may be processed to:

• create and manage accounts;
• authenticate users;
• provide chats, channels and communications;
• store and share files;
• display profiles and posts;
• provide Artificial Intelligence features;
• analyze documents and images when requested;
• perform translations;
• provide voice features;
• manage personal storage;
• provide virtual tours;
• create and publish digital menus;
• manage Agora Coins;
• provide radio and multimedia content;
• manage VIP features;
• manage payments or subscriptions where applicable;
• send notifications;
• provide support;
• resolve errors;
• maintain security;
• prevent fraud and abuse;
• moderate content;
• investigate reports;
• protect the rights of users and Soy Agora;
• meet legal obligations;
• defend Soy Agora against claims.

24. LEGAL BASES

Depending on the specific processing, we may rely on:

Performance of a contract

When processing is necessary to provide a feature requested by the user or maintain their account and Soy Agora services.

Consent

When the law requires consent or when an optional feature depends on the user's decision.

Consent may be withdrawn where applicable.

Legitimate interest

We may process certain data when necessary for legitimate interests such as:

• security;
• fraud prevention;
• infrastructure protection;
• abuse prevention;
• incident resolution;
• defense against claims;
• reasonable improvement of service stability,

provided that these interests do not override the user's rights and freedoms.

Legal obligation

We may retain or disclose information when necessary to comply with an applicable legal obligation.

25. THIRD-PARTY DATA PROVIDED BY THE USER

Soy Agora allows users to enter content freely.

A user may therefore provide information relating to other people.

Anyone providing third-party personal data declares that they have a sufficient legal basis to do so.

Soy Agora cannot verify in advance the lawfulness of all data included by users in:

• messages;
• documents;
• images;
• videos;
• knowledge bases;
• AI agents;
• posts;
• menus;
• tours;
• comments.

If a person believes their data has been unlawfully published or processed by another user, they may request a review through the privacy channel indicated in this Policy.

26. PUBLIC INFORMATION

Certain features allow content to be published.

Depending on the feature, the following may be public:

• username;
• profile photo;
• public profile information;
• posts;
• photos and videos;
• comments;
• certain activity indicators;
• virtual tours;
• digital menus;
• published agents;
• certain totals associated with content.

The user should assume that published information may be viewed, copied or redistributed by third parties.

Even if Soy Agora later removes the original content, it may not always be technically possible to delete copies previously made by third parties outside the platform.

27. DATA RECIPIENTS

Personal data may be accessible, as appropriate, to:

• other users when the feature itself involves communication or publication;
• authorized Soy Agora administrators;
• strictly necessary technical providers;
• mobile notification infrastructure providers;
• email providers when email communications are used;
• public authorities, courts or law enforcement where there is a legal obligation.

We do not sell our users' personal databases.

28. LOCAL ARTIFICIAL INTELLIGENCE PROCESSING

One of Soy Agora's technical principles is to process core Artificial Intelligence features through private infrastructure.

Prompts, documents and ordinary conversations with AI agents are not intentionally sent to external public Artificial Intelligence platforms to obtain a response when Soy Agora's local infrastructure is used.

This reduces information exposure to external providers but does not eliminate all risks inherent in the electronic processing of information.

29. AGENTS' INTERNET FEATURES

Some agents may have access to searches or information available on the Internet.

When the user requests a feature that requires external access, certain technical queries may be transmitted to external services needed to retrieve the requested information.

Soy Agora will seek to minimize the information transmitted and avoid sending unnecessary personal data as part of a search.

The user should not include unnecessary private information in requests explicitly intended for public Internet searches.

30. INTERNATIONAL TRANSFERS

Soy Agora's main infrastructure is designed to keep core processing and Artificial Intelligence on private infrastructure.

However, certain ancillary services—for example, mobile notifications, email, web resources requested by the user or other technical services—may involve providers that process data from other countries.

Where there is an international transfer of personal data, the safeguards required by European data protection regulations will apply.

31. DATA RETENTION

Personal data will be retained only for as long as necessary to provide the service, fulfill the purposes described and meet legal obligations.

As a general rule:

Account: while it remains active and subsequently for the period needed to meet legal obligations or address claims.

Messages and content: while they remain stored in the account or relevant spaces, unless deleted or lawfully retained for other reasons.

Files: while they remain stored by the user or are needed to provide the relevant feature.

Agent and knowledge base data: while the agent exists or until deleted in accordance with the available features.

Security logs: for the period reasonably necessary to protect the platform and investigate incidents.

Agora Coins: for as long as necessary to maintain the integrity of transaction history, resolve disputes, conduct audits and meet applicable obligations.

Data subject to legal obligations: for the periods required by law.

When data is no longer necessary, it may be deleted, anonymized or blocked as appropriate.

32. ACCOUNT DELETION

The user may request deletion of their account through the available features or by contacting Soy Agora.

Deleting an account does not necessarily mean the instant deletion of absolutely all records.

We may retain certain information when necessary to:

• meet legal obligations;
• prevent fraud;
• investigate abuse;
• maintain transaction integrity;
• resolve disputes;
• establish, exercise or defend claims;
• protect the rights of third parties.

Where appropriate, remaining data may be blocked, anonymized or restricted.

Messages sent to other people or shared spaces may require specific treatment to preserve the coherence of conversations and the rights of other users.

33. BACKUPS

Where backups exist, deleting information from active systems may not cause its immediate removal from all backups.

Residual data may remain temporarily in backups until their rotation or deletion according to the relevant retention cycle.

These copies must not be used for ordinary purposes once the data has been deleted from the active system, unless a technical restoration or compliance with a legal obligation is necessary.

34. SECURITY

Soy Agora adopts technical and organizational measures designed to protect data against:

• unauthorized access;
• improper alteration;
• loss;
• destruction;
• disclosure;
• abuse.

Measures may include:

• communications encrypted using HTTPS/TLS;
• authentication;
• access controls;
• administrative permissions;
• private infrastructure;
• file access restrictions;
• technical logs;
• security and moderation mechanisms.

However, no computer system connected to a network can guarantee absolute security.

The user is also responsible for keeping their credentials confidential and protecting the device they use to access Soy Agora.

35. SECURITY INCIDENTS

In the event of a security breach affecting personal data, Soy Agora will assess the incident and implement the measures required by current law.

Where there is a legal obligation, the supervisory authority and/or affected users will be notified within the legally established deadlines.

36. USER RIGHTS

In accordance with applicable regulations, the user may exercise the rights to:

• access their personal data;
• rectify inaccurate data;
• erasure;
• restriction of processing;
• object;
• data portability, where applicable;
• withdraw consent, where processing is based on consent.

To exercise these rights, you may contact: compadre@soyagora.es

We may request information reasonably necessary to verify the applicant's identity before responding to a request.

These rights may be exercised free of charge under the terms provided by law.

37. COMPLAINTS

If the user believes the processing of their personal data breaches applicable regulations, they may lodge a complaint with the competent data protection authority.

In Spain, the principal authority is the Spanish Data Protection Agency (AEPD).

This does not limit the user's right to use other available administrative or judicial remedies.

38. MINORS

Soy Agora is not specifically directed at children under 14.

Where consent-based processing affects a child under 14, the holder of parental responsibility or guardianship must be involved under the terms established by Spanish law.

Users must not use Soy Agora to unlawfully collect personal information about minors.

If we become aware that a minor's data has been processed in breach of applicable legal requirements, we may take steps to delete it or restrict its processing.

39. USER RESPONSIBILITY FOR CONTENT

The user is responsible for information they:

• publish;
• share;
• store;
• send;
• upload;
• add to an agent;
• add to a knowledge base;
• use to create a menu;
• add to a virtual tour.

The user undertakes not to use Soy Agora to unlawfully process or disseminate third-party personal data.

40. AUTOMATED DECISIONS

Soy Agora's Artificial Intelligence features generate content automatically at the user's request.

As a general rule, these responses are not designed to independently make decisions that produce legal effects concerning the user or similarly significantly affect them.

If an automated decision-making feature with such effects is implemented in the future, Soy Agora will provide the additional information and safeguards required by applicable law.

41. THIRD-PARTY LINKS AND CONTENT

Soy Agora may contain links, webpages, embedded content or resources belonging to third parties.

Soy Agora does not control the privacy practices of external websites or services.

When the user leaves Soy Agora or interacts directly with an external service, they should consult that third party's privacy policy.

42. CHANGES TO SOY AGORA'S FEATURES

Soy Agora is continuously evolving.

We may:

• add features;
• modify features;
• remove features;
• change technologies;
• update Artificial Intelligence systems;
• modify infrastructure.

When a change involves a material modification to how personal data is processed, we will update this Privacy Policy and, where legally necessary, notify the user or request renewed consent.

43. CHANGES TO THIS POLICY

We may update this Privacy Policy to reflect:

• legislative changes;
• new features;
• technical modifications;
• changes in providers;
• security improvements;
• organizational changes.

The date of the latest update will appear at the beginning of the document.

Where changes are substantial, we may provide notice through the app, website, email or another appropriate means.

44. INTERPRETATION

This Policy must be interpreted in accordance with:

• Regulation (EU) 2016/679 (GDPR);
• Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights;
• applicable Spanish and European legislation.

The possible invalidity of a provision of this Policy will not necessarily affect the validity of the remaining provisions.

45. CONTACT

For any questions relating to privacy, data protection or the exercise of rights:

Soy Agora

Controller: DENISOV STUDIO 360

NIF/CIF: Y6505053I

Address: Santa Cruz de Tenerife, 38001

Spain

Privacy email: compadre@soyagora.es

© 2026 Soy Agora. All rights reserved.