Castellano · Català · English

Privacy annex: apps and bill analysis without an account

This annex is part of the Spock privacy policy, which applies to everything not said here. It covers what is specific to two ways of analysing your electricity or gas bill without creating an account: the Spock mobile app and the Spock connector for AI assistants (Claude, ChatGPT or others).

Who processes your data and why

The controller is Spock p2p, S.L. (tax ID B-67743567), with its registered address at Plaça Ausiàs March, 1, planta 1, oficina 6, 08195 Sant Cugat del Vallès (Barcelona), Spain. For any privacy question, write to us at soporte@spock.es.

We process your data to:

• Analyse your bill and work out your saving, including the lookup of your supply point. You ask for it to decide whether to sign up, so the legal basis is taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR).
• Keep your result in your account and, if you sign up, handle the contract: performance of the contract (Art. 6(1)(b) GDPR), as the general policy explains.
• Look up your consumption in Datadis: your consent, which we ask for separately when you sign up and you can withdraw at any time.
• Keep the proof of the contract (what you accepted, when and from where): the legal obligation to keep it and Spock’s legitimate interest in being able to prove it.
• Send you marketing: only with your consent, asked for separately. The app does not ask for it, so we send no marketing to people who come through it.

What Spock reads from your bill

Your bill carries personal data. An automated system reads it and extracts the holder (name and tax ID), the CUPS, the supply address, the marketer, the dates, the consumption, the contracted power, the prices and the amounts. The result is an indicative calculation of your saving.

• The reading is done by Lince, Spock’s bill reader, with an artificial intelligence model from Anthropic. If Lince does not answer, Spock falls back to an external bill-reading provider, and it does not keep the IBAN from that provider’s result.
• Supply point lookup: with the CUPS, Spock looks up, through an energy data provider, the technical and consumption data the distributors publish (SIPS), to complete your annual consumption and your tariff.

The Spock mobile app

• You analyse your bill without signing up: we ask for no name or email.
• Camera and files: the app only uses the camera to photograph the bill and only accesses the photo or PDF you choose. It records no video or audio and does not ask for your location or your contacts. Photos are turned into a PDF on your phone before they are sent.
• Saving your result: if you give us your email, we send you a code to confirm it and the analysis moves to your Spock account. From then on the general policy applies.
• Error reports: if the app fails, it sends a technical report to our error-monitoring service. Before sending it, it hides the phone number, the DNI or NIE and any codes, keeps only the domain of the email and only the last four digits of the IBAN.
• Deleting your account: from the app itself, under «Your account». We close it within 24 to 48 hours, and until then you can reactivate it. What the law requires us to keep (for example, a signed contract and its proof) stays blocked for six years after the contract ends and is only used to meet legal obligations.

The assistant connector: what reaches it and what it returns

Connecting without an account asks for no name or email: the connection is a random identifier.

Your bill can reach the connector in two ways:

• With the upload link (the usual case): you upload it from your browser to a page of this service, and from here it goes to Spock. It never goes through the assistant. It takes one PDF or up to 6 photos; photos are turned into a PDF and lose their metadata (EXIF, GPS location included).
• As a ChatGPT attachment: if you uploaded it to the chat, OpenAI already has it. The connector downloads it from the address ChatGPT gives and sends it to Spock the same way.
• What goes back to the assistant: whether it is electricity or gas, the masked CUPS, the tariff, the annual consumption in kWh, the saving with the collective purchase (percentage and euros a year, what you pay and what you would pay) or the reason there is no figure, the marketer and the collective purchase of the winning offer, some notices (for example, if you are on the regulated tariff), for gas the estimate at the regulated tariff (TUR) when there is no saving, and the link to continue on Spock with its expiry. Never the bill, your name, your address or your IBAN.
• What the tools return is processed by the assistant platform under its own privacy policy.
• The collective purchase and electricity price (OMIE) tools only return public data.
• If you connect your Spock account («Sign in with Spock»), the assistant can only read, never change, what you tick: your account with the email masked and your supplies (address, tariff, marketer, contracted power and the state of the services), your consumption history, hourly too, and the holder’s name with a partial DNI or NIF (the last four characters).

The assistant connector: what it keeps and for how long

• The bill: it does not keep it. It is read in memory and sent to Spock; it is never written to disk or to a database.
• Each analysis: a record with its state, the attempts, the language, the connection that asked for it, the internal number of the supply at Spock and the result, encrypted. It is deleted after 24 hours. The upload link works for 15 minutes and 3 attempts.
• Usage counters, to limit how many analyses are run: they count per connection, per app and per IP address, but the IP is never stored; only a keyed hash (HMAC) that cannot be turned back into it. They are deleted one day after their period closes (48 hours at most).
• The connection with the assistant: without an account, a random identifier that lasts up to 180 days and expires after 30 without use; with an account, up to 90 days or until you disconnect it. Codes and tokens are stored hashed, never in clear; with an account, the read credential Spock issues is stored encrypted and expires with the connection.
• Technical logs: the time, the tool, the app and its platform, the outcome, the latency and some technical identifiers. Never your IP, your full CUPS, the bill, the upload or continue links or any token. They are kept in our cloud provider’s logging service, which deletes them automatically when their retention period ends.
• Whatever has expired is deleted automatically, up to 24 hours late.

What Spock keeps of your bill and when it deletes it

Whether it comes from the app or the connector, Spock keeps:

• An anonymous user, with no email or name, tagged with the channel you came from (the app or the assistant). From the connector it also receives a per-person key that is not personal data: a keyed hash (HMAC) of your connection.
• A supply with your CUPS and your current marketer, and the saving calculation.
• The reading of the bill, with the data in «What Spock reads from your bill».
• The file (PDF), in Spock’s cloud storage.
• If the bill cannot be read or does not qualify, an error record with the reason, where the file is and its fingerprint (hash).
• For the connector only, the link to continue: Spock keeps only its fingerprint (hash) and a summary of the result with the CUPS masked. It works once and expires after 7 days, or earlier if the anonymous user expires.
• 30 days after you analysed the bill, unless you saved it to your account, signed, joined a collective purchase or gave the holder’s details to sign up, the anonymous user, the supply, the reading, the file, the saving calculation, the error record and the link record are permanently deleted, together with their change history. The copy of the reading Lince keeps is deleted too, with its file. All that remains is a technical log line with identifiers and counts and, in Lince, the entry of what was billed, with no data from the bill. The backup copies of the file disappear within the following 7 days. The deletion runs every day; if a step fails, it is retried the next day.
• If you save it to your account (with your email in the app, or by signing in from the connector’s link), the analysis moves to your account and the general policy’s periods apply.

Who else processes your data

Spock relies on providers that process the data only on its behalf and following its instructions (processors), for:

• hosting, cloud storage and sign-in;
• the automated reading of the bill with artificial intelligence and, as a fallback, another bill-reading provider;
• the technical and consumption data of the supply point;
• sending emails and, if you sign up, the electronic signature and sending codes by SMS;
• error monitoring of the app and the service.

International transfers

One of those providers is in the United States, so your data leaves the European Economic Area. You can ask us for a copy of the safeguard that protects it at soporte@spock.es.

• Anthropic, which reads the bill for Lince, receives the whole file. The transfer relies on the European Commission’s standard contractual clauses, which are part of Anthropic’s data processing addendum. Anthropic does not use what it receives to train its models and deletes it within 30 days at most, unless it must keep it longer by law or to enforce its usage policy.

Your rights

You can ask for access, rectification, erasure, objection, restriction and portability of your data by writing to soporte@spock.es, and complain to the Spanish Data Protection Agency (aepd.es).

If you analysed a bill without an account, tell us its CUPS so we can find it. If you do not, it is deleted automatically after 30 days.

If you connected your account to an assistant, you can disconnect it at any time from your connections. In the app, you can delete your account as explained above.