Last updated: 4 August 2026 · This is an English courtesy translation of the Política de Privacidad. In case of discrepancy, the Spanish version prevails.
This Privacy Policy explains who processes your personal data, which data, for what purpose and on what legal basis when you visit https://detectordebulos.com, use the Detector de Bulos browser extension (on any plan, including the free one), buy a licence or contact us. It follows Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD) and Law 34/2002 (LSSI-CE).
1. Data controller
| Company | HOLOMENTS SL (single-member limited company) |
| Tax ID | B05359062 |
| Address | Avenida Litoral, 45, Portal I, 1st floor, 29680 Estepona (Málaga), Spain |
| Website | https://detectordebulos.com |
| Contact | info@detectordebulos.com |
HOLOMENTS SL has not appointed a Data Protection Officer, as none of the cases in Article 37 GDPR applies. For any question about this policy write to info@detectordebulos.com, the only contact mailbox.
2. The content you analyze: built-in engine and BYOK option
This is the most important part of this policy. Detector de Bulos offers two ways to analyze content, and your data travels differently in each: the built-in (managed) engine, active by default on every plan, and the BYOK option («bring your own key»), available on every plan: on the Free plan it keeps the same monthly cap; on Pro and Familia it is not limited by our quotas.
2.1. Built-in engine (default on every plan)
- The text you submit travels encrypted (HTTPS) from your browser to our server api.detectordebulos.com, running on Oracle Cloud Infrastructure in the eu-madrid-1 region (Madrid, Spain).
- Our server does not store the analyzed content: it processes it and keeps only a cryptographic digest (SHA-256 hash) in the usage log, used to count consumption; the original content cannot be reconstructed from it. Neither the text nor the model’s answer is written to logs.
- The analysis is performed by an AI model hosted on HOLOMENTS SL’s own infrastructure, in the same Oracle Cloud environment. The content is not forwarded to any external AI provider and does not leave the European Economic Area. Should the built-in engine ever rely on an external inference provider, this policy will be updated before activation, naming the provider, its location and the applicable safeguards.
- Verdict cache. To answer instantly when the same content — a circulating hoax — is analyzed by several people, we keep for up to 30 days, keyed by the content hash and linked to no licence or user, the extracted claims, their verdict, the reasoning and the source links; never the full analyzed text. If the claims look like they contain personal data (emails, phone numbers, identifiers), the result is not stored.
- Public verdicts. When the same content has been analyzed from at least three different licences — circulating material rather than a private text — its verdict may be published on a page of this site (detectordebulos.com/v/…) with the claims, the verdict and the sources, with no user data. If you believe a verdict page contains information that should not be public, write to us and we will remove it.
- The legal basis is the performance of the contract (Art. 6.1.b GDPR): analyzing the content with the AI model is the very service you request.
- Audio verification is not yet operational: no audio data is processed by the built-in engine today. When activated on the plans that include it, audio will follow the same no-storage path and, if its transcription is entrusted to an external provider, this policy will name it — with location and safeguards — before the feature is activated.
- Other channels. The demo on the site’s home page and, when activated, the WhatsApp verification service use the same engine under the same rules. On WhatsApp, the sender’s number is used only to reply and to apply the daily limit, in hashed form, and is not stored.
2.2. BYOK option (available on every plan)
If you enable BYOK, you choose the AI provider (OpenAI, Anthropic, Google or others), hold the account with that provider and configure your own API key in the extension. In that case the content you analyze travels directly from your browser to your provider’s API; it never passes through HOLOMENTS SL’s servers; HOLOMENTS SL is neither controller nor processor of that content, and your provider’s privacy policy governs that processing. Your API key is stored locally in your browser and is never sent to us.
2.3. Optional Telegram / webhook alerts (silent mode)
The extension includes a silent mode, off by default, that can alert you when it flags risky content. If you enable it and configure a destination, the extension sends — directly from your browser — the URL and title of the flagged page, the verdict and, for webhooks, the alert email address you typed. Destinations are a Telegram bot you create and control (via the Telegram API) or a webhook endpoint you choose (n8n, Zapier, your own server). HOLOMENTS SL never receives these alerts: the data goes from your browser to your own services, and you can turn it off at any time in the extension settings.
Practical advice: avoid analyzing content that includes third parties’ personal data, confidential information or material under professional secrecy, since it will be transmitted to the relevant engine: our server with the built-in engine, or the provider you configured with BYOK.
3. Data we process, purpose and legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, billing address, tax ID when an invoice is requested, phone if provided | Manage the purchase, issue the invoice, maintain the contract | Contract (Art. 6.1.b) and legal obligation for invoicing (Art. 6.1.c) |
| Order data: plan, amount, currency, date and the transaction identifier returned by the payment gateway | Process the order, manage renewals, refunds and claims | Contract (Art. 6.1.b) |
| Licence data held by our API: licence key stored as a SHA-256 hash, associated email, plan, status, monthly usage counters and identifiers of the devices it is activated on | Issue and validate the licence, activate the extension, apply plan quotas and enforce the device limit (1 device on Free, 2 on Pro, 5 on Familia, 30 on Aula) | Contract (Art. 6.1.b); legitimate interest in preventing fraud and device-limit abuse (Art. 6.1.f) |
| Free-plan device identifier: a random UUID generated by the extension, not linked to your name, email or any identifying data | Automatically issue the free licence bound to that device and apply its limits: 20 text checks a month, no audio, one device | Contract (Art. 6.1.b) |
| Content submitted through the built-in engine (text and, on plans that include it, audio) | Provide the verification service as described in 2.1 | Contract (Art. 6.1.b) |
| Usage log of the built-in engine: licence identifier, operation type, units consumed, verdict label and SHA-256 hash of the content | Count monthly consumption, apply plan limits, prevent abuse, and compute anonymous aggregate statistics | Contract (Art. 6.1.b) and legitimate interest (Art. 6.1.f) |
| Delivery email | Send the licence key and strictly necessary service communications | Contract (Art. 6.1.b) |
| Email and content of your enquiries | Provide support | Contract or legitimate interest (Arts. 6.1.b and 6.1.f) |
| Email, if subscribed to commercial communications | Send news and offers about our products | Consent (Art. 6.1.a) or Art. 21.2 LSSI for similar products; unsubscribe at any time |
| Billing and accounting data | Comply with tax, accounting and commercial obligations | Legal obligation (Art. 6.1.c) |
| Server technical logs: IP address, date and time, browser data | Security, availability and integrity of the site and the API | Legitimate interest in system security (Art. 6.1.f) |
The free plan requires neither registration nor purchase: the extension generates a random device identifier and our API issues a licence bound to it. That identifier is not linked to your name or email, so by itself it does not let us know who you are. We do not process card data — payments are entered directly in the payment gateway’s secure environment. We make no automated decisions with legal effects and build no behavioural profiles.
4. Recipients
We do not share your data with third parties except where legally required. We work with the following providers, which access personal data as processors or, in the case of the payment gateway, as independent controllers of their own activity:
| Provider | Role |
|---|---|
| Stripe | Payment gateway: processes payments, recurring subscriptions and refunds |
| IONOS | Outgoing email (SMTP) for licence delivery and domain hosting |
| Oracle Cloud | Infrastructure running the licensing API and the built-in engine (api.detectordebulos.com), including the self-hosted AI model, in the eu-madrid-1 region (Madrid, Spain) |
The built-in engine’s AI model runs on infrastructure contracted by HOLOMENTS SL, so today no external AI provider receives the content you analyze. Data may also be disclosed to tax authorities, banks, courts and law enforcement when legally required.
5. International transfers
Our API infrastructure — licensing and built-in engine — runs in Oracle Cloud’s eu-madrid-1 region, so licence data, usage logs and analyzed content do not leave the European Economic Area. Today no international transfer of analyzed content takes place. Should any provider process data outside the EEA in the future, it will do so under the safeguards of Chapter V GDPR (adequacy decision or standard contractual clauses), and this policy will be updated beforehand. Transfers to the AI provider you choose under BYOK are made by your own browser under your contract with that provider and fall outside this section.
6. Retention
| Data | Retention |
|---|---|
| Content analyzed through the built-in engine | Not stored: processed and discarded; only the SHA-256 hash remains in the usage log |
| Verdict cache (extracted claims, verdict, reasoning, sources; never the full text) | 30 days from last use, except verdicts published as public pages, kept while the page exists |
| Usage log (counters and hash) | While the licence is active and up to twelve months after it ends |
| Licence data (key hash, email, plan, status) | While the licence is active and, afterwards, for the limitation period of contractual claims |
| Device identifiers | While the device is linked to the licence; deleted on unlinking or licence termination |
| Invoices and accounting records | Six years (Art. 30 Spanish Commercial Code); four years for tax purposes (Law 58/2003) |
| Support enquiries | As long as needed to resolve them and, afterwards, for the limitation period of possible claims |
| Marketing subscription | Until you withdraw consent or unsubscribe |
| Server technical logs | Up to 30 days, then deleted automatically |
7. Parental control and minors
The site and licence purchases are intended exclusively for adults with capacity to contract. We do not market products to minors nor knowingly collect their data through this site. The Familia plan is available for purchase; the parental-control feature is a future feature not yet included in the extension and will be added to the Familia plan at no extra cost when released. Installing and configuring it on a minor’s device will always be the parent’s or legal guardian’s responsibility, including informing the minor in an age-appropriate way; HOLOMENTS SL provides the tool and does not access supervision reports. If you become aware that a minor has provided us personal data without their legal representative, write to info@detectordebulos.com and we will delete it.
8. Security
We apply appropriate technical and organisational measures under Article 32 GDPR: HTTPS encryption in transit, licence keys stored as SHA-256 hashes, no persistence of analyzed content, restricted access, and backups of licence data. No system is invulnerable, but we maintain the procedures needed to detect and notify security breaches when required.
9. Your rights
You may exercise at any time your rights of access, rectification, erasure, objection, restriction, portability and withdrawal of consent by writing to info@detectordebulos.com, stating the right you wish to exercise and attaching a copy of an identity document. We reply within one month, extendable by two more for complex requests. Two particulars: for content analyzed under BYOK, rights must be exercised before the AI provider you contracted; on the free plan, the licence is bound to a random device identifier not linked to your name or email, so we may need that identifier to serve your request (Art. 11.2 GDPR). You may lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid, www.aepd.es).
10. Cookies
This site uses its own and, where applicable, third-party cookies. Details are in our Cookie Policy. Non-essential cookies are set only with your consent (Art. 22.2 LSSI-CE). Site analytics are cookieless and aggregate.
11. Limits of the service
Detector de Bulos is a decision aid, not an infallible truth detector. AI models can be wrong, make things up or be out of date. Verdicts, confidence levels and sources should be read as support for your own judgement, never as a final ruling, and must not be the sole basis for important informational, medical, financial, legal or professional decisions.
12. Changes to this policy
We may update this policy to reflect regulatory, technical or service changes. The current version is always the one published on this page with its last-updated date. Where changes are substantial and affect processing based on your consent, we will notify you by email.