Who is responsible
Angel Fernandez Fernandez is responsible for the app’s processing of personal data. The operator’s address and identification details appear in the Legal notice. For privacy requests, use hello@lastword.club. This notice covers the promotional conversation and its paid checkout.
Data used by the service
- Sign-in and company profile
- The hosting sign-in service supplies an account identifier, email address and, where available, display name. We use them to recognize you and control access to your company. The app stores your account identifier with the company name, public website, category, description and timestamps. Your sign-in email is shown in your own account and is not included in public reply data.
- Replies and paid contributions
- We store the text you submit, its company snapshot, UTC date, sequence, accepted amounts and an identifier that prevents a repeated request from creating another reply. These are publicly readable, except for account identifiers and technical request identifiers.
- Saved replies and drafts
- Bookmarks are stored against your account and are not shown to other participants. Unpublished drafts and the action you intended before sign-in are stored in your browser tab. Draft text is sent to the server when you submit it; profile details are sent when you create or save the profile.
- Activity and company results
- For signed-in accounts, we record presence, visit sessions, qualifying impressions and product-link requests. A hashed account identifier is used to avoid counting duplicates. Hashing is pseudonymization, not anonymization. We retain the event type, reply and time needed for these reports. Companies receive aggregate results, not a visitor list.
- Verification, safety and reports
- We keep domain-verification challenges and results, submission-limit records, reports, the reporter’s account identifier and moderation decisions. Information in a report is available to the operator, not the public feed.
- Infrastructure
- The hosting and sign-in providers receive connection and authentication information needed to deliver and protect the service, such as network addresses and request information. The app does not ask for your ChatGPT password or conversation history.
Why data is used
We use account, profile, reply and bookmark data to provide the functions you request. Where data-protection law requires a lawful basis, this is performance of the service agreement or steps you request before entering it.
Security, duplicate prevention, moderation and limited service measurement support our legitimate interests in a trustworthy service and useful company reports, balanced against your rights. We use data to meet legal obligations where required. Any optional use based on consent will be explained separately, and you may withdraw that consent.
The service does not sell personal data, operate advertising-audience profiles or use automated decisions with legal or similarly significant effects. Pricing follows the published arithmetic; domain checks and rate limits do not establish a company’s legal identity.
Who receives information
Anyone can read public company replies and follow their links. Signing in is required to participate. Authorized operator access is used for administration, support and moderation. The app uses OpenAI Sites for hosting and ChatGPT sign-in, with Cloudflare-backed execution and database services. These services process information within their respective roles and terms.
Company icons are requested from Google’s favicon service using the company hostname. Because the browser makes that request, Google also receives ordinary connection information such as the reader’s IP address and browser details. We suppress the page referrer on icon requests. A domain-verification check sends the DNS record name to Google Public DNS from our server.
Following a company link opens that company’s website. Missing referral parameters identify The Last Word, the round and the reply; they do not include your account identifier or email. The destination may operate its own analytics. Opening an X draft or using a device’s share sheet passes the content you choose to the selected service.
When you choose a paid checkout, the app sends Dodo Payments the product, quoted amount, order reference, live-mode label and accepted terms version. It does not forward your ChatGPT email or reply text. Dodo collects the billing and payment details you enter on its hosted checkout under its own privacy policy. We retain the immutable reply draft, company snapshot, quote, terms acceptance time, provider references, payment and refund status, and event identifiers to deliver the purchase, handle refunds and prevent duplicates. Card details are not stored in our database. These order records are available to the purchaser and operator, not the conversation feed.
International processing
Infrastructure and external providers may process information outside your country, including outside the EEA. Where required, international transfers must use an applicable adequacy decision or appropriate safeguards such as standard contractual clauses. Contact the operator for information about the safeguards applicable to the service.
See OpenAI’s privacy policy, Cloudflare’s privacy policy and Google’s privacy policy for their own services. These notices do not replace the operator’s responsibilities.
How long information is kept
Company profiles and bookmarks are kept while the account is used, unless you remove a bookmark or request account closure. Published replies form the conversation archive, subject to moderation and valid erasure requests. Closing a profile does not automatically erase every historical reply; we review personal information and any legal reason for keeping a limited record.
Event-level activity records are kept only for as long as needed to provide company reports and investigate counting errors or abuse. Verification, security and report records are retained as needed to resolve the issue, prevent recurrence and meet applicable legal obligations. The service has no automatic expiry job for these server records; retention and erasure are handled by the operator. Non-identifying totals may be retained after individual records are removed.
A legal dispute or preservation requirement may justify restricted retention of particular records. Device-storage lifetimes and ways to clear local drafts appear in the storage notice.
Your choices and rights
Where applicable, you can request access, correction, erasure, restriction or portability of your personal data; object to processing based on legitimate interests; and withdraw consent for optional processing. Send a request through hello@lastword.club. We may need proportionate information to verify the request. We normally respond within one month under the GDPR and explain any lawful extension.
You may complain to the data-protection authority in your place of habitual residence, work or the alleged infringement. In Spain this is the Agencia Española de Protección de Datos (AEPD).
You can edit your company profile and remove saved replies in the app. A request to close your account or remove historical personal information is handled by the operator. Providing account and profile details is necessary to publish; it is not necessary to inspect these legal pages. This service is intended for adult company representatives, not children.
Payment processing and records
Dodo Payments handles payment and billing data under its own privacy notice. The app receives signed payment/refund events and verifies payments using Dodo’s API. Payment payloads may include billing information, but our application database retains only the order, company snapshot, amount, acceptance, provider identifiers, statuses and event hashes needed for delivery, reconciliation and dispute handling. Your card details and provider payloads are not stored as order records.
Contract performance supports checkout and delivery processing; fraud prevention and dispute handling rely on the relevant legitimate interests; mandatory fiscal or record-keeping requirements provide the basis where applicable. Payment and contract records are retained for the applicable statutory and claims periods, with restricted retention when an account is closed. Contact the operator for the retention requirements applicable to your transaction. Operational deletion is handled by the operator.