Privacy Policy

The controller of the personal data collected through the Alethexis platform is:

• Company name: ALETHEXIS, S.L.
• Tax ID (CIF): B88758057
• Registered office: C/ Tirso de Molina 36, 08940 Cornellà de Llobregat (Barcelona)
• CNAE (Spanish activity code): 6201 (Computer programming activities)
• General contact: [email protected]
• Privacy contact: [email protected]

We process your personal data for the following purposes, each with its legal basis in accordance with Regulation (EU) 2016/679 (GDPR):

• Account and user management (name, email, role, usage metadata): performance of the service contract (Art. 6(1)(b) GDPR).
• Invoicing (company name, tax ID, tax address, amounts): legal obligation under commercial and tax law (Art. 6(1)(c) GDPR).
• B2B lead generation and commercial communications (name, job title, business email, company, sector): legitimate interest in commercial activity directed at businesses (Art. 6(1)(f) GDPR) and Article 21 of Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (LSSI).
• Technical logs, analytics and monitoring (IP address, user agent, path, timestamps, errors with sensitive data removed): legitimate interest in maintaining and improving a reliable service (Art. 6(1)(f) GDPR).
• Cookies and trackers on alethexis.com: strictly necessary ones on the basis of legitimate interest (Art. 6(1)(f)); all others, where applicable, on the basis of consent (Art. 6(1)(a) GDPR and Article 22 LSSI). See Cookie Policy.
• Waiting list (waitlist) by country (email, organisation, country, sector, employees): informed consent (Art. 6(1)(a) GDPR), which may be withdrawn at any time.
• Newsletter subscription (email): informed consent (Art. 6(1)(a) GDPR and Article 21 LSSI) for sending Alethexis communications, including editorial content on artificial intelligence and regulation, and product news. It may be withdrawn at any time through the unsubscribe link included in every mailing.

• Account data: term of the contract + 30 days.
• Invoicing data: 6 years (Article 30 of the Spanish Commercial Code (CCom) and tax legislation).
• Prospects without conversion: 24 months from the last unanswered contact.
• HTTP logs: 30 days. Error logs: 90 days.
• Waitlist: 24 months at most from sign-up.
• Newsletter subscribers: until the data subject unsubscribes or after 24 months of inactivity.
• Access log (audit log): 5 years, as evidence of due diligence.

To provide the service we rely on infrastructure providers acting as processors (Art. 28 GDPR). The full and up-to-date list is available at Sub-processors. We give 30 days' notice of the addition of any new sub-processor.

Product data is stored in the European Union (Supabase, Frankfurt). Certain providers process account data and communications outside the EEA (United States): Stripe (payment processing; USA and India), Resend (email delivery to users) and Google Workspace (email and communication with customers). In addition, web traffic transits through the infrastructure of Cloudflare and Vercel, which have a presence in the USA. All of these transfers rely on safeguards under Chapter V of the GDPR: standard contractual clauses (Art. 46(2)) and, where applicable, the EU-US Data Privacy Framework. The breakdown by provider, with location and mechanism, is on the sub-processors page.

You may exercise the rights recognised by the GDPR: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21) and not to be subject to automated decisions producing legal effects (Art. 22).

To exercise them, write to [email protected]. We will reply within a maximum of 30 calendar days. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD — www.aepd.es).

With regard to the substantive data that the customer enters into the platform (AI system inventories, assessments, evidence, decisions, names in RACI matrices, etc.), ALETHEXIS, S.L. acts as processor, not as controller. We process that data solely in accordance with the customer's documented instructions and under the Data Processing Agreement (DPA) that forms part of the contract. We do not access it for our own purposes, except for requested support, supervised maintenance or a legal obligation.

Support content. When you use our support channel, you may attach files to your tickets. Alethexis acts as processor of that content, which may include personal data — including special categories of data — if you choose to attach it. We only access those files to resolve your support request, through time-limited links, and we keep them only for the life of the ticket: when the ticket or your account is deleted, the files are erased. Hosting takes place on Supabase (EU, Frankfurt), with encryption at rest.

We apply appropriate technical and organisational measures: encryption in transit (TLS 1.3) and at rest (AES-256), multi-tenant isolation through Row Level Security, an immutable access log, restricted secrets management and backups with point-in-time recovery (PITR).

Alethexis is a professional B2B service aimed at businesses. It is not intended for minors and we do not knowingly collect data from minors.

The use of cookies on alethexis.com is described in the Cookie Policy.

We may update this policy to reflect legal or service changes. We will publish the current version on this same page and will inform you of material changes through the usual channels.

For any question about this policy or the processing of your data: [email protected].