Privacy Policy

The controller of the personal data collected through the Alethexis platform is:

• Company name: ALETHEXIS, S.L.
• Tax ID (NIF): B88758057
• Registered office: C/ Tirso de Molina 36, 08940 Cornellà de Llobregat (Barcelona)
• CNAE (Spanish activity code): 6201 (Computer programming activities)
• General contact: [email protected]
• Privacy contact: [email protected]

We process your personal data for the following purposes, each with its legal basis in accordance with Regulation (EU) 2016/679 (GDPR):

• Account and user management (name, email, role, usage metadata): legitimate interest (Art. 6(1)(f) GDPR), and performance of the contract (Art. 6(1)(b) GDPR) only where the user is personally the contracting party. See the paragraph after this list.
• Invoicing (company name, tax ID, tax address, amounts): legal obligation under commercial and tax law (Art. 6(1)(c) GDPR).
• B2B professional contact management and prospecting (name, job title, business email and phone, company, sector): legitimate interests (Art. 6(1)(f) GDPR). For persons providing services within a legal entity, subject to the conditions of Article 19 of Spanish Organic Law 3/2018 (LOPDGDD). Data obtained from the data subject, from the organisation they belong to, from public professional sources or from B2B data providers used in accordance with applicable law; Article 14 GDPR information is provided at first contact.
• Electronic marketing communications: consent, or the permission available under the electronic-communications rules applicable to the recipient. In Spain, Article 21 of Law 34/2002 (LSSI-CE), including the prior-contractual-relationship exception where its conditions are met. Outside Spain, the national transposition of Directive 2002/58/EC. Alethexis does not treat GDPR legitimate interests as a general permission to send unsolicited marketing email. Every message includes an easy opt-out.
• Technical logs, error monitoring and abuse protection (IP address, user agent, path, timestamps, Turnstile signals, errors with sensitive data removed): legitimate interests (Art. 6(1)(f) GDPR) in a secure and reliable service. Alethexis does not perform website visitor analytics.
• Cookies and storage on alethexis.com: only those strictly necessary to provide the service requested, which are exempt from consent. Alethexis uses no analytics or marketing cookies. See Cookie Policy.
• Waiting list (waitlist) by country (email, organisation, country, sector, employees): informed consent (Art. 6(1)(a) GDPR), which may be withdrawn at any time.
• Newsletter subscription (email): informed consent (Art. 6(1)(a) GDPR and Article 21 LSSI) for sending Alethexis communications, including editorial content on artificial intelligence and regulation, and product news. It may be withdrawn at any time through the unsubscribe link included in every mailing.

The client organisation decides which people access the platform and with which role. Alethexis processes the account data of users as controller, on the basis of its legitimate interest in managing access, authenticating users and maintaining the security, integrity and availability of the service (Art. 6(1)(f) GDPR). These data are not used for purposes other than those stated. Users may object to this processing on grounds relating to their particular situation. In that case, Alethexis will assess the request in accordance with the applicable law and, if the objection is upheld, will coordinate the closure of the account with the client organisation, since the service cannot be provided without identifying the user.

If you choose to sign up or sign in with your Google account, we receive from Google your name, your email address and, where applicable, your profile picture, for the sole purpose of creating and authenticating your account. We do not receive your Google password, nor do we access any other data in your Google account. Google's use of your data is governed by Google's own privacy policy.

Single sign-on (SSO) at your organisation. If your organisation has configured single sign-on, we receive your authentication data from its identity provider — for example Microsoft Entra ID or Google Workspace — which it engages and configures, not us. From that exchange we keep only a stable identifier assigned to you by the provider and your email address: we do not store the provider's assertions or tokens, either in the audit log or in the technical logs.

That provider is not a sub-processor of Alethexis: your organisation chooses and engages it. Our own authentication provider does appear in the Subprocessors & Service Providers Register.

We do not create accounts automatically from that identity. Only someone already invited to the organisation can sign in this way.

External auditors authorised by a customer organisation. When a customer organisation grants temporary access to an external auditor, we process that auditor's email address on the organisation's behalf, and the organisation is the controller: it enters the address, and we use it to send the one-time code and to record their accesses and downloads in that organisation's audit history.

If you are the auditor and wish to exercise your rights, the organisation that granted you access is your point of contact; if you write to us, we pass your request on without delay. Access always expires — 7, 30 or 90 days — and the organisation may revoke it earlier at any time.

Targeted advertising on LinkedIn

Alethexis may promote its content and services through advertising aimed at professional audiences on LinkedIn. For this purpose, it selects certain targeting criteria made available by the platform, such as location, profile language, professional role and company size.

LinkedIn uses its members' data to determine ad delivery and provide campaign performance information. Alethexis receives aggregated statistics and does not use uploaded contact lists, the LinkedIn Insight Tag or retargeting for this advertising configuration.

The proposed legal basis for Alethexis's participation in this activity is legitimate interests under Article 6(1)(f) GDPR, subject to the corresponding assessment. Individuals may manage their advertising preferences on LinkedIn and exercise their rights with Alethexis in respect of processing activities under its responsibility.

Alethexis retains downloaded statistical reports for no longer than 12 months after the end of each campaign, except for historical indicators that are genuinely anonymous.

LinkedIn states in its contractual terms that it acts as an independent controller. Alethexis has asked LinkedIn to confirm in writing the allocation of responsibilities for this advertising configuration. LinkedIn states that it carries out international data transfers relying, as applicable, on the EU-U.S. Data Privacy Framework and standard contractual clauses.

• Account data: term of the contract + 30 days.
• Invoicing data: 6 years (Article 30 of the Spanish Commercial Code (CCom) and tax legislation).
• Prospects without conversion: 24 months from the last unanswered contact.
• HTTP logs: 30 days. Error logs: 90 days.
• Waitlist: 24 months at most from sign-up.
• Newsletter subscribers: until the data subject unsubscribes or after 24 months of inactivity.
• B2B prospects (Apollo.io or other B2B data providers): data is verified and enriched through providers acting as processors for Alethexis; see the Subprocessors & Service Providers Register.
• Platform audit log (audit.access_log): during the relationship, as part of the Service.
• After the account is closed, the user identifier is replaced by a pseudonymous correlation identifier and the record is blocked under Article 32 of the LOPDGDD: its processing, including its display, is prevented, except in order to make it available to judges and courts, the Public Prosecutor's Office or the competent public administrations. In Service terms, that means that no screen, no read function and no interface returns those entries.
• We keep that blocked record in case liabilities may arise from our relationship with the organisation (Article 33(4) LOPDGDD), in our capacity as processor. The retention relies on Art. 6(1)(f) GDPR; Art. 17(3)(e) is an exception to the obligation to erase, not the legal basis for the processing.
• As a general rule, that retention has a maximum duration of five years from the end of the engagement, without prejudice to a different limitation period being applicable or to a legal cause interrupting or extending that period. Once the applicable limitation period has elapsed, the data are destroyed.
• IP address and user agent: nulled after 12 months in all accounts, irrespective of the above.
• Approval snapshots: when someone at your organisation records the approval of a document — a policy, a FRIA, a DPIA — we keep an exact copy of what was approved together with the fingerprint that allows it to be checked. That copy inherits the access and the retention period of the document it preserves: only someone who can read the document can read it, and when the document is deleted the copy is nulled, leaving only the act, the role, the date and the fingerprint.
• Backups: database backups are kept for 7 days plus the current day's. During that period, the data of a person whose account has been closed are still present in the backups; once the last backup predating the closure rotates out, they no longer are. The backups do not include the files you upload to the Service, which follow their own cycle.

Alethexis uses providers and processors for certain operations of the service. The up-to-date list and their role can be consulted at providers and processors.

Product data is stored in the European Union (Supabase, Frankfurt). Where a provider processes data outside the European Economic Area, Alethexis relies on the Standard Contractual Clauses under Article 46(2)(c) GDPR, with the assessment and supplementary measures required. The mechanism for each provider is stated in the Subprocessors & Service Providers Register.

You may exercise the rights recognised by the GDPR: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and objection (Art. 21). You also have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you (Article 22 GDPR). Alethexis does not make decisions of that kind about platform users.

To exercise them, write to [email protected]. We will reply without undue delay and in any event within one month, which may be extended in accordance with Article 12(3) GDPR. You have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD — www.aepd.es) or with the supervisory authority of the Member State of your habitual residence, place of work or place of the alleged infringement (Article 77 GDPR).

With regard to the substantive data that the customer enters into the platform (AI system inventories, assessments, evidence, decisions, names in RACI matrices, etc.), ALETHEXIS, S.L. acts as processor, not as controller. We process that data solely in accordance with the customer's documented instructions and under the Data Processing Agreement (DPA) that forms part of the contract. We do not access it for our own purposes, except for requested support, supervised maintenance or a legal obligation.

Support content. When you use our support channel, you may attach files to your tickets. Alethexis acts as processor of that content, which may include personal data — including special categories of data — if you choose to attach it. We only access those files to resolve your support request, through time-limited links, and we keep them only for the life of the ticket: when the ticket or your account is deleted, the files are erased. Hosting takes place on Supabase (EU, Frankfurt), with encryption at rest.

Identification data of the users a Customer authorises on the platform (name, email, role) are Account Data: Alethexis processes them as controller for account management and access security, and they fall outside the Data Processing Agreement.

We apply technical and organisational measures proportionate to the risk, including encryption in transit, encryption at rest in the database and storage, isolation between organisations through Row Level Security, an append-only audit log and daily backups with a seven-day retention. The audit log also carries cryptographic integrity controls, periodic verification and a daily copy of its fingerprint in a store held by a different provider, so that it is designed to evidence unauthorised alterations. The measures in force are described in Annex III of the Data Processing Agreement.

Alethexis is a professional B2B service aimed at businesses. It is not intended for minors and we do not knowingly collect data from minors.

The use of cookies on alethexis.com is described in the Cookie Policy.

We may update this policy to reflect legal or service changes. We will publish the current version on this same page and will inform you of material changes through the usual channels.

Alethexis SL is not required to designate a data protection officer (Article 37.1 of Regulation (EU) 2016/679 and Article 34.1 of Ley Orgánica 3/2018) and has not designated one on a voluntary basis. The privacy function is carried out by the person responsible for the organisation with external legal advice. For any query or to exercise your rights: [email protected].

This document is available in Spanish and English. Both versions state the same content. In the event of a discrepancy of interpretation, the Spanish version prevails, without prejudice to mandatory rules.

Read the Spanish version