Privacy Policy
How we handle your personal data at AIGiner. Compliant with the GDPR and the LOPDGDD.
This is a courtesy translation provided for convenience. The Spanish version is the legally binding text.
1. Data controller
Note: AIGiner is not currently required to appoint a formal Data Protection Officer under Art. 37 GDPR (it does not carry out large-scale processing of sensitive data or systematic monitoring). The addresses above are the channels for any query or request regarding data processing.
| Item | Detail |
|---|---|
| Data controller | AIGiner S.L. |
| Main purpose | Handling of contact requests and provision of AI services |
| Registered address | Gran Via de Carles III, 98, 10º, 08028 Barcelona, Spain |
| Tax ID (CIF) | B93819753 |
| Commercial Registry | Registered with the Barcelona Companies Registry · Sheet B-662372 · Entry 1 · IRUS 1000478196595 |
| Data protection contact | privacy@aiginer.com |
| Formal requests (GDPR Art. 12/15-22) | dpo@aiginer.com |
2. Data we collect
AIGiner only collects data that users voluntarily provide through our contact and audit forms and in the emails they write to our addresses (hola@aiginer.com and the company’s other addresses):
- First and last name
- Email address
- Phone number (optional)
- Company name (optional)
- Number of employees (optional)
- Message or project description, whether by form or by email
If you enrol in an AIGiner Academy training course (academy.aiginer.com), we also process the data required to give you access and to certify that you completed it:
- Your name and email address, which identify your account
- Your password, which is never stored as such: it is kept irreversibly hashed
- Your course progress: which modules you have opened and what you wrote in the exercises
- Your exam result: correct answers, the date you passed and the number of attempts
- The certificate issued, bearing your name, the company you state and its serial number
If you buy the Compliance Kit (formerly the extended AI Act test report; www.aiginer.com/ai-act-check), we store what is needed to generate your document and to let you download it again:
- The nine answers you gave in the test. None of them is a special category of data
- The company name you typed and your email address
- The record that you agreed to start the download immediately, with its date and time, as required by Article 103(m) of the Spanish consumer protection act
- The payment identifier and the amount. Card details never reach us: they are handled by Stripe, which also issues the invoice
Other data we collect, each for its own purpose (see section 3):
- Free AI law test: your answers, the result and your email, and the record of whether you ticked the box to receive information about our services
- Website assistant: the conversation is not stored. If you give it your name and email, they are kept like a contact form
- Web Check and Monitoring: the website address you give us, the reports we issue on it and your subscription details
- WhatsApp: the number you write from and the content of the messages
We may also automatically collect technical data such as IP address, browser type, and pages visited through our anonymized analytics tool (Cloudflare Web Analytics, cookie-free measurement). This information does not allow the identification of any individual user.
If you also accept the "analytics" category in the cookie notice, we measure how the website is used with Google Analytics 4: page views, where you come from and general device type, through two cookies (_ga and _ga_4XYY2R0VYR) that tell visitors apart pseudonymously. If you do not accept it, that tool is not loaded and your browser does not contact Google. We do not use it for advertising. It does not measure the contact cards, the screens shown after payment or the academy. Details in the Cookie Policy.
We do not collect special category data (health, ideology, ethnic origin, etc.) or data from minors under 14 years of age, which is the age set by Article 7 of the Spanish Data Protection Act (LOPDGDD). If we detect that a minor has provided data without the consent of their parents or guardians, we will delete it immediately.
3. Purpose and legal basis of processing
Messages are classified by a language model run by TensorX Ltd., the European Union inference provider listed in section 4, acting as processor. Email addresses, phone numbers and links are masked before the text is sent to it. The classification only sorts the inbox: it decides nothing about you and has no legal effect. You can object to this processing by writing to privacidad@aiginer.com.
| Purpose | Legal basis | Retention period |
|---|---|---|
| Responding to contact and quote requests | Your request: taking pre-contractual steps you ask for (Art. 6.1.b GDPR) | For as long as needed to deal with your enquiry and any relationship that follows from it. You can ask us to delete it sooner at privacy@aiginer.com |
| Sending information about requested services | Your request: taking pre-contractual steps you ask for (Art. 6.1.b GDPR) | Until consent is withdrawn |
| Managing the contractual relationship with clients | Performance of a contract (Art. 6.1.b GDPR) | Duration of the contract + 5 years |
| Compliance with legal obligations (tax, accounting) | Legal obligation (Art. 6.1.c GDPR) | As required by applicable regulations: min. 6 years (Article 30 of the Spanish Commercial Code) and a 4-year tax limitation period (Article 66 of the General Tax Act) |
| Granting access to AIGiner Academy courses and certifying who has completed them | Performance of a contract (Art. 6.1.b GDPR) | For as long as the account remains active. The certificate issued is kept for as long as it still serves as proof of the training, which is its sole purpose |
| Generating and re-delivering the Compliance Kit (formerly the extended AI Act test report) | Performance of a contract (Art. 6(1)(b) GDPR) | 12 months from purchase, so we can generate the document again for you. After that the answers are deleted and only the payment record is kept, for the tax obligation in the row above. You can ask us to delete it sooner |
| Sending you the result of the AI Act test and, if you tick the box, information about our services | Your request (Art. 6.1.b GDPR) for sending it. Your consent (Art. 6.1.a GDPR and Art. 21 LSSI-CE) for the commercial part | Answers and result: 12 months from sending. Your email and the record of your commercial consent: until you withdraw it |
| Replying to you when you leave your name and email in the website assistant | Your request (Art. 6.1.b GDPR) | The conversation is not stored. The contact details you leave are kept like a form |
| Selling and delivering the Compliance Kit, Web Check and Monitoring: reviewing the website you give us, issuing the reports and managing the subscription | Performance of a contract (Art. 6.1.b GDPR) | Web Check: 12 months from delivery. Monitoring: while the subscription lasts and 12 months after. Billing data: the tax period in the legal-obligations row |
| Receiving and answering the messages you send us on WhatsApp | Your request (Art. 6.1.b GDPR) | Until the enquiry is closed; same as a form |
| Automatically classifying the messages we receive (forms and email) as lead, proposal or other, in order to sort requests, prioritise commercial ones and filter spam | Legitimate interest (Art. 6.1.f GDPR) | The same as for forms. The classification is kept and deleted together with the message |
| Improving the website through anonymized analytics (Cloudflare Web Analytics, cookie-free) | Legitimate interest (Art. 6.1.f GDPR) | Anonymized data, no time limit |
| Web analytics with Google Analytics 4: aggregate statistics on how the website is used (page views, origin, general device type) to improve it. Only if you accept the "analytics" category. No advertising or remarketing | Consent (Art. 6.1.a GDPR and Art. 22.2 LSSI-CE). You can withdraw it at any time from the cookie manager; withdrawing it deletes the _ga cookies | _ga and _ga_4XYY2R0VYR cookies: 13 months. In Google Analytics: 2 months for event data and 14 months for data linked to a user (the cookie identifier) |
4. Data recipients
AIGiner does not sell, rent, or transfer your personal data to third parties for commercial purposes. Data will only be shared with the following service providers, acting as data processors, and under appropriate safeguards:
| Provider | Use | Safeguard |
|---|---|---|
| Cloudflare, Inc. (Pages + Email Routing + Turnstile) | Website hosting, email forwarding, and anti-bot protection | Cloudflare's public Data Processing Addendum (DPA) plus the European Commission's Standard Contractual Clauses for transfers to the US |
| Google LLC (Gmail) | Mailbox where we receive the email you send to any @aiginer.com address and from which we reply | Google processes that email under its terms of service, including outside the European Economic Area |
| Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), Google Analytics 4 | Aggregate web analytics, only if you accept the "analytics" category in the cookie notice. No advertising, no remarketing, no Google Signals | Google Ads Data Processing Terms (GDPR). It may transfer data to Google LLC (US), relying on the adequacy decision of the EU-US Data Privacy Framework (Google LLC is certified) and on standard contractual clauses |
| Resend (Resend, Inc.) | Sending outbound emails from @aiginer.com (transactional + authorized marketing) | Resend's public DPA and a verified domain with DKIM/SPF/DMARC on aiginer.com |
| Contabo GmbH (Lauterbourg, France · EU) | Virtual private server (VPS) running AIGiner's API, which processes the contact and audit forms and the website assistant | EU server managed by AIGiner; no transfer to third parties |
| Supabase (data hosted in eu-west-1, Ireland, EU) | Database holding the leads received through the website's forms | Supabase Data Processing Addendum; data is hosted within the European Union |
| Cloudflare D1 (European Union jurisdiction) | Databases for AIGiner Academy (accounts, progress, certificates), for the inbox where forms and assistant contacts arrive, and for course, Kit, Web Check and Monitoring orders | Cloudflare's processing agreement; databases created under EU jurisdiction, which keeps the data in the European Union |
| Stripe Payments Europe, Ltd. (Ireland) | Payment for purchases and subscriptions, invoices and VAT calculation. It receives your name, email, billing address, VAT number if you give one, and your card details, which we never see | Stripe's processing agreement. It may transfer data to Stripe, Inc. (US) under standard contractual clauses. For fraud prevention Stripe also acts as a controller in its own right |
| WhatsApp Ireland Limited (WhatsApp Business) | Receiving and answering the messages you send us at +34 644 04 03 78 | WhatsApp Business terms. It may transfer data to Meta Platforms, Inc. (US), certified under the EU-US Data Privacy Framework |
| TensorX Ltd. (Dublin, Ireland · EU), LLM inference provider on EU sovereign infrastructure | Generates the answers of the website's conversational assistant and classifies incoming messages (with email addresses, phone numbers and links masked) | Processor established in the European Union, under a processing agreement with zero retention: neither conversations nor messages are stored or used to train models |
| Cloudflare Web Analytics (Cloudflare, Inc., US, with EU standard contractual clauses) | Anonymized, cookie-free web analytics | Cloudflare's processing agreement and standard contractual clauses. Aggregated data only; it identifies no one |
5. International transfers
Some of our providers (Cloudflare Inc., Resend Inc., Stripe Inc.) are headquartered in the United States. Where an international transfer occurs, the framework of the Standard Contractual Clauses adopted by the European Commission (Implementing Decision 2021/914) applies, which, together with each provider's internal policies (Data Processing Addendum), ensures an adequate level of protection. Two processing activities run under the terms of service of the company providing them, including outside the European Economic Area: the mailbox (Google LLC, Gmail) and WhatsApp (Meta).
The critical infrastructure for lead and communication processing resides on servers located within the territory of the European Union: AIGiner’s own server (Contabo, Lauterbourg, France), the leads database (Supabase, Ireland) and the AIGiner Academy data (Cloudflare D1, Western Europe). The conversational assistant is processed entirely within the European Union, with no international transfer.
Exception: web analytics with Google Analytics 4, which is only activated if you accept it. Its provider is Google Ireland Limited (Ireland), but it may transfer data to Google LLC in the United States. That transfer relies on the adequacy decision of the EU-US Data Privacy Framework (Google LLC is certified) and on standard contractual clauses. If you do not accept it, there is no transfer on this account.
6. Your rights
Under the GDPR and Organic Law 3/2018 (LOPDGDD), you may exercise the following rights at any time:
| Right | What it allows |
|---|---|
| Access | Find out what data of yours we process |
| Rectification | Correct inaccurate or incomplete data |
| Erasure | Request the deletion of your data |
| Objection | Object to processing in certain cases |
| Restriction | Restrict the processing of your data |
| Portability | Receive your data in a structured format |
To exercise any of these rights, send us an email to privacy@aiginer.com indicating which right you wish to exercise and, only if we have reasonable doubts about your identity, we will also ask you for a copy of your identity document. We will respond within one month, extendable by two further months for complex requests under Article 12.3 GDPR.
Where processing is based on your consent (for example, analytics with Google Analytics), you can withdraw it at any time, without affecting what was processed before you withdrew it. For analytics, just untick the category in the cookie manager (/gestor-cookies).
If you believe that the processing does not comply with applicable regulations, you may file a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.
7. Security measures
AIGiner has implemented the technical and organizational measures necessary to ensure the security of personal data and to prevent its alteration, loss, unauthorized processing, or access, taking into account the state of the art, the nature of the data stored, and the risks to which they are exposed.
These measures include: HTTPS encryption across all communications, access restricted to authorized personnel only, and periodic reviews of security systems.
8. Changes to this policy
AIGiner reserves the right to modify this Privacy Policy to adapt it to legislative, case-law, or business-practice developments. Changes will be notified on this same page. We recommend reviewing this policy periodically.