Privacy Policy

Custodia (the project's working name, hereinafter "Custodia", "we") is currently a project under development, without an incorporated company yet. For as long as this is the case, the controller of your data is Eric Alcantud, in a personal capacity, as the project's promoter. This policy will be updated as soon as a legal entity exists.

1. What data we collect

• Account data: email, first and last name, company name, password (stored encrypted by our authentication provider, never in plain text).
• Data you enter in the platform: registered AI tools, your organization's employees (name, email, role, department), use cases, answers to the risk pyramid questionnaire, and the documents you generate.
• Pre-registration data: if you join the early access list, your name, work email, company, size, email and user system, the AI tools you use (optional) and the campaign you came from.
• Basic technical data: strictly necessary cookies to keep your session signed in. We do not currently use analytics or advertising cookies.

If you register your company's employees in Custodia, you (as your organization's administrator) are the one who decides to enter that data, and the one who must inform those people that their data is processed on this platform for this purpose.

2. What we use your data for

• To give you access to your account and your organization's data.
• To generate the risk classification and the compliance documents you request.
• To communicate with you about your account (never for advertising purposes without your explicit consent).
• To improve the product and fix errors.
• To contact you about early access, if you have pre-registered.

3. Legal basis

We process your data to perform the service agreement you accept when you sign up, and on the basis of your consent where applicable (for example, when using the public questionnaire or when pre-registering for early access, which you can withdraw at any time).

4. Who we share your data with

We use external providers acting as data processors, under their own security safeguards:

• Supabase — database and authentication.
• Vercel — hosting of the web application.

We do not sell or share your data with third parties for advertising purposes.

5. How long we keep your data

For as long as your account remains active. We keep pre-registration data until you withdraw your consent or, at most, 12 months after the public launch. If you cancel your account, we delete your data within a reasonable period, unless the law requires us to keep something for longer.

6. Your rights

You can request access, rectification, erasure or portability, or object to the processing of your data, by writing to ericalcantudtresgallo@gmail.com. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD).

7. Changes to this policy

As this is a project under active development, this policy may be updated fairly often. We will publish the date of the latest update here.

8. Contact

For any question about this policy or your data, write to ericalcantudtresgallo@gmail.com.