Privacy Policy

1. Data Controller

In accordance with Regulation (EU) 2016/679 General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018, of December 5, on Personal Data Protection and digital rights guarantee (LOPDGDD), we inform you that the data controller for your personal data is:

Name: Corbat Technologies / Víctor Martín Gil
Location: Asturias, Spain
Email: info@corbat.tech

For any question related to the controller identity, data processing or rights requests, you can contact us directly through the email above.

How the Coco demo works

Projects, conversations and drafts in the document demo are stored in this browser using IndexedDB. They do not sync across devices. When the demo opens, conversations that have not been updated for 30 days are removed; projects without active conversations are removed if they have also been unchanged for 30 days. You can delete individual conversations or the full demo history.

When you send a question, it is transmitted to our server and Google Gemini with publication excerpts and the recent context needed to answer. Local history storage does not mean questions are processed only on your device. Do not include confidential information or other people's personal data. Deleting local history does not remove records that service providers may retain.

The website's commercial assistant keeps its conversation for the browser session. Preparing a summary does not send a business inquiry: you can edit it and explicitly submit it through the contact form.

2. Personal Data We Collect

When you use our website or contact us, we may collect the following categories of personal data:

Identification data: name, surname, email, phone
Professional data: company, position, industry sector
Browsing data: IP address, cookies, browser type, visited pages
Communication data: content of messages sent through the contact form and AI assistant when used

3. Legal Basis for Processing

The processing of your personal data is based on the following legal bases under Article 6 of GDPR:

Consent (Art. 6.1.a): for the use of analytical cookies, sending commercial communications, and voluntary use of the AI assistant
Contract performance (Art. 6.1.b): to manage service requests and execute contracts
Legitimate interest (Art. 6.1.f): to respond to business inquiries and improve our services
Legal obligation (Art. 6.1.c): to comply with applicable tax and legal obligations

4. Purpose of Processing

We process your personal data for the following purposes:

Manage and respond to your inquiries and information requests
Provide the contracted consulting and development services
Send quotes and commercial proposals
Analyze website usage through Google Analytics to improve user experience
Operate the AI assistant, respond to your messages, and prepare a project summary if you choose to send it
Comply with legal and tax obligations

5. Data Retention Period

We retain your personal data for the following periods:

Contact data (inquiries): 3 years from the last interaction
Contractual data: during the contract term plus legal limitation periods (6 years under the Commercial Code)
Browsing data: according to the applicable cookie policy (maximum 2 years)
Commercial assistant session: kept in browser session storage during the session. If you send a summary or contact details, it is retained as a business inquiry under the period above

6. Data Recipients

Your personal data may be disclosed to the following recipients:

Google LLC: for web analytics through Google Analytics (with your prior consent)
Google (Gemini API): to process AI assistant messages and generate responses when you use it
Formspree: to receive requests sent through the contact form or the summary you choose to send
Hosting providers: Vercel Inc., for website hosting
Public authorities: when legally required

7. International Data Transfers

Some of the recipients mentioned are located outside the European Economic Area (EEA), specifically in the United States. These international transfers are made with the following safeguards:

Google LLC: Certified under the EU-U.S. Data Privacy Framework (DPF) - European Commission adequacy decision
Vercel Inc.: Standard Contractual Clauses approved by the European Commission

You can obtain more information about these safeguards by contacting us.

8. Cookies and Similar Technologies

We use our own and third-party cookies to improve your browsing experience and analyze website usage. Google Analytics analytical cookies are only activated with your prior consent, which you can accept or reject from the cookie banner. You can also request a preference change by contacting us.

The current banner offers acceptance or rejection of non-essential analytics. We do not use advertising cookies or third-party commercial profiling.

9. Your Rights

In accordance with GDPR and LOPDGDD, you have the following rights:

Right of access: obtain confirmation of whether your data is being processed and access it
Right to rectification: correct inaccurate or incomplete data
Right to erasure: request deletion of your data when no longer necessary
Right to object: object to processing based on legitimate interest
Right to restriction: request restriction of processing in certain circumstances
Right to portability: receive your data in a structured, commonly used format
Right to withdraw consent: withdraw consent at any time without affecting the lawfulness of prior processing

To exercise any of these rights, you may contact us at info@corbat.tech indicating "GDPR Rights Exercise" in the subject line and attaching a copy of your ID document.

10. Right to Lodge a Complaint

If you believe that the processing of your personal data violates data protection regulations, you may lodge a complaint with the Spanish Data Protection Agency (AEPD):

Website: www.aepd.es
Address: C/ Jorge Juan, 6, 28001 Madrid

11. Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

Encryption of communications using HTTPS/TLS protocol
Access control to systems and data
Regular backups
Continuous security measures assessment

12. Children's Data

Our services are not directed to children under 14 years of age. We do not knowingly collect personal data from minors under that age. If you become aware that a child has provided us with personal data without required parental consent, please contact us so we can proceed with its deletion.

13. Policy Updates

We may update this Privacy Policy periodically to reflect changes in our practices or applicable legislation. The last update date appears at the beginning of the document. We recommend reviewing this page regularly.

14. Contact

For any inquiries related to this Privacy Policy or the processing of your personal data, you may contact us at:

Email: info@corbat.tech