Privacy policy

Who the controller is

The data controller is CODELABS STUDIO, S.L., company number B88708797, registered at Paseo Federico García Lorca 6, 3º E, 29130 Alhaurín de la Torre (Málaga, Spain). AlmaOS is operated by this company. If you live in the European Union, your data is processed under the General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

What data we process

We only process what the service needs to work:

• Account data: your email address and the name you choose to use.
• Content you store: projects, decisions, notes and anything you type or dictate into AlmaOS.
• Billing data: if you subscribe to a paid plan, your payment history. Your card details are handled directly by Stripe and never reach our servers.
• Technical data: IP address, device type and error logs, needed to keep the service running and protect it from abuse.
• Voice: if you use dictation in the mobile app, the audio is processed to turn it into text. We store the resulting text, not the recording.

Why we use it and on what legal basis

Every processing activity has a specific legal basis:

• Providing the service and maintaining your account: performance of a contract (GDPR article 6.1.b).
• Charging your subscription and meeting tax and accounting obligations: contract and legal obligation (articles 6.1.b and 6.1.c).
• Keeping the service secure, detecting errors and preventing abuse: legitimate interest (article 6.1.f).
• Sending you marketing communications, should there ever be any: your consent, which you can withdraw at any time (article 6.1.a).

What we do not do with your data

We do not sell or share your data with third parties. We do not use it for advertising or commercial profiling. We do not train artificial intelligence models on the content you store in AlmaOS.

Who else is involved

We work with a small number of providers to run the service. All of them act as processors under contract and all of them keep the data in the European Union:

• Hetzner Online GmbH (Germany): application and database hosting.
• Sentry, European region (Frankfurt, Germany): technical error logging so we can diagnose failures.
• Stripe Payments Europe, Ltd. (Ireland): subscription payment processing.
• Our own mail server, hosted on the same European infrastructure, for service emails.

International transfers

We do not transfer your data outside the European Economic Area. The entire infrastructure, including hosting, database, error logging and email, is located in the European Union.

How long we keep it

We keep your data while your account is active. If you delete it, we erase your content and account data within a maximum of 30 days, except for billing records, which Spanish tax law requires us to retain (generally six years). Technical logs are kept for a maximum of 90 days.

Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw any consent you have given. Just write to the address below. We will respond within one month. If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

Security

We encrypt communications in transit and apply access control to stored data. The full list of technical and organisational measures, and the status of each one, is published on the security page.

Children

AlmaOS is not aimed at children under 14 and we do not knowingly collect data from anyone below that age. If we find an account created under those circumstances, we will delete it.

Changes to this policy

If we change this policy we will update the date shown above and, when the change is significant, we will notify you by email before it takes effect.