Privacy Policy

1. Data controller

• Controller: MARIANO GÓMEZ LABRADOR
• Tax ID (NIF): 05708978X
• Address: C/ VIRGEN DEL CORO, 18 PISO 2, PUERTA 1 - 28027 MADRID
• Email: mrngl1991@gmail.com

2. Data we collect

We collect the following types of personal data:

• Account data: email address provided during registration (via Supabase Auth).
• Usage data: saved words, language preferences, reading history within the platform.
• Billing data: managed entirely by Stripe. LexicAIze does not store credit card or bank details.
• Technical data: IP address, browser type, and HTTP request data (processed by the server for service operation).

3. Processing purposes

We process your data for the following purposes:

• Service delivery: user account management, vocabulary saving, translation, and learning features.
• Billing: subscription and payment management via Stripe.
• Security: fraud prevention, abuse control (rate limiting), and service integrity.
• Communications: transactional emails related to the service (account confirmation, subscription changes).

4. Legal basis

• Performance of a contract (Art. 6.1.b GDPR): for service delivery, account management, and billing.
• Legitimate interest (Art. 6.1.f GDPR): for security, fraud prevention, and service maintenance.
• Consent (Art. 6.1.a GDPR): for non-essential cookies (analytics, marketing), when implemented in the future.

5. Data processors and recipients

We share data with the following service providers (data processors):

• Supabase, Inc. — User authentication and data storage. Based in the USA. Privacy policy.
• Stripe, Inc. — Payment processing and billing. Based in the USA. Privacy policy.
• Google Cloud (Google LLC) — AI services (Gemini API), Text-to-Speech. Based in the USA. Privacy policy.
• Upstash, Inc. — Rate limiting service (Redis). Based in the USA. Privacy policy.

We do not sell personal data to third parties or share it for third-party marketing purposes.

6. International transfers

Some of our data processors are located in the United States. These transfers are protected by:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• The EU-US Data Privacy Framework, where the provider is certified.

7. Data retention

We retain your personal data for as long as necessary for the purposes described:

• Account and usage data: while the account is active. Upon account deletion, data will be removed within a reasonable period.
• Billing data: as required by applicable tax regulations (minimum 4 years under Spanish tax law).
• Technical data (logs): up to 90 days, unless legally required to retain longer.

8. Your rights

You have the right to:

• Access: know what personal data we process about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion of your data when no longer necessary.
• Restriction: request restriction of processing in certain circumstances.
• Portability: receive your data in a structured, commonly used format.
• Objection: object to processing in certain circumstances.

To exercise these rights, send an email to mrngl1991@gmail.com indicating the right you wish to exercise.

You also have the right to file a complaint with the Agencia Española de Protección de Datos (AEPD).

9. Minors

LexicAIze is intended for persons aged 14 or older, in accordance with Spanish data protection law (LOPDGDD). If you are under 14, you need parental or guardian consent to use this service.

10. Changes to this policy

We reserve the right to update this privacy policy. Changes will be published on this page with the update date.

11. Contact

For any privacy-related inquiries: mrngl1991@gmail.com.