Privacy policy

Last updated: 7 October 2026

This is a translation provided for convenience. In case of any discrepancy, the Spanish version prevails.

This Policy explains how personal data is processed through the AIM CODEX service. BIOMAG, S.L.U. complies with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD) and the LSSI, ensuring transparency and security in the use of data.

1. Controller

2. Two roles: controller and processor

Because of the nature of the Service, two roles coexist and it is important to tell them apart:

• BIOMAG, S.L.U. acts as CONTROLLER for account and contract data: the data of whoever contracts or uses the Service (name, email, company, billing data) and the usage data needed to provide and protect it.
• BIOMAG, S.L.U. acts as PROCESSOR for the personal data that users choose to include in the documents they seal, share or send through the Service, and for the data of recipients. In that area the user is the controller and BIOMAG processes the data on their behalf and on their instructions, under the Data Processing Agreement.
• Sign-up source page: if you create your account by pressing a button on one of our pages (for example, the quote template), we store that page's name with the sign-up, to know which pages are useful. Only the page name: nothing is stored in your browser and we do not track you across visits. Basis: legitimate interest.

3. What data do we process?

• Identification and contact data: name, email address, organisation.
• Billing data: those needed to issue invoices and manage the subscription payment.
• Usage and security data: IP address, browsing data and logs of the actions carried out in the Service (creation, sealing, verification, acceptance), for operation, evidence and fraud prevention.
• Content of documents and recipient data (name and email of whoever receives, opens, verifies or accepts a document): processed as processor, on behalf of the user who is the controller.
• Text sent to the artificial intelligence features (drafting, reviewing or explaining a document), only when the user uses them. It may include personal data of third parties if the document contains it; it is processed as processor, on the user’s behalf. Do not use these features with special categories of data (health, beliefs, trade union membership, ethnic origin, sex life, biometrics, criminal data).
• Meeting audio recordings, only when the user uses the meeting minutes feature: the audio is sent to the artificial intelligence provider (through OpenRouter) to transcribe it and draft the minutes. CODEX does not keep the recording: it stores only its SHA-256 fingerprint and its size. It contains the voices and what the attendees say; it is processed as processor, on behalf of the user, who must inform the attendees before recording.
• Anonymous measurement of how the website works: when leaving each page, the browser sends three loading times, the page and whether the screen is a mobile one. No cookies, no identifiers and the IP address is not stored.
• Technical browser reports when the website’s security policy blocks something: the page (without parameters), the rule and the blocked origin. No data about the person.
• Answers to voluntary surveys to improve the website: anonymous; we do not ask for name or email.

Anchoring the proof in the public blockchain publishes only a cryptographic fingerprint (SHA-256 hash) of the document: neither the content of the document nor any personal data is published on the chain.

4. Purposes and legal basis

Purpose	Legal basis (Art. 6 GDPR)
Provide the Service (seal, verify, share, keep the proof) and manage the account.	Performance of the contract.
Invoicing and tax and accounting obligations.	Compliance with a legal obligation.
Security of the Service, fraud prevention and incident handling.	Legitimate interest (with the right to object).
Service communications (operational notices).	Performance of the contract.
Commercial communications about similar own products or services, where applicable.	Consent or Art. 21.2 LSSI, with unsubscribe in every message.
Artificial intelligence features activated by the user (drafting, reviewing, explaining).	Performance of the contract. For the content of documents we act as processor, following the user’s instructions (Art. 28 GDPR).
Measuring and improving the speed and operation of the website, with anonymous data.	Legitimate interest.
Voluntary surveys to improve the clarity of the website.	Consent: taking part is voluntary.

5. Recipients and processors (sub-processors)

Data is not disclosed to third parties except where required by law or necessary to provide the Service. To provide it, the following providers process data as processors of BIOMAG, S.L.U. under a data processing agreement (the live list, with the data each one processes and where, is at aim-codex.ai/subencargados):

• Railway (USA): hosting of the application and the database, on servers in the Netherlands.
• Resend (USA): sending the service emails, from its European region (Ireland).
• Migadu-Mail GmbH (Switzerland): the contact mailbox and backup email sending.
• OpenRouter, Inc. (USA): gateway to the artificial intelligence models, only when those features are used: it receives the text and, if meeting minutes are used, the audio recording. Every request requires the provider that runs the model not to keep the data and not to use it for training.
• Paddle.com Market Limited (United Kingdom): charging subscriptions as reseller; it processes payment data as controller, not on our behalf.
• Timestamping calendars on the public blockchain (OpenTimestamps) and timestamping authorities (DigiCert, Sectigo and FreeTSA): they receive only the SHA-256 fingerprint, no personal data.
• Public Bitcoin explorers (blockstream.info and mempool.space): when you verify a document, your browser asks them directly for the public data of the block it is anchored in; like any website, they receive your IP address and the block number, never the document or its fingerprint. Our server also queries them, with the block number only.
• Tax/accounting advisers, auditors and legal services, where appropriate, and public authorities and administrations, where required by law.

Where your data is. Your account data and your documents are stored in the European Union. The text and audio you send to the artificial intelligence features are processed in the United States or in other countries where the model providers are located.

International transfers: Railway, Resend and OpenRouter are US companies. Any transfer or access from outside the European Economic Area is covered by the European Commission’s Standard Contractual Clauses included in their data processing agreements and, in the case of Resend, also by the EU-US Data Privacy Framework. Switzerland and the United Kingdom have an adequacy decision from the European Commission.

6. Retention periods

• Account and document data: while the account is active and, after it is closed, for the period the user decides or the one needed to meet legal liabilities.
• Billing: the periods required by tax and commercial law.
• Enquiries/support: until resolved and, where applicable, for traceability.
• Security/fraud: for as long as necessary; afterwards, blocked to meet liabilities.
• Link opens and codes: the IP address and browser of each open are deleted after 12 months (only the date is kept); verification codes and password-reset links, the day after they expire; notice subscriptions that were never confirmed, after 30 days.
• After the account is deleted: its documents and data are deleted. For each sealed document only its cryptographic fingerprint, version, sealing date and whether it was revoked or expiring are kept, with no title and no personal data, so that whoever received it can still check that it is authentic.

Erasure of the data of someone who signs or acknowledges. When a person asks, the issuer erases their data from the console: their name, email, IP and browser disappear from the lists, the activity log and the exports, and their link stops working. Receipts and dossiers already sealed are not modified, because their fingerprint would change and they would prove nothing: they are kept without a public link, only the issuer can download them and only to establish, exercise or defend legal claims (GDPR Art. 17(3)(e)), and they are deleted with the account. In dossiers shared by link, emails are masked.

7. Your rights

You may exercise the rights of access, rectification, erasure, objection, restriction, portability and withdrawal of consent by writing to:

• Post: c/ Barrachi, 39 – Pab. 3, 01013 Vitoria-Gasteiz (Álava, Spain).
• Email: hola@aim-codex.ai.

We may ask for proof of identity. Response time: 1 month at most (extendable by 2 months). Where data is processed as processor (the data contained in a customer’s documents), requests from data subjects will be passed on to the customer who is the controller so that they can handle them. You may lodge a complaint with the Spanish Data Protection Agency: www.aepd.es.

8. Minors

The Service is not aimed at children under 14 and their data is not knowingly processed. If detected, it will be deleted.

9. Security and breaches

We apply appropriate technical and organisational measures (access control, encryption in transit, sealing and integrity of the proof, incident logging and backups). In the event of a security breach posing a risk, we will notify the AEPD within 72 hours at most and, where appropriate, the data subjects.

10. Cookies

Information about cookies is in the Cookie policy.