Privacy Policy

Updated: January 2026

Translation: this English version is provided for convenience. If there is any discrepancy, the Spanish version prevails.

Summary: We only collect the data needed to provide the service. We do not sell your data. You can exercise your GDPR rights by writing to elaia@elaiapp.com.

1. Data Controller

Owner: Iñigo Pacheco Bengoechea
Tax ID (NIF): 44638400T
Email: elaia@elaiapp.com
Activity: Spanish business activity tax (IAE) heading 845 - Software and computer application services

2. Data We Collect

Data you give us:

Email (for your account and communications)
Name (personalization)
Type of study (to adapt the experience)
Uploaded PDFs (to generate your material)

Data collected automatically:

IP address (security)
App usage (adaptive algorithm)
Cookies (see the Cookie Policy)

3. What We Use It For

Providing the service (account, tests, subscription)
Improving the platform (aggregate analysis)
Service communications
Marketing (only with your consent)

4. Legal Basis

Service and payments: performance of the contract
Communications: legitimate interest
Marketing: consent
Legal obligations: regulatory compliance

5. How Long We Keep It

Account data: while the account is active + 5 years
PDFs: while you use the service (you can delete them)
Billing: 5 years (tax obligation)
Marketing: until you withdraw consent

6. Who We Share It With

Firebase (Google Cloud): Hosting, authentication and database. Data in the EU. Privacy policy.
Stripe: Payment processing. Certified under the Data Privacy Framework. Privacy policy.
Google Analytics: Website usage statistics (only with your consent). Privacy policy.
PostHog: App usage statistics (only with your consent). Data in the EU (eu.i.posthog.com). Privacy policy.
Microsoft Clarity: Browsing analysis (only with your consent). Privacy policy.
AI services: In accordance with Regulation (EU) 2024/1689 (AI Act), the content of your documents is processed by artificial intelligence systems to generate study material. This processing is technical and automated; the content is not used to train models and is not linked to your identity. You have the right to be informed when you interact with AI-generated content.

We NEVER sell your data.

International transfers: Some providers may process data outside the EEA. In those cases, we require appropriate safeguards (Standard Contractual Clauses or certification under the EU-U.S. Data Privacy Framework).

7. Your Rights (GDPR)

Access: to know what data we hold
Rectification: to correct data
Erasure: to delete your data
Objection: to object to certain uses
Portability: to take your data with you
Restriction: to restrict processing in certain cases

To exercise them: elaia@elaiapp.com with the subject "GDPR rights". We reply within 30 days.

You can lodge a complaint with the Spanish Data Protection Agency (AEPD).

8. Security

We use encryption (HTTPS), restricted access and backups.

9. Minors

Elaia is for people aged 16 and over. If you are a parent or guardian and your child used the service without permission, contact us.

10. Documents You Upload

Our system may detect possible personal data in uploaded documents. This detection is for information only. You are responsible for not uploading documents containing real personal data of third parties without their consent.

11. Changes

We will notify you of significant changes by email 30 days in advance.

12. Contact

Email: elaia@elaiapp.com