Privacy Policy
Data controller
- Iván Moreno Muñoz, who carries out his professional activity under the trade name Nereodata
- Tax ID (NIF): 20261678N
- Professional address: Calle Cidro, 3, 28044 Madrid, España
- Data protection contact: [email protected]
The activity is carried out as a sole trader.
In short
- Your presentations and templates stay on your computer. What leaves is what you send to be generated.
- Nereodata does not train models on that content. The text provider excludes training without authorisation; the specific contractual coverage for the image provider is not evidenced for the current configuration.
- Nereodata does not keep it. Its caches expire within 24 hours at most.
- The subprocessors page identifies the providers involved and the information available about their location and retention.
What follows explains it in detail. Section 1 always applies; after that there is a section for each situation and you may read only the one that concerns you.
1. Who processes your data and how to exercise your rights
Two distinct roles
When you visit this website, write to us or open an account, Nereodata decides what your data is used for and acts as data controller.
When you use Aprexx with your organisation’s material, it is your organisation that decides what content is entered and for what purpose. It is the controller and Nereodata acts as processor, following its instructions and the data processing agreement entered into.
Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to [email protected]. You may be asked to prove your identity where this is necessary to handle the request securely. You may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
If the data forms part of content an organisation entered into Aprexx, the request is forwarded to that organisation, which is the one that decides.
Transfers outside the European Economic Area
Some providers process data outside the European Economic Area. The subprocessors page identifies the documented transfer safeguards for each provider and explicitly marks those not verified for the current configuration.
The managed cloud does not generally guarantee that content from all its functions is stored or processed exclusively within the EEA. The actual location is stated by function and provider on that page.
Security
Encryption in transit, access control, minimisation of the content that reaches technical logs, and no durable retention of presentation content. No measure removes risk entirely: protect your credentials and let us know if you suspect any misuse.
Changes
They are published here with their effective date. Where a change is material, customers are informed before it takes effect. A change of provider does not modify this policy; what is updated is the subprocessors page.
2. Account and licence
Applies to anyone who creates an account to use Aprexx. It is the same account on the website and in the application.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Identifier, email, user name and encrypted password | Create the account and allow secure access | Performance of the contract | While the account exists |
| Modalities, capabilities, quotas and validity dates | Verify the contracted scope and apply usage limits | Performance of the contract | Term of the contract |
| Email and content of the notices | Password recovery, security notices and critical updates | Performance of the contract | While the relationship is in force |
| Contact details and support communications | Handle queries and incidents | Performance of the contract | Relationship in force |
| Time, response code, duration and technical request identifiers | Operate, protect and diagnose the service, and prevent abuse | Legitimate interest in security and continuity | Maximum 12 months |
Once the relationship ends, the account is deleted after thirty days and the rest is blocked until liabilities lapse.
Technical logs do not include the text of instructions, the content of documents or full file names. There is no product analytics, usage profiling or history of what has been generated.
3. Website
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, email, company, size, plan of interest and your message | Handle your enquiry and the commercial contact arising from it | Steps taken at your request prior to entering into a contract | For as long as the relationship arising from your enquiry lasts |
Submitting the form does not subscribe you to any commercial mailing. To receive them, separate consent is requested, voluntary and revocable.
4. Application
Applies to the content an organisation enters into Aprexx. In respect of that content, the organisation is the controller and Nereodata the processor.
What stays and what leaves
The application stores on your computer the work in progress, the image banks, the generated images and their descriptions. Exported presentations are saved wherever you decide.
When you request an artificial intelligence function, what leaves is what is needed to run it: the content of the presentation, the submitted documents, or a complete image if you ask for its description. The exact breakdown, function by function, is in section 3.4 of the Terms and Conditions. Local paths on your computer are not sent.
Content accepted by the managed cloud
The managed cloud accepts ordinary personal data, but is not intended to process special categories under Article 9 GDPR—such as health data, biometric data used for identification, racial or ethnic origin, political opinions, beliefs, trade-union membership, sex life or sexual orientation—or data concerning criminal convictions and offences under Article 10. Aprexx does not systematically inspect or classify content and does not warrant automatic detection of those categories. The organisation using Aprexx must avoid submitting them to the managed cloud.
Standard image generation has an additional restriction: do not include personal data, sensitive information or confidential content in the description. That description is sent to the image provider. Aprexx does not filter it for those categories and does not attach customer documents, complete slides or customer supplied images by default. The function is configured in Production. The subprocessors page states the evidenced location, transfers and retention. There is no evidenced guarantee of exclusive EU residency, immediate individual deletion or a maximum 24 hour retention period at that provider. The function is currently used on Nereodata’s own account; it has not been made available to customers.
How long it is kept
Nereodata does not store that content durably: it receives it, processes it and returns the result. To avoid reprocessing files within a session it may keep a cache, which is released 24 hours after it was last used at the latest.
AI and infrastructure providers maintain their own caches, technical logs and security or abuse-prevention mechanisms. The subprocessors page states the evidenced periods and marks those that are not established. The managed cloud does not offer zero retention.
Providers
Nereodata does not use content for training, advertising or profiling without prior, separate and express authorisation. The contractual no-training coverage of the image provider is not evidenced for the current endpoint. The safeguards required of providers are in section 3.6 of the Terms and Conditions. The subprocessors page identifies who is involved and the conditions evidenced. Data may also be disclosed to competent authorities where there is a legal obligation.
If you need nothing to leave
The BYOK and Local modalities run the orchestrator on your organisation’s own infrastructure. In them content does not pass through the managed hosting or reach any provider engaged by Nereodata, and what is described above about its caches and providers does not apply. Merely changing the AI credential while continuing to use the managed orchestrator does not provide that separation. These modalities offer greater control over provider, region and retention, but do not by themselves warrant compliance for every regulated processing activity.