Privacy policy
Version 2026-10-26b. Cotify is an application in a closed pilot, only for invited people. We have written this text in plain language to explain what data we process and why. It is not legal advice: it will be reviewed with a lawyer before the app is opened to more companies. This is a translation of the Spanish version, which prevails if they differ.
Who is responsible
- Controller of the app and of user accounts: ARTIFICIAL INTELLIGENCE HACKS, S.L. (AIHacks) (aihacks-es.com). Tax ID (CIF): being processed. Registered office: Calle Escalonia 15, Portal 13, Bajo C, 28231 Las Rozas de Madrid (Spain).
- Privacy and support contact: soporte@aihacks-es.com.
Two different roles
The app processes two kinds of information, and we have a different role in each:
- Your account (email, encrypted password, the date you accepted these terms and technical access logs). Here AIHacks is the data controller.
- The drawings and photos you upload and the table produced from them. The company you work for decides which drawings it uploads and why. Here AIHacks is the data processor: it only uses them to provide the service, following your company's instructions.
Drawings are technical documents and normally contain no personal data, except, sometimes, the name or initials of whoever drew or checked the drawing in the title block. We treat all the content as confidential.
What data we process and why
| Data | What for | Legal basis |
|---|---|---|
| Email address, password (stored encrypted, never in clear text) and app language | Creating your account by invitation, letting you sign in and writing to you in your language | Performance of the contract (art. 6.1.b GDPR) |
| Version and date on which you accepted these terms | Being able to show what you accepted and when | Legal obligation and legitimate interest in proving it (art. 6.1.c and 6.1.f) |
| Drawings (PDF), photos of drawings, detected balloons and specification table | Turning the drawing into the table so that you can review and validate it | On behalf of your company, according to its instructions (art. 28 GDPR) |
| Who reviewed and validated each drawing, and when | Knowing which rows have been reviewed and counting validated drawings | Performance of the contract (art. 6.1.b) |
| Technical logs (IP address, access date, errors) | Security of the app and fixing faults | Legitimate interest in keeping the service secure (art. 6.1.f) |
| Anti-bot check when signing in (Cloudflare Turnstile) | Preventing automated access and attacks on passwords | Legitimate interest in keeping the service secure (art. 6.1.f) |
We do not build profiles, we do not sell data and we do not use it for advertising.
Use of artificial intelligence
A vision model (Gemini, from Google, through its paid API) only transcribes the text next to each balloon on the drawing. It receives the crop around each balloon and a thumbnail of its surroundings, never your email or other data from your account. The numbers in the table (nominal, tolerances, limits) are calculated by our own code, not by the AI, and a person reviews and validates each drawing before it is accepted. The AI does not take any decision about people.
Your drawings are not used to train AI models, neither ours nor Google's: on the paid tier of the Gemini API, Google does not use the data to train its models. That processing is not guaranteed to take place in the European Union (see «Who else processes the data»).
Who else processes the data (processors)
Only providers we need for the app to work. Drawings and app data are stored and processed in the European Union:
| Provider | What it does | Where |
|---|---|---|
| Supabase | Database, accounts, storage of drawings and photos, server functions | EU (Frankfurt, Germany) |
| Google Cloud (Cloud Run) | Service that processes the drawing | EU (Belgium, europe-west1) |
| Google (Gemini API, paid) | Transcription of the text of each balloon | Google infrastructure, with no guarantee that it is in the EU, under standard contractual clauses. On the paid tier, Google does not use the data to train its models |
| Firebase Hosting (Google) | Serves the app's pages | Worldwide distribution network; it only serves the app, not your drawings or your data |
| Google Workspace | Sending the account emails (invitation, password change) from no-reply@aihacks-es.com, and the support mailbox | EU and USA, with standard contractual clauses |
| Cloudflare (Turnstile) | Anti-bot check when signing in to the app: it analyses technical browser data and the IP address, without tracking or advertising cookies | Cloudflare's worldwide network, with standard contractual clauses and the EU-US Data Privacy Framework |
Some of these companies have a parent company in the United States. When a provider may access data from outside the European Economic Area, it does so with the safeguards of the GDPR: the European Commission's standard contractual clauses included in their data processing agreements.
How long we keep them
- Drawings and photos: deleted 90 days after the drawing is validated. The specification table is kept for as long as you have the account.
- Drawings that are never validated: the drawing and its photos are deleted 180 days after upload.
- When you delete your account, everything is deleted: account, drawings, photos and tables.
- Technical logs: the limited time set by each provider for the security and operation of the service.
On your device: no tracking cookies
The app does not use advertising or analytics cookies. In the browser's local storage it only keeps your session (so that you don't have to sign in every time) and, at most, usage preferences (such as the language); never drawing data. The service worker, which lets you install the app, only stores the application itself (its pages, code and icons), never drawings, photos or tables. Signing out of the app deletes the session.
Your rights
You can ask at any time for:
- Access to your data and a copy in a format you can use (portability).
- Rectification of anything that is wrong.
- Erasure of your data or your account.
- Restriction of processing or objection to it.
Write to us at soporte@aihacks-es.com from your account's email address. We will answer within one month at most. If the request is about your company's drawings, we will pass it on to your company, which is the one that decides about them.
If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es).
Security
Connections are encrypted (HTTPS). Each user only sees their own drawings (this is guaranteed by the database, not just by the app). The service that processes the drawings is not public: it is only called by our server functions.
Changes
If we change this policy, we will publish the new version with its date and, if the change is significant, we will ask you to accept it again when you sign in.