1. Data Controller
The data controller for personal data processed through the Service, for the purposes of the General Data Protection Regulation (EU) 2016/679 (GDPR), is the operator of GaugeH2:
- Legal name: David Fernández Frutos
- Tax ID (NIF): 47763383L
- Address: Av. Pau Casals 19, A 3-2, 43840 Salou (Tarragona), Spain
- Email: contact@gh2.ai
In this policy, “GaugeH2”, “we” and “us” mean that operator.
When a firm uses the Service to work on projects of its own clients, the firm decides what data it enters and why: for that data the firm is the controller and we act as its processor, under a data processing agreement with that firm (GDPR Art. 28).
2. Data We Collect
Account data
When you register, we collect:
- Name and email address
- Password (hashed, never stored in plain text)
- Organization, organization type and country, if you give them
- How you first heard about GaugeH2, if you tell us, and the campaign tags (utm_source, utm_medium, utm_campaign) of the link you followed to the sign-up page, if it carried any
- Account creation date and last login
Usage data
When you use the platform, we collect:
- Calculation inputs and results (stored against your account if logged in)
- Pages visited, features used, and session duration — measured via cookieless analytics (aggregated, no stored IP address)
- Your IP address, as the key of counters that limit abuse and the number of calculations without an account (see Retention)
- Your IP address and browser, stored with each signed-in session to keep it secure (see Retention)
- Your IP address in the request logs kept by our hosting and database providers (see Retention)
- Browser type and operating system
Reports you download
When we issue a report and you download it, we keep a copy of that exact PDF so that you can download the same document again later. We also record its SHA-256 fingerprint, so that anyone holding the PDF can verify it.
Payment data
If you purchase a subscription, payment is processed by Stripe. We receive only a token and basic billing information (name, billing address). We do not store full card numbers.
Communications
If you contact us, we retain the content of your message and your email address to respond and improve our service.
3. How We Use Your Data
We use your data to:
- Provide and maintain the Service, including account management
- Process subscription payments and manage billing
- Send transactional emails (verification, password reset, receipts)
- Improve the platform through aggregated, anonymized usage analytics
- Understand which channels bring new accounts, reported only in aggregate
- Detect and prevent fraud and abuse
- Comply with legal obligations
We do not sell your personal data to third parties. We do not use your data for advertising profiling.
4. Legal Basis for Processing
Under GDPR Article 6, our legal bases are:
- Contract performance (Art. 6(1)(b)): processing necessary to provide the Service you have signed up for
- Legitimate interests (Art. 6(1)(f)): security monitoring, fraud prevention, service improvement through anonymized analytics, and measuring which channels bring new accounts
- Legal obligation (Art. 6(1)(c)): financial record-keeping, tax compliance
- Consent (Art. 6(1)(a)): where you explicitly opt in to optional communications
5. Data Retention
- Account data: retained while your account is open. When you close it, the details you gave when you signed up (name, organization, organization type, country, how you heard about us and campaign tags) are cleared at once, your email address is replaced by an anonymous value, your billing identifiers are unlinked from your account, and your sign-in is revoked. There is no recovery period: a closed account cannot be reopened.
- Calculation records: retained while your account is open, and not deleted when you close it. Calculations made in a firm’s workspace stay with that firm, and the records of issued reports point to their calculations, so those reports can still be verified. After you close your account, your calculations are no longer linked to your name or email address; the names you gave them are kept as you wrote them.
- Copies of the reports you download: retained while your account is active; deleted when you close your account. The fingerprint of each report is kept, so that the PDF can still be verified.
- Payment records: retained for 6 years, as required for accounting records by Spanish law (Commercial Code, art. 30)
- Signed-in sessions: deleted, with their IP address, when you sign out, or about 30 days after you last used them
- Request logs of our providers: deleted by the provider within 7 days
- Counters keyed by your IP address: deleted automatically. The ones that count calculations without an account last about 60 days after your last request; the rest, a few minutes
- Support communications: retained for 2 years after resolution
- Records of your acceptance of the Terms and this policy (version, date, IP address and browser): kept as proof of the contract while your account is open and, after you close it, for 5 years, the period to bring contractual claims under Spanish law (Civil Code, art. 1964). Legal basis: our legitimate interest in being able to prove what was agreed (Art. 6(1)(f)).
6. Your Rights Under GDPR
As a data subject in the EU/EEA, you have the right to:
- Access: request a copy of personal data we hold about you
- Rectification: correct inaccurate or incomplete data
- Erasure: request deletion of your data (“right to be forgotten”)
- Restriction: ask us to limit how we process your data
- Portability: receive your data in a structured, machine-readable format
- Objection: object to processing based on legitimate interests
- Withdrawal of consent: withdraw consent at any time where processing is consent-based
To exercise any of these rights, email contact@gh2.ai. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority (in Spain: AEPD).
8. Third-Party Processors
We use the following sub-processors, each bound by GDPR-compliant data processing agreements:
- Supabase — database, authentication and file storage (the copies of the reports you download). Data is stored on EU-region servers (AWS eu-west-1). Supabase is SOC 2 Type 2 certified.
- Stripe — payment processing. Stripe is PCI DSS Level 1 certified. Data processed under Stripe’s privacy policy and EU Standard Contractual Clauses.
- Vercel — hosting. The code that handles your requests runs in Dublin, Ireland (EU); your connection enters through Vercel’s nearest point of presence. Data transfers covered by Vercel’s DPA and SCCs.
- Upstash — rate limiting. Your IP address is the key of the counters that limit abuse and the number of calculations without an account; they are deleted automatically (see Retention).
- Resend — email delivery: the emails we send you, such as the sign-up confirmation and invitations to join a firm.
- Artificial intelligence provider — used to classify and enrich the public project catalogue and regulatory texts. It receives only public content (news, registers and official texts), never your account data or your calculations.
- Hostinger — email hosting for contact@gh2.ai: the messages you send us and our replies.
Upstash, Resend and our artificial intelligence provider are based in the United States and may process data there. Where they do, the transfer is covered by the EU–US Data Privacy Framework, for providers that have joined it, or by the EU Standard Contractual Clauses included in their data processing agreements (GDPR Arts. 45 and 46).
We do not share your personal data with any other third party except where required by law or with your explicit consent.
9. Contact
For any privacy-related questions, data subject requests, or concerns:
- Email: contact@gh2.ai
- Subject line: “Privacy Request — [your name]”
We aim to respond to all requests within 30 days. If you are not satisfied with our response, you may escalate to the Spanish Data Protection Authority (AEPD) at www.aepd.es.