Privacy Policy

1. Data Controller Information

2. Legal Basis for Processing

We process your personal data based on the following legal grounds under Article 6 GDPR:

• Consent (Article 6(1)(a)): For marketing communications and optional features
• Contract Performance (Article 6(1)(b)): To provide our AI legal services
• Legal Obligation (Article 6(1)(c)): For compliance with Spanish and EU laws
• Legitimate Interest (Article 6(1)(f)): For service improvement and security

3. Data We Collect

3.1 Personal Information

• Name, email address, company information
• Account credentials and authentication data
• Payment and billing information (processed by certified payment providers)
• Communication records and support interactions

3.2 Document Data

• Legal documents uploaded for analysis (contracts, agreements, etc.)
• AI-generated analysis results and recommendations
• Document metadata and processing logs

3.3 Technical Data

• IP addresses, browser information, device identifiers
• Usage analytics and performance metrics
• Security logs and access records

4. How We Use Your Data

• Provide AI-powered legal document analysis and compliance services
• Process payments and manage your account
• Send service updates and regulatory alerts
• Improve our AI models and service quality
• Ensure platform security and prevent fraud
• Comply with legal obligations under Spanish and EU law

5. AI Processing and Automated Decision-Making

• AI models analyze legal documents to identify risks and compliance issues
• Automated systems generate compliance recommendations
• You can always request human review or override AI suggestions
• AI training uses anonymized and aggregated data only

6. Data Sharing and Transfers

6.1 Within the EU/EEA

We primarily process data within the European Union and Spain. Our servers are located in:

• Primary: Spain (Madrid and Barcelona data centers)
• Backup: Germany and Netherlands (EU-certified facilities)

6.2 Third-Party Processors

We work with carefully selected processors who meet GDPR requirements:

• Cloud infrastructure providers (AWS Europe, Google Cloud EU)
• Payment processors (Stripe, certified under PCI DSS)
• Email service providers (EU-based only)

6.3 International Transfers

If data must be transferred outside the EU, we ensure adequate protection through:

• European Commission adequacy decisions
• Standard Contractual Clauses (SCCs)
• Additional safeguards as required by Spanish DPA

7. Your Rights Under GDPR and Spanish Law

To exercise your rights, contact us at privacy@searchlens.com. We will respond within 30 days as required by Spanish law.

8. Data Retention

• Account Data: Retained while your account is active + 3 years
• Document Analysis: 7 years (Spanish commercial law requirement)
• Payment Records: 10 years (Spanish tax law requirement)
• Marketing Data: Until consent is withdrawn
• Security Logs: 2 years (cybersecurity requirements)

9. Security Measures

We implement state-of-the-art security measures compliant with Spanish cybersecurity regulations:

• End-to-end encryption for all data transmissions
• AES-256 encryption for data at rest
• Multi-factor authentication and access controls
• Regular security audits and penetration testing
• ISO 27001 and SOC 2 Type II certified infrastructure
• Incident response plan compliant with GDPR Article 33

10. Cookies and Tracking

We use cookies in compliance with Spanish Law 34/2002 and ePrivacy Directive:

• Essential Cookies: Required for platform functionality (no consent needed)
• Analytics Cookies: Google Analytics with IP anonymization (consent required)
• Marketing Cookies: Only with explicit consent

You can manage cookie preferences through our cookie banner or browser settings.

11. Children's Privacy

Our services are not intended for individuals under 16 years old (GDPR Article 8). We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

12. Complaints and Supervisory Authority

You have the right to lodge a complaint with supervisory authorities:

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of material changes via email or platform notification at least 30 days before they take effect, as required by Spanish law.

14. Contact Information