Privacy and terms

1. Controller

CAPITALGEA SPAIN SL, tax ID B90050923, Plaza Ruiz de Alda, 11, Bajo, 41004 Seville, Spain. Trading name: HREVN. Contact: contact@hrevn.com.

2. What the tool receives

The current version receives a title chosen by the person, the declared AI provider and between one and three JSON files per participant. JSON is a structured text file prepared by the assistant from the context it still has available.

We do not request the complete chat or final deliverable. Free-text content may include personal data if the person submitting it introduces such data; review the JSON and avoid personal, confidential or unnecessary information.

3. Purposes of processing

Data is used to validate the format, build an educational summary of human–AI interaction, create the requested report, allow its temporary download, verify that HREVN issued the file and protect the service technically.

Aggregated daily counts of actions and technical results—such as successful or rejected validations, reports created and group projects started—are also retained to identify where the flow fails and improve the tool. These measurements do not contain content, titles, JSON files, IP addresses, browser user agents, or person or session identifiers. They count actions, not people or unique users.

They are not used to profile, score or classify people or make automated decisions about them. The report does not measure authorship, effort, performance, ability, quality or truthfulness.

4. Legal basis

• Performance of the request and acceptance of these terms in order to validate submissions and create the report.
• HREVN’s legitimate interest in maintaining security, preventing abuse and using aggregate counts to understand whether the technical flow works.
• Prior consent when Google Analytics 4 is used on the public landing page. Operational workbook routes do not load Google Analytics 4, analytics cookies or session identifiers.

5. Exact retention periods

• Individual use: JSON files are processed during the request and are not retained as project content.
• Group use: confirmed submissions remain encrypted until the coordinator closes the project or for a maximum of 30 days. Their content is then deleted.
• PDF: the encrypted copy is available for up to 60 minutes for repeat download. It is then deleted and cannot be recovered.
• Verification: a minimal technical issue record is retained: report identifier, date, cryptographic fingerprint, technical signature and hashes of verification and download codes. The chat, JSON, title and PDF are not retained.
• Group project: technical status, dates, pseudonymous codes and counts may be retained to understand how the flow operates. Submitted content and the title are deleted on closure or expiry.
• First-party operational analytics: aggregate counts by date, action type, result, mode, declared assistant and closed error category are retained for up to 24 months. They do not contain titles, text, files, IP addresses, browser user agents or user or session identifiers.
• Security logs: the server may retain technical access logs, including IP addresses, for approximately 14 days.
• Browser: the group access package may remain for up to 24 hours in the tab that created it to allow immediate recovery.

6. Processors, infrastructure and security

Data may be processed by strictly necessary technical providers of hosting, network, security and email services. HREVN applies encryption to group submissions and temporary PDFs, access controls, non-reversible database tokens and minimisation of persistent content.

No internet-connected system is invulnerable. Do not submit information that is unnecessary for the workbook’s educational purpose.

7. Report operation and limits

• The assistant may have lost context, summarised earlier parts or interpreted the conversation incorrectly.
• A valid JSON file shows that it meets the technical structure, not that its content is complete or true.
• The absence of human intervention from the traces does not prove that it did not occur.
• The report reconstructs only what can be recovered and does not establish a shared timeline if the sources do not allow one.
• HREVN verifies that it issued a particular file; it does not certify its content or the work it describes.
• Once issued, the report is not changed. If incorrect data was confirmed, a new process must be started.

8. Group use and coordinator responsibility

The coordinator creates pseudonymous access links, decides who receives them and when to close with the available submissions. The coordinator cannot edit material confirmed by other people. On closure, the report shows how many submissions were included and excluded.

HREVN does not know the real identity associated with each link and cannot recover lost access links. The coordinator is responsible for distributing them securely, retaining the local copy, informing the other people and using the service in accordance with applicable law.

9. Rules of use

The tool is not designed or specifically directed at minors. Users must have capacity to accept these terms. It must not be used for unlawful purposes, covert surveillance, automated evaluation, impersonation, unauthorised data extraction or processing third-party information without a lawful basis.

HREVN may suspend the tool for maintenance, security, abuse or technical reasons. Projects or reports deleted under the periods above cannot be recovered manually.

10. Rights and contact

You may exercise rights of access, rectification, erasure, objection, restriction and portability by writing to contact@hrevn.com. You may also lodge a complaint with the Spanish Data Protection Agency.

This information supplements HREVN’s general Privacy Policy and Legal Notice

11. Legal and design references

The design follows the principles of lawfulness, transparency, data minimisation, storage limitation and data protection by default in the General Data Protection Regulation, and the guidance of the AEPD on data protection by default.