Privacy Policy

This policy complies with the General Data Protection Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 on Personal Data Protection and Digital Rights Guarantee (LOPDGDD), and Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE).

1. Data Controller

2. Categories of Data We Collect

We collect different categories of data depending on how you interact with our services. Below we detail each category with its corresponding legal basis:

3. Purposes of Processing

4. Data Sharing with Third Parties

We only share your data in the following strictly necessary circumstances:

5. International Data Transfers

We prioritize keeping your data within the European Economic Area (EEA). When it is necessary to transfer data outside the EEA, we ensure an equivalent level of protection through:

• European Commission adequacy decisions: For countries that guarantee an adequate level of protection (Switzerland, UK, etc.).
• Standard Contractual Clauses (SCCs): Approved by the European Commission, signed with each provider processing data outside the EEA.
• EU-US Data Privacy Framework (DPF): For transfers to US companies certified under this framework.

You can request information about the specific safeguards applied by contacting privacidad@entrenai.app.

6. Data Retention Periods

We retain your data only for the time necessary to fulfill the purposes described:

After requesting account deletion, we complete the deletion of all your personal data within a maximum of 45 days, except for data we must retain due to legal obligations.

7. Your Data Protection Rights

Under GDPR and LOPDGDD, you have the following rights over your personal data:

8. Security Measures

We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss, destruction, or alteration:

• Encryption in transit: TLS 1.3 for all communications
• Encryption at rest: AES-256 for data stored in databases
• Passwords: Hashed with bcrypt (never stored in plain text)
• Access control: Principle of least privilege, multi-factor authentication for administrators
• Monitoring: Suspicious activity detection and real-time alerts
• Backups: Encrypted, automated, and geographically distributed backups
• Audits: Periodic security reviews and penetration testing

Data Breach Notification

In accordance with Art. 33 GDPR, in the event of a personal data breach posing a risk to your rights and freedoms, we will notify the Spanish Data Protection Agency (AEPD) within 72 hours of becoming aware of it. If the breach entails a high risk, we will notify you directly and without undue delay in accordance with Art. 34 GDPR.

9. Minors

EntrenAI is not intended for users under 16 years of age. We do not intentionally collect personal data from minors under that age.

If you are a parent or guardian and discover that a child under 16 has provided us with personal data without your consent, contact privacidad@entrenai.app immediately and we will delete that information.

10. Artificial Intelligence and Automated Decisions

EntrenAI uses artificial intelligence to generate and adapt training plans. It is important that you understand how it works and its limitations:

You have the right to request human intervention in decisions that significantly affect you, express your point of view, and contest the decision by contacting info@entrenai.app.

11. Changes to this Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of significant changes through:

• Push or in-app notification at least 30 days before taking effect
• Email to the address associated with your account
• Prominent banner on our website

Continued use of the service after the changes take effect constitutes your acceptance of the updated policy.