Privacy policy

1. Data controller

This Privacy Policy describes how DATALETHIA S.L. ("Datalethia", "we" or "our") collects, uses and protects the personal and business data of users who access datalethia.com, including associated services and platforms such as Pastanaga AI (a subdomain or subpage of datalethia.com).

Using the services implies accepting this Policy.

2. Scope

This policy applies to all services offered by DATALETHIA S.L., including:

• Tailored data consulting and analytics services.
• Pastanaga AI, a decision intelligence SaaS platform that lets companies connect their data sources (such as Holded, Shopify, HubSpot, Odoo, Zoho or YouTube, among others), analyse them and get automated insights.
• Contact and subscription forms, and the emails or communications sent through the website.

3. Information we collect

3.1. Personal data you give us directly

When you register or contact us, we may collect:

• First and last name
• Email address
• Company name
• Billing information (processed securely through Stripe)
• Encrypted credentials (password)
• Technical data needed to connect to third-party services through APIs or OAuth (for example, encrypted identifiers and access tokens)
• Optional information on estimated revenue or business size

We will not ask for data on gender, age, home address or sensitive information.

3.2. Business data uploaded by users

Pastanaga AI users can upload or connect business or commercial data, including:

• Customer, sales, billing, advertising campaign, inventory and operational metrics data, among others.
• Data from integrations with external systems (Holded, Shopify, HubSpot, YouTube, Google Ads, Meta Ads, among others).

These data are not considered personal data, but they are handled with the same confidentiality and level of security, with DATALETHIA S.L. acting as data processor under article 28 of the GDPR.

3.3. Data collected automatically

We may automatically collect:

• IP address and device type
• Browser, operating system and time zone
• Platform use (access date, session time, features used)
• Error logs and system diagnostics
• Cookies and similar technologies (see section 10)

4. Purpose and legal basis

5. Use and retention of data

Personal data will be kept:

• While there is a contractual relationship or the user keeps their account active.
• Until the user expressly asks for their data or account to be deleted.
• Data held in backups may be kept for up to 90 days.
• Tax and accounting data are kept for 7 years, as required by Spanish tax law.

6. Disclosure and data processors

DATALETHIA S.L. does not sell or disclose personal data to third parties. To run its services, it uses the following data processors, which act under contracts and confidentiality clauses:

All data is stored on servers in the European Union, except data handled by providers under Standard Contractual Clauses approved by the European Commission (SCCs).

7. Business data and confidentiality

The business or commercial data uploaded to the Pastanaga AI platform belongs exclusively to the client. DATALETHIA S.L. undertakes to:

• Process that data only to provide the contracted service.
• Apply appropriate technical and organisational measures to prevent unauthorised access, loss or alteration of data.
• Not disclose or reuse the information unless required by law or expressly authorised by the client.

8. Your rights

You can exercise the following rights:

• Access: know which data we process.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask for your personal data to be deleted ("right to be forgotten").
• Objection: object to processing based on legitimate interests.
• Restriction: ask for processing to be temporarily restricted.
• Portability: receive your data in a structured, transferable format.
• Withdrawal of consent: at any time, without affecting the lawfulness of earlier processing.

To exercise these rights, send a request to info@datalethia.com, stating your identity and the right you want to exercise. DATALETHIA S.L. will answer within 30 working days at most.

You also have the right to file a complaint with the Spanish Data Protection Agency (AEPD) if you consider that the processing does not comply with current regulations.

9. International data transfers

Although the main infrastructure is in the European Union, some providers (Stripe, Resend, OpenAI) may process data in the USA. These transfers are made under:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Additional security measures (encryption and anonymisation).

10. Cookies and tracking technologies

The datalethia.com website does not use advertising or tracking cookies. It counts visits with Cloudflare Web Analytics, which does not use cookies or identify individual visitors. The details are in the Cookie Policy.

The Pastanaga AI platform uses the essential cookies it needs for signing in and for the service to work. You can manage or delete cookies in your browser. If you disable them, some features may not work.

11. Security measures

DATALETHIA S.L. applies appropriate technical and organisational measures to protect data, including:

• Encryption of data in transit (HTTPS/SSL).
• Encryption of passwords and tokens.
• Role-based access control.
• Automatic backups.
• Security monitoring and logs.

No system is completely infallible, but reasonable best practices are used to reduce the risks.

12. Minors

The services of Datalethia and Pastanaga AI are intended for people over 18 and for representatives of companies or businesses. If a minor wants to use the service, they must do so under the supervision and responsibility of their legal guardian or the business owner.

13. Changes to this policy

Datalethia may change this Privacy Policy when necessary. Changes will be published on this page with an updated date. Substantial changes will be communicated by email or through a prominent notice on the platform.

14. Contact

15. Glossary

• Personal data: information that identifies a natural person.
• Business data: non-personal information related to commercial or professional activities.
• Processing: any operation carried out on personal data (collection, storage, use, among others).
• Data controller: the entity that decides the purposes and means of the processing (DATALETHIA S.L.).
• Data processor: the entity that processes data on behalf of the controller.
• Standard Contractual Clauses (SCCs): safeguards for international data transfers.

© 2026 DATALETHIA S.L. All rights reserved.