Privacy policy
This policy explains what data we collect, for what purpose, on what legal basis, with whom we share it and what rights you have.
Last updated: April 20, 2026
1. Data controllers
CODX is a corporate group with three legal entities. Depending on your jurisdiction, the data controller will be:
- Omega AI SLU — Andorra la Vella, Principality of Andorra. Controller for users resident in Andorra.
- Thanic Capital SL — Bilbao, Spain. Controller for users resident in Spain and the rest of the European Union.
- CODX LLC — Controller for users resident in the rest of the world.
PrivacyPage.s1.contact
2. Data we collect
We process only the data strictly necessary for each purpose:
- Contact form / free consultation: name, email, project type, message.
- CODY chatbot: the messages you write in the conversation (not persisted after closing the browser, aside from temporary logs at the AI provider).
- Web analytics (if you accept cookies): pages visited, session duration, device type, traffic source — always aggregated and anonymized.
- Blog: only technical navigation data (see analytics cookies).
We do not knowingly collect special categories of data (health, beliefs, orientation, etc.) nor data from minors.
3. Purposes and legal basis
| Purpose | Legal basis | Retention |
|---|---|---|
| Respond to your commercial inquiry | Consent (art. 6.1.a GDPR) | Up to 2 years without interaction |
| Contract execution with client | Contract (art. 6.1.b GDPR) | During the contract + 6 years (tax obligations) |
| Web analytics | Consent (art. 22 Spanish LSSI) | Up to 26 months (GA4) |
| CODY chatbot | Implied consent on starting the conversation | In-memory session (not persisted) |
4. With whom we share your data
We work with the following processors, all under signed DPAs:
- Supabase Inc. (database and form hosting) — USA, DPF certified.
- Vercel Inc. (front-end hosting) — USA, DPF certified.
- Resend Inc. (transactional email) — USA, SCC.
- Google LLC (Google Analytics 4) — USA, DPF certified.
- Google LLC (Gemini API, CODY chatbot) — USA, DPF certified. Chat messages may be retained by Google for up to 30 days for security/abuse purposes.
We do not sell or share your data with third parties for commercial purposes.
5. International transfers
Some processors operate outside the European Economic Area. All transfers are protected by:
- EU-US Data Privacy Framework (Google, Supabase, Vercel certified).
- Standard Contractual Clauses (SCC) approved by the European Commission.
6. Your rights
As a data subject you have the right to:
- Access your personal data.
- Rectify inaccurate data.
- Erase your data (right to be forgotten) when no longer necessary.
- Object to processing at any time.
- Request portability to another controller.
- Restrict processing while resolving a complaint.
- Withdraw your consent at any time, without retroactive effect.
PrivacyPage.s6.contact
If you believe your right has not been addressed, you can complain to:
- Spanish Data Protection Agency (AEPD) — residents in Spain.
- Andorran Data Protection Agency (APDA) — residents in Andorra.
7. Security
We apply reasonable technical and organizational measures: encryption in transit (HTTPS/TLS 1.3), encryption at rest in databases, role-based access control, log auditing, automated backups and regular team training on privacy.
8. Changes to this policy
This policy may be updated. The last update date appears at the top. Substantial changes will be notified by email to active users and/or through the site banner.