Privacy Policy

For any questions, requests, or complaints regarding your personal data, contact our Data Protection team at [email protected]. We will respond within one calendar month of receiving your request, as required by Article 12(3) GDPR.

3.1 Data collected directly from you

3.2 Data received from third-party OAuth providers

When you authenticate using Google or GitHub, we receive the following data from these providers (Article 14 GDPR):

We only request the minimum scopes necessary for authentication. We do not access your repositories, contacts, or any data beyond what is listed above. For details on how these providers handle your data, see the Google Privacy Policy and GitHub Privacy Statement.

3.3 Data we do NOT collect

• We do not collect special categories of personal data (Article 9 GDPR): racial or ethnic origin, political opinions, religious beliefs, health data, biometric data, sexual orientation.
• We do not collect financial data or payment information.
• We do not engage in profiling or automated decision-making (Article 22 GDPR).

We process your data for the following purposes, each with a specific legal basis under Article 6(1) GDPR:

Where we rely on legitimate interest (Art. 6(1)(f)), we have conducted a balancing test to ensure that our interests do not override your fundamental rights. You may object to such processing at any time (see Section 8).

5.1 Where your data is stored

All personal data is stored on our own infrastructure located in Alicante, Spain, within the European Union. We operate our own servers and do not use third-party cloud hosting services (AWS, Google Cloud, Azure, etc.).

5.2 International transfers

When you authenticate using Google or GitHub OAuth, the authentication handshake is processed by these providers' servers (which may be located outside the EEA). However, we only receivedata from them — we do not send your data to them. Once received, your data remains exclusively on our EU-based infrastructure.

Both Google and GitHub have adopted Standard Contractual Clauses (SCCs) and additional safeguards for EU-US data transfers in compliance with the EU-U.S. Data Privacy Framework.

We retain your personal data only for as long as necessary for the purposes described in this policy:

We do not sell, rent, or share your personal data with third parties for marketing purposes. Your data is accessed only by:

We may disclose personal data to law enforcement or judicial authorities when required by applicable Spanish or EU law, and only to the extent strictly necessary.

Under GDPR (Articles 15–22) and LOPDGDD, you have the following rights:

How to exercise your rights

Send your request to [email protected] with the subject line “Data Protection Request”. Please include your full name and the email address associated with your account. We will verify your identity and respond within one calendar month. This period may be extended by two additional months for complex or multiple requests, in which case we will inform you within the first month.

Exercising your rights is free of charge. However, we may charge a reasonable fee for manifestly unfounded, excessive, or repetitive requests (Art. 12(5) GDPR).

We use only strictly necessary cookies required for the Service to function. We do not use analytics, advertising, or tracking cookies.

Since we only use strictly necessary cookies, no cookie consent banner is required under the ePrivacy Directive. Should we introduce non-essential cookies in the future, we will implement a compliant consent mechanism with equal-prominence accept/reject options as required by the AEPD.

Server-side storage

Session data is stored server-side in our PostgreSQL database and Redis cache, both located in Alicante, Spain. The session cookie in your browser contains only a unique session identifier — no personal data is stored in the cookie itself.

In accordance with Article 32 GDPR and the right to digital security established by Article 82 LOPDGDD, we implement appropriate technical and organizational measures to protect your data:

• Encryption in transit — All data transmitted between your browser and our servers is encrypted using TLS 1.3 (HTTPS).
• Encryption at rest — Database and file storage volumes are encrypted.
• Access control — Strict role-based access; only authorized administrators can access personal data.
• Network security — Firewall-protected infrastructure with intrusion detection.
• Authentication security — OAuth 2.0 / OpenID Connect with PKCE; session tokens are cryptographically signed; API tokens are hashed before storage.
• Physical security — Servers are hosted in a secured facility in Alicante with restricted physical access.
• Regular backups — Automated encrypted backups with tested restoration procedures.
• Incident response — In the event of a data breach, we will notify the AEPD within 72 hours (Art. 33 GDPR) and affected individuals without undue delay when the breach poses a high risk to their rights (Art. 34 GDPR).

In accordance with Article 7 LOPDGDD, the minimum age for valid consent in Spain is 14 years. NeuroBrix is not intended for use by individuals under the age of 14. We do not knowingly collect personal data from children under 14. If we become aware that a user is under 14, we will promptly delete their account and associated data.

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you (Article 22 GDPR). Model download statistics and usage data are used for aggregate analytics only and do not result in any automated decisions affecting individual users.

We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

• Update the “Last updated” date at the top of this page.
• Notify registered users by email for significant changes affecting their rights.
• Provide a summary of changes when required by applicable law.

We encourage you to review this policy periodically. Continued use of the Service after changes constitutes acceptance of the updated policy.

If you have any questions about this Privacy Policy or wish to exercise your rights:

• Email: [email protected]
• Subject line: “Data Protection Request”
• Supervisory authority: If you are unsatisfied with our response, you have the right to lodge a complaint with the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, Spain.

• Regulation (EU) 2016/679 — General Data Protection Regulation (GDPR)
• Ley Orgánica 3/2018 — Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD)
• Directive 2002/58/EC — ePrivacy Directive
• Ley 34/2002 — Servicios de la Sociedad de la Información y de Comercio Electrónico (LSSI-CE)