Privacy policy
Last updated: August 24, 2026 (draft)
1. Who processes your data
The legal owner of the service is pending formal incorporation (see Legal notice). In the meantime, the privacy contact is soporte@phyxio.net.
2. What data we collect, and why
This table reflects exactly what the system stores today — not a generic description.
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, password (encrypted) | Create and manage your account, sign in | Performance of the contract for use of the service |
| Google account identifier (only if you sign in with Google) | Recognize you when you sign in with your Google account, without another password | Performance of the contract (a feature you activate voluntarily) |
| Microsoft account identifier (only if you sign in with Microsoft) | Recognize you when you sign in with your Microsoft account, without another password | Performance of the contract (a feature you activate voluntarily) |
| Date of birth | Check the minimum age to register by yourself (14 years) | Legal obligation (protection of minors) |
| Curriculum(s) purchased, curriculum change history | Show you the content of your country/educational programme and manage your access | Performance of the contract |
| Daily use (calculators, exercises, exported PDFs) | Apply usage limits according to your plan and show you your progress | Performance of the contract |
| IP address, browser, date and time of administrative or security actions | Detect and respond to security incidents, keep an audit log | Legitimate interest (security of the service) |
| Technical error diagnostics: sanitized message and trace, route without parameters, version, browser, language, screen size and a random session identifier | Detect, group and fix Phyxio faults. Forms, passwords, tokens, email, document content and account identity are not included | Legitimate interest (security, stability and improvement of the service) |
| Documents you upload to your personal room (PDF, images, audio, presentations) and the text you extract with the OCR reader | Store them for your own use (notes, scans) | Performance of the contract (a feature you activate voluntarily) |
| Email and name, when subscribing to a paid plan (never the card number, which you enter directly in the payment gateway) | Process the payment of your subscription | Performance of the contract |
| The text you write to the AI assistant (Phyxi) and the topic it relates to | Generate the assistant's answer | Performance of the contract (a feature you activate voluntarily) |
3. Documents you upload
The documents in your personal room are stored encrypted on the server (AES-256). This protects the content against unauthorized access to the disk or to a backup, but it is not end-to-end encryption: the server keeps the encryption key, so in theory it could decrypt them if necessary (for example, in response to a legal requirement). If you use the OCR reader, text recognition runs in your own browser -- the image is not sent to any external service for that purpose.
We only accept specific file types (PDF, JPG/PNG, MP3/WAV/M4A/OGG, .pptx) and a size limit according to your plan, precisely so that this feature is not used as generic storage. You are responsible for the content you upload (see Terms and conditions).
4. First-party analytics
We maintain first-party analytics to count visits and sign-up steps, using a random browser identifier rotated every 30 days, not your email or account, without storing your IP address in those events. When configured, Google Analytics 4 also measures acquisition on public pages, only after you accept. It is not activated in signed-in sessions or private areas. Events cover visits, registration requests and information requests; they do not include names, emails, form text, documents or student answers. Advertising features are disabled. You can decline or withdraw consent through Analytics preferences in the footer; your choice is retained for up to 180 days. Google may process identifiers and technical browsing data under its privacy policy. Google Privacy Policy.
5. What we do NOT do
- We do not use advertising tracking cookies. Phyxio sessions use local storage. If you accept optional analytics, Google Analytics may use measurement cookies.
- Google analytics is optional: it does not load before you accept and does not measure your private area. See section 4 and the footer preferences.
- We do not use your questions to the AI assistant or your progress data to train any model.
- We do not show advertising or build advertising profiles, and we will never do so with minors' accounts.
- We do not access the documents you upload unless legally required -- we do not review them, we do not use them to train any model, and the OCR reader runs in your own browser.
6. Minors
Direct sign-up requires being at least 14 years old. Below that age, the account must be created by a teacher or guardian — Phyxio does not currently offer a parental consent verification system for self-registration of minors, and therefore does not allow it yet.
7. Your rights
You can exercise at any time:
- Access — see what data we hold about you, from your profile.
- Rectification — correct your name from your profile.
- Erasure — delete your account and all associated data (including your documents) immediately, from "My profile → Danger zone". It is a real feature, not a manual request.
- Portability — download from "My subscription" a structured copy of your account, progress, exercise, exam, note and activity data. Original documents can also still be downloaded individually.
- Objection and restriction — by writing to soporte@phyxio.net.
8. Retention
- Data of individual accounts with an active subscription: for as long as the account exists.
- After cancelling the renewal of an individual subscription: the profile, results and documents are kept for 365 days from the end of the paid period. They are then deleted automatically, unless the account holder requests a different period at soporte@phyxio.net or a legal obligation applies.
- Documents in your personal room: during the period above, or until you delete them yourself individually.
- Invoices and accounting records: for the applicable legal periods, kept separate from the operational account and with restricted access.
- Security/audit logs: 90 days, deleted automatically.
- First-party analytics events (no personal data): 180 days, deleted automatically.
- Technical error events: 90 days. Groups resolved or ignored without a Jira issue are deleted after 365 days.
- Unused guest codes: deleted automatically when they expire.
- Database backups: encrypted, with restricted access and automatic rotation (latest backups only). Note: this backup covers the database, not the files of uploaded documents.
9. Where the data is hosted and who we send it to
The servers are located in the European Union (Spain). Four specific providers receive data for a feature that you activate yourself:
- Google (sign-in), if you sign in with your Google account: it receives the sign-in request and sends us your email, your name and an identifier of your account; it never receives your progress or academic data. This processing may involve a transfer outside the European Union.
- Microsoft (sign-in), if you sign in with your Microsoft account: it receives the sign-in request and sends us your email, your name and an identifier of your account; it never receives your progress or academic data. This processing may involve a transfer outside the European Union.
- Stripe (payment processor), if you subscribe to a paid plan — it receives your email, name and the payment itself; we never process it directly. Stripe may process this data outside the European Union, under the international transfer framework in force.
- Google (Gemini API), if you use the AI assistant — it receives the text of your question, never your notes or your academic performance. This transmission may involve a transfer outside the European Union.
We do not share your data with anyone else, and never for advertising purposes.
10. Complaints
You can file a complaint with the Spanish Data Protection Agency (www.aepd.es) if you believe we have not handled your data correctly.