Version 2026-11. In force since [EFFECTIVE DATE].
This policy explains how we process the personal data of people who use AIR-Core (https://app.air-core.io, its API and its MCP server) and visit https://air-core.io. It does not cover the data our customers upload to the platform (their datasets, models, etc.). For that data we act as a data processor on behalf of the customer, who is the controller and whom you should contact if your data is in an AIR-Core account (see section 9).
1. Controller and Data Protection Officer
- Controller: INSTITUTO INTERNACIONAL DE INVESTIGACIÓN EN INTELIGENCIA ARTIFICIAL Y CIENCIAS DE LA COMPUTACIÓN (“AIR Institute”), tax ID G37571627, Av. Santiago Madrigal, 39, 37003 Salamanca (Spain).
- Privacy contact: info@air-institute.com (opens your email app).
- Data Protection Officer (DPO): contacto@delegado-lopd.es (opens your email app) [CONFIRM that the AIR Institute DPO covers AIR-Core].
2. What data we process
| Category | Data | Where it comes from |
|---|---|---|
| Account | Email, username, password (stored only as a hash), country and, optionally, full name, bio, URL and photo | You, when you sign up or edit your profile |
| Login with Google or GitHub | Identifier, email, name and username at the provider | Google or GitHub, when you choose that login |
| Organization | Organizations you belong to, role and permissions, invitations | You or the administrator who invites you |
| Billing | Name or company name, tax ID, billing address and email, plan, amounts, payment history, last digits and expiry date of the card | You and Stripe. We never see the full card number |
| Security and session | IP, browser, operating system, session date and time, two-step verification, reCAPTCHA result, account activity logs | Generated when you use the service |
| Use of AI | Conversations with the assistant; AI activity log (user, tool, parameters with credentials hidden, model, tokens, cost, result); BYOK keys, encrypted | Generated when you use the AI Features |
| Integrations | API tokens, applications authorized through OAuth or MCP (application name, permissions, dates) | You |
| Communications | Messages to support, notification preferences, consent to marketing communications | You |
| Acceptances | Version of the Terms accepted, date and time, IP, user agent; cookie preferences | Generated when you accept |
| Notices of illegal content | Name, email and content of the notice | The person giving notice |
We do not ask for special categories of data for the account. AIR-Core is not intended for people under 18.
3. What we use it for and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and manage your account and organization, and provide the service you subscribed to (including the Free plan) | Performance of the contract (art. 6.1.b) |
| Login with Google or GitHub | Performance of the contract (art. 6.1.b), at your request |
| Payment, invoicing and accounting and tax obligations | Contract (6.1.b) and legal obligation (6.1.c): Spanish Commercial Code, General Tax Law |
| Service notices: security, changes to the Terms or prices, inactivity, credit usage and expiry, alerts you set up | Contract (6.1.b) and legal duty to inform (6.1.c) |
| Record of acceptance of the Terms and of cookie consent | Legal obligation to be able to prove it (6.1.c, art. 7.1 GDPR) and legitimate interest in evidencing the contract (6.1.f) |
| Security: protect the account and the service, prevent fraud, bots and abuse (sessions, logs, reCAPTCHA, payment anti-fraud), usage limits | Legitimate interest in the security of the service and its users (6.1.f) and security obligation (art. 32) |
| AI Features: handle your requests to the assistant or to “Do it with AI” | Contract (6.1.b) |
| AI activity log: cost and credit control, auditing for your organization's administrators, security | Contract (6.1.b) and legitimate interest in traceability and spending control (6.1.f) |
| Management of inactive free accounts (notices, deactivation, deletion) | Contract (6.1.b) and legitimate interest in not keeping unnecessary data (6.1.f, art. 5.1.e) |
| Support | Contract (6.1.b) |
| Aggregate usage statistics to operate and improve AIR-Core (without the content of your data) | Legitimate interest (6.1.f) |
| Marketing emails about AIR-Core | Consent (6.1.a), through an unticked box. For customers, legitimate interest regarding similar products (LSSI art. 21.2), with the option to object in every message |
| Notices of illegal content and requests from authorities | Legal obligation (6.1.c), Digital Services Act |
| Defence against claims | Legitimate interest (6.1.f) |
We have weighed the legitimate interests listed against your rights. You can ask for the details of that assessment and object (section 7).
4. Artificial intelligence
- Assistant and “Do it with AI” with AIR-Core's AI.
- Your instruction and the necessary context (schemas, column names, statistics and, if needed, limited samples) are processed with Anthropic models (Claude) through Amazon Bedrock, with an inference profile of the European Union: the data is processed in AWS regions in the EU.
- AWS does not keep the requests or use them to train models.
- We do not use your data to train models.
- Conversations and the AI activity log are kept for 365 days.
- Our own models. [VERIFY whether they are used in production: some models are served on AIR Institute infrastructure in [EU location]; the interface indicates this.]
- BYOK (your own key).
- If you set up a key from OpenAI, Anthropic, Groq, Google Gemini or another compatible provider, we will send the request and the context to that provider on your instructions.
- That provider processes the data under its contract and privacy policy with you, and may be outside the EEA (for example, in the US).
- It is not our provider: we recommend that you review its terms before using it.
- We store your key encrypted and you can delete it whenever you like.
- AI applications connected through MCP (for example Claude or ChatGPT).
- When you authorize an application, it receives the data from your account that it requests within the permissions you grant.
- That data is processed by the provider of that application under its relationship with you.
- You can revoke the authorization in “Account → Applications”.
- Explainability. It statistically calculates (SHAP) which variables influence a model. It runs on our infrastructure and does not use generative AI.
- Transparency. We always tell you when you are interacting with an AI system and we label generated content.
5. Who we share data with
We do not sell personal data. We share it with these providers, who act as processors unless stated otherwise:
| Recipient | What for | Location | Safeguard for transfers |
|---|---|---|---|
| Amazon Web Services EMEA SARL (Luxembourg) | Hosting, databases, storage, backups and Amazon Bedrock | EU: Frankfurt (eu-central-1); Bedrock in EU regions | Data hosted in the EU. For possible access from the US (Amazon.com, Inc.): EU-US Data Privacy Framework (DPF) and standard contractual clauses (SCCs) in the AWS data processing agreement |
| Stripe Payments Europe, Ltd. (Ireland) | Payments, subscriptions and anti-fraud. For fraud prevention and its financial obligations, Stripe acts as an independent controller | EU and US (Stripe, Inc.) | DPF and SCCs |
| Google Ireland Ltd. / Google LLC | Login with Google (only if you choose it); reCAPTCHA (protection against bots at login and sign-up) | EU and US | DPF and SCCs |
| GitHub, Inc. | Login with GitHub (only if you choose it) | US | DPF [VERIFY certification] and SCCs |
| Amazon Web Services EMEA SARL (Luxemburgo), servicio Amazon SES | Sending service emails and alerts | UE: Fráncfort (eu-central-1) | Datos en la UE. DPF y CCT del acuerdo de encargo de AWS |
| Cloudflare, Inc. | DNS [VERIFY whether it also acts as a proxy: if so, it processes the traffic] | Global | DPF and SCCs |
| Mapbox, Inc. | Maps for geographic visualizations (receives the browser's IP) | US | DPF and SCCs |
| X Corp. | Only if X/Twitter visualizations are shown and you accept those cookies | US | DPF and SCCs |
| [VERIFY: Meta Platforms Ireland] | Login with Facebook, only if enabled | EU/US | DPF and SCCs |
| External Data Protection Officer, advisers and auditors | Compliance | Spain | — |
| Public administrations, judges and courts | When required by law | Spain/EU | — |
In addition, within your organization, administrators can see members' data (name, email, role, activity and AI used).
Access by authorities of third countries.
- Your data and your account's data are hosted in the EU.
- We will only comply with requests from authorities outside the EU when they are based on an international agreement or, failing that, when Union law allows it.
- We will challenge disproportionate requests and notify you unless legally prohibited (Regulation (EU) 2023/2854, arts. 28 and 32).
6. How long we keep it
| Data | Period |
|---|---|
| Account and organization | While the account is active. After closure they are deleted within 30 days at most, except what must be kept blocked |
| Inactive free accounts | Deactivation after 12 months without use, following notices 30 and 7 days before; deletion possible 90 days later |
| Billing | 6 years from the last entry (Commercial Code art. 30), blocked. Tax data, 4 years plus the assessment period (LGT arts. 66 and 70) |
| Sessions (IP, browser, OS) | Until they expire (1 day, or 30 with “Remember me”) and deletion within 30 days at most |
| Security and account activity logs | 12 months |
| Conversations with the assistant and AI activity log | 365 days |
| OAuth/MCP tokens | Until they expire or are revoked (access: 1 hour; refresh: 30 days) |
| Acceptances of the Terms | For the duration of the contract and 5 more years (limitation period, Civil Code art. 1964.2) |
| Cookie consent | 12 months; you are then asked again |
| Marketing communications | Until you withdraw consent or object |
| Support | 3 years from the closure of the ticket |
| Notices of illegal content | 3 years |
| Backups | Overwritten within [35] days [VERIFY the actual retention] |
When the law requires us to keep data, we keep it blocked (LOPDGDD art. 32): it is made available only to judges, courts and authorities during the limitation period.
7. Your rights
You can exercise these rights:
- access;
- rectification;
- erasure;
- restriction;
- portability;
- withdrawal of consent at any time, without affecting prior processing;
- not to be subject to automated decisions.
Right to object. You can object at any time to processing based on legitimate interest and, without having to give reasons, to marketing communications.
How to exercise them:
- Where: many of them directly in the application (profile, export, account deletion, notification and cookie preferences), or by writing to info@air-institute.com (opens your email app) or to the DPO.
- Identification: if you write from your account's email address, we need nothing more. Otherwise, we may ask for the minimum needed to identify you.
- Time limit: we reply within one month, extendable by two months in complex cases, with notice.
If you are not satisfied, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) (C/ Jorge Juan 6, 28001 Madrid, www.aepd.es) or with the authority of your country of residence.
Deceased persons. Heirs or designated persons may request access to, rectification or erasure of the data and content of a deceased person (LOPDGDD arts. 3 and 96), unless the deceased person prohibited it.
8. Automated decisions
AIR Institute does not take decisions based solely on automated processing that produce legal effects or significantly affect you (art. 22 GDPR).
Some contractual measures are applied automatically:
- AI spending caps;
- plan limits;
- deactivation for inactivity, always after notices;
- reCAPTCHA verification.
You can ask for a person to review any of them at info@air-institute.com (opens your email app).
Stripe may reject a payment with its anti-fraud systems, as an independent controller.
The models you create in AIR-Core and the decisions you take with them are your organization's responsibility.
9. If your data is in a customer's account
If a company or organization has uploaded your data to AIR-Core (for example, in a dataset or as a recipient of alerts), that entity is the controller and must handle your rights. If you write to us, we will refer you to it or forward your request to it.
10. Security
We apply technical and organizational measures appropriate to the risk:
- hosting in the EU;
- encryption in transit (TLS);
- encryption of credentials and keys with a master key;
- role-based access control;
- two-step verification;
- activity logging;
- backups.
They are described in Annex II of the Data Processing Agreement. If a breach occurs that poses a high risk to you, we will inform you without delay.
11. Marketing communications
We will only send you marketing information about AIR-Core if you have agreed to it or if you are a customer and it concerns similar products. You can always unsubscribe with the link in each email or in your account settings.
12. Cookies
See the Cookie Policy (https://air-core.io/cookies).
13. Changes
If we change this policy in a significant way, we will inform you by email or in the application before it takes effect. Previous versions are available at [URL].