Summary
Fluxia processes the minimum personal data possible. Access is by invitation, through a request that a person reviews or through the link of a trial promotion; we do not build profiles or run advertising, and we do not take automated decisions with legal effects about you. This page explains, by category, what data we process, why, on which legal basis, for how long, who receives it and how to exercise your rights under Regulation (EU) 2016/679 (GDPR).
Data controller
| Field | Value |
|---|---|
| Controller | Alejandro Frechoso Mejía |
| Tax ID (NIF) | 52903876N |
| Address | Calle Elba 27, 28022 Madrid, Spain |
| Contact | fluxia.soporte@gmail.com (we reply within 30 calendar days) |
| DPO | Not appointed |
Roles. With client organizations that register their people under a contract, Fluxia acts as a processor and the data processing agreement we sign with them governs; if you are a user of one of those organizations, send your requests to it. For this website, access requests, invitations and trial accounts, Fluxia is the controller.
What we process, why and for how long
Access request
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Email, name (optional), organization (optional) and whatever you write in “What do you need it for?” (optional), from app.fluxia-ia.com/register | So a team member can decide whether to grant access and contact you | Art. 6(1)(b) GDPR: steps prior to a contract, at your request | There is no automatic deletion once the request is decided: it is kept until you ask for its erasure |
| Minimal technical data of the connection | Anti-abuse measures | Art. 6(1)(f): interest in preventing abuse | Up to 7 days |
Account and invitation
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Email of an account created by invitation | Identify the account and contact whoever uses it | Art. 6(1)(b) | For as long as the account exists |
| Optional internal note an administrator writes when inviting | So the team remembers why that person was invited | Art. 6(1)(b) | For as long as the email stays on the allowed-access list |
Queries, responses and history
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Text of your queries and of the responses, with the sources cited and the account they belong to | Answer you, show you your history and, afterwards, evaluate and debug the service | Art. 6(1)(f) GDPR: legitimate interest in providing and improving the service | History: for as long as your account exists. Operating logs: see “Operating logs” |
Your queries and the responses are stored in your history and in the operating logs. The history is kept for as long as your account exists; when the account is deleted, the history is deleted along with it. Deleting a conversation from the sidebar only hides it in your browser: to erase it for real, ask through the procedure in “Your rights”. We do not retrain models on your queries.
Do not type personal data into your queries. Fluxia does not need it to answer about river basin plans and, if you type it, it will remain in your history and in the operating logs.
Operating logs
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Technical records of how the service runs, which include your queries and the responses and the technical data of each request; only those who administer and review the service can access them | Security, incident handling and service improvement | Art. 6(1)(f): legitimate interest in security, incident handling and service improvement | The time needed for security, incident handling and service improvement; linked to your account; they are not deleted automatically when the account is deleted; you can ask for their erasure |
Ratings and comments
| Data | Why | Legal basis | How long |
|---|---|---|---|
| 👍/👎 vote and free-text comment (both optional) | Improve the service and assess the quality of responses | Consent (Art. 6(1)(a)), when you press the thumb; you can withdraw it | The time needed to improve the service; linked to your account; they are not deleted automatically when the account is deleted; you can ask for their erasure at any time |
Voting is strictly optional: if you do not press the thumb, we store nothing about your opinion. Withdrawing consent does not affect the lawfulness of processing carried out before.
Problem reports
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Description of the problem, impact, whether you agree to be contacted, and the account and the conversation it refers to | Investigate the problem and, where applicable, notify the competent authority | Legal obligation (Art. 6(1)(c)) when handled as a serious incident; legitimate interest in handling and documenting the problem otherwise | Up to 5 years when handled as a serious incident under a legal obligation; otherwise, the time needed to deal with it; linked to your account; they are not deleted automatically when the account is deleted; you can ask for their erasure |
Trial accounts through a promotion
These are trial accounts created through the link of a Fluxia promotion, with a query limit.
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Email, name, organization (optional), profile, whatever you write in “What would you like to discuss with the Fluxia team?” (optional) and the promotion through which you signed up | Create the trial account, apply the query limit of its promotion and let the team contact you if you ask | Art. 6(1)(b): creating the account | For as long as the account exists; when it is deleted this data is erased and only an anonymous sign-up record remains (promotion, profile and date), which counts toward the trial’s account cap |
| Minimal technical data at sign-up | Anti-abuse measures at sign-up | Art. 6(1)(f): legitimate interest in preventing abusive sign-ups | For as long as the account exists; sign-up limit events, up to 7 days |
| Email, name, organization, profile, your text and up to your 10 most recent queries, only if you press “I want to talk to the Fluxia team” | So the team can reply to you | Art. 6(1)(b), at your request | A single email is sent to the support mailbox and cannot be withdrawn; it is deleted from there only if you ask. It also creates an access request, which is kept like the others |
None of the above is used to build profiles or for advertising.
Is providing the data mandatory?
It depends on the data. In the access request, the email is necessary to assess it: if you do not provide it, we cannot consider your request; name, organization and reason are optional. In the trial account, the name and the profile are also necessary to create it. The query is necessary to answer you: if you do not provide it, we cannot answer you. Voting and commenting are voluntary and carry no consequence if you do not. Other fields marked as optional have no consequence if you leave them empty.
Recipients and transfers
To provide the service we rely on providers that process data on our behalf, grouped in these categories:
- Hosting and cloud infrastructure: the service and the database run in the EU; publishing the website and routing requests use a global distribution network.
- AI model providers: receive the text of the query, the retrieved document excerpts and, where applicable, the conversation context to generate the response.
- Document search and re-ranking: receive the text of the query and plan excerpts to find and order the sources.
- Supplementary web search: receives the text of the query only when the question is about current events.
- Email delivery: receives your address when we invite or write to you and, if you press the trial’s contact button, the contact email.
Some providers process data outside the EEA with the safeguards of Chapter V of the GDPR (standard contractual clauses or an adequacy decision), except for the support mailbox and the supplementary web search, which are governed by the provider’s standard terms. We send no account data to the AI and search providers, but we do send the text of the query, which contains whatever you type into it.
The list of sub-processors is available to clients and to any data subject who asks for it at
fluxia.soporte@gmail.com.
Cookies and storage
This website stores nothing in your browser and the assistant uses only technical storage. The detail is in the cookie policy.
Your rights
As a data subject you have the following rights. To exercise them, write to fluxia.soporte@gmail.com from the email
of your account or request; we may ask you to prove your identity. Response time: 30 calendar days from receipt of
the request.
| Right | GDPR article | How to exercise |
|---|---|---|
| Access | Art. 15 | Ask for a copy of the data we hold about you |
| Rectification | Art. 16 | Say which data must be corrected |
| Erasure (“right to be forgotten”) | Art. 17 | Ask us to delete your data; includes the history and any conversations you want removed |
| Restriction | Art. 18 | Ask us to pause the processing while we review it |
| Portability | Art. 20 | Ask for a copy of your data in a structured, commonly used format |
| Objection | Art. 21 | Applicable to legitimate interest: explain your particular situation |
| Automated decisions | Art. 22 | Fluxia does not make automated decisions with legal effects about you |
| Withdraw consent | Art. 7(3) | Write to us and we delete the associated vote and comment |
Complaints: if you believe the processing infringes the GDPR you may lodge a complaint with the Spanish Data Protection Agency (AEPD) or with the supervisory authority of your country of residence.
Changes to this policy
When this policy changes, we will publish the new version, with its date, on this page.
Current version: 2026-10-07.