Privacy Policy

Last updated: 26 September 2026

Data controller

Biomag, S.L.U., with registered office at Calle Barrachi 39, Pabellón 3, 01013 Vitoria-Gasteiz, Álava, España (Tax ID B01037241), is the controller of the personal data collected through the AIM DECK service.

For any privacy question or to exercise your rights, you can contact us at attcliente@biomag.es.

What data we process

Account data: your email address, a hashed version of your password —we never store your password in clear text—, your chosen language and your plan.

Content you create: the text and titles you enter to generate your presentations, their revisions, any logo you upload and the images generated or uploaded.

Data you collect from third parties: if you enable lead capture, comments or collaboration on a public presentation, we process on your behalf the names, emails and messages those people send you. In that case, you are the controller of that data.

Technical usage data: product metrics linked to your account (for example, registering, creating or exporting a presentation) and AI usage metrics (consumption and cost). Views of a public presentation are counted WITHOUT storing the IP address or identifying the viewer: only the date is kept.

Purpose and legal basis

To provide the service and manage your account (performance of the contract).

To generate your presentations by sending the text you enter to our AI providers (performance of the contract).

To keep the service secure, prevent abuse and improve the product with aggregated metrics (legitimate interest).

Providers and international transfers

To operate, AIM DECK relies on processors: artificial-intelligence providers that generate content from the text you enter (text and image generation) and a hosting provider in the European Union.

Some AI providers may process data outside the European Economic Area. In those cases, transfers are covered by the safeguards provided under the GDPR (such as the European Commission's Standard Contractual Clauses).

These are the current processors, so you can verify it: Railway (hosting and database, European Union — Amsterdam), OpenRouter (text generation) and Atlas Cloud (image generation). None of them uses your content to train models.

We do not sell your data or share it with third parties for advertising purposes.

AI transparency

AIM DECK content is generated with the help of artificial intelligence, and we mark it as such, as required by Article 50 of Regulation (EU) 2024/1689 (the AI Act).

Generated images carry two machine-readable marks: the IPTC standard term for media created by trained algorithms (trainedAlgorithmicMedia), read by search engines and social networks, and signed C2PA content credentials declaring how they were made. Videos carry C2PA credentials as composite content with generated elements. PowerPoint and Word files declare it in their properties, and SCORM courses in their code and in a visible notice.

Images you upload are not marked: labelling a real photo as synthetic would be false.

We sign the credentials with AIM DECK's own authority; C2PA readers show it as not on their trust list until we use a certificate from a C2PA-recognised authority.

Retention

We keep your account data and content while your account is active. If you delete your account, you and your presentations are permanently removed. We may keep minimal records where a legal obligation requires it.

Security

We apply reasonable technical and organizational measures. Passwords are stored hashed and access to your data is restricted.

Staff training record

If your company uses the AI kit's training record, the staff members who take the course through the link enter their name and, optionally, their role; we also keep the date and the assessment result.

For that processing, your company is the data controller and Biomag, S.L.U. acts as data processor: we process that data only to show it to your company and record the training, we do not use it for anything else and we do not send it to any AI provider. It is kept until the company deletes it or closes its account, and any result can be deleted at any time from the record itself.

Company requests and orders, and AI voucher alerts

If you request a quote on the page for companies, we process the data you give us (name, email, company, sector, size, need, timing, tools you use and message) to answer you and prepare the quote. The legal basis is taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR).

To order the replies, each request receives an automatic score based on those same answers. It has no legal effect and does not significantly affect you: every request receives the indicative price for what it asks by email.

If you join the waiting list for Spain's AI voucher, we use your email only to let you know when its rules are published, with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by writing to attcliente@biomag.es.

If you order a course, we keep the materials and logo you upload outside the website and only to produce that course; only the team preparing it can download them. They are deleted after 12 months if the order is not confirmed, and 90 days after delivery.

Requests are deleted after 12 months if they do not lead to an order, and the waiting list once we have notified you or, at most, after 24 months. Emails are sent through Resend. We do not use this data for advertising or share it with third parties.

Your rights

You can access and download a copy of your data, and delete your account and all your content, directly from the settings section of the application.

You may also exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to attcliente@biomag.es. If you believe your request has not been handled properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

Minors

The service is not directed to minors and we do not knowingly collect their data.

Changes

We may update this policy. We will post the current version here with its last-updated date.