Privacy Policy

Claix — AI-powered document intelligence, data mapping, and transformation platform

1. Introduction

Claix (hereinafter, the “Service”, “Platform”, “we”, “us”, or “Claix”), operated by ANAYA CARBALLO GAEL, provides an API and SaaS platform for document processing, data standardization, intelligent mapping, data transformation, document context, knowledge spaces, and AI-assisted workflows.

Claix may process business documents, structured and unstructured content, including spreadsheets, PDFs, text documents, images, HTML, XML, and JSON, in order to return structured outputs, support document-related questions, and enable automation workflows.

We take privacy, confidentiality, and information security seriously. This Privacy Policy explains how we collect, use, store, disclose, and protect personal data in connection with the Service.

This Privacy Policy is intended to comply with applicable data-protection law, including Regulation (EU) 2016/679 (“GDPR”), the Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (“LOPDGDD”), and Law 34/2002 on Information Society Services and Electronic Commerce (“LSSI-CE”), where applicable.

This Privacy Policy applies to:

• visitors to the Claix website;
• account holders and workspace users;
• customers and business users of the Claix Dashboard and API;
• individuals whose personal data may be included in content submitted to Claix by a customer;
• users who choose Claix Managed AI; and
• users who enable Bring Your Own Key (“BYOK”) and connect their own AI-provider credentials.

Where Claix processes personal data contained in Customer Content on behalf of a business customer, Claix generally acts as a processor and the customer acts as controller, subject to the applicable Data Processing Addendum (“DPA”) and the customer’s documented instructions.

2. Data Controller

Identity: ANAYA CARBALLO GAEL Trade name: Claix Address: Ronda Sur 203, 3º 3ª Der, 28053 Madrid, Spain Tax ID (NIF): 51030923H Contact and privacy email: info@claix.dev

For questions about this Privacy Policy, privacy rights, or data-protection matters, please contact us at info@claix.dev.

3. Categories of Personal Data and Processing Purposes

Claix distinguishes between Account and Service Data, Customer Content, Document Context Data, and BYOK Configuration Data.

A. Account, Workspace, and B2B Management Data

We may process the following data relating to account holders, workspace administrators, and business customers:

• email address;
• encrypted or hashed authentication credentials, where applicable;
• name, company name, trade name, or legal entity name;
• tax identification number, billing address, and billing details, where applicable;
• account and workspace identifiers;
• account preferences and product settings;
• support communications and support ticket information;
• service communication preferences;
• subscription, invoice, and payment-related records, where applicable;
• records relating to acceptance of Terms, Privacy Policy, and DPA versions.

We use this data to:

• create and manage accounts and workspaces;
• authenticate users and secure access to the Service;
• provide customer support;
• communicate service notices, security notices, product notices, and contractual updates;
• manage subscriptions, billing, invoices, and payment-related obligations;
• prevent fraud, abuse, unauthorized access, and misuse of the Service;
• comply with legal, accounting, tax, and regulatory obligations; and
• maintain evidence of contractual acceptance and account activity where necessary.

B. Navigation, Security, and API Usage Data

We may process technical and usage information, including:

• IP address;
• browser, device, and operating-system information;
• HTTP headers;
• approximate location inferred from IP address;
• timestamps;
• API request metadata;
• API key or token usage metadata;
• authentication events;
• rate-limit, quota, security, and abuse-prevention events;
• error and diagnostic information;
• billing and usage history; and
• logs necessary for security, reliability, debugging, incident response, and service improvement.

We use this information to operate, secure, maintain, troubleshoot, protect, and improve the Service; enforce quotas and rate limits; investigate abuse or incidents; and comply with applicable legal obligations.

C. Customer Content and API Payload Data

“Customer Content” means information submitted by or on behalf of a customer through the Claix Dashboard, API, or supported integrations. Customer Content may include:

• files such as Excel, CSV, PDF, Word, text, Markdown, RTF, or image files;
• text, HTML, XML, JSON, or other API payloads;
• prompts and instructions submitted through supported endpoints;
• schema definitions and agent definitions;
• document-related questions;
• document-derived structured data;
• generated outputs, including JSON responses; and
• any personal data contained in the foregoing.

Claix processes Customer Content only to provide the requested Service, including:

• document extraction and transformation;
• spreadsheet or JSON conversion;
• schema-based structured output generation;
• Agent Mode processing;
• document context queries;
• Knowledge Space queries;
• output generation;
• error handling, security, abuse prevention, and service reliability; and
• other processing initiated or instructed by the customer through the Service.

Customers are responsible for ensuring that they have an appropriate legal basis and all required rights, notices, permissions, and consents to submit Customer Content to Claix.

Customers should not submit special categories of personal data, credentials, payment-card data, highly sensitive confidential information, or regulated data unless they have independently assessed that the selected Service configuration, applicable provider, and contractual documentation are appropriate for their use case.

D. Document Context and Knowledge Space Data

Claix offers optional document context and Knowledge Space features.

When a customer enables temporary or persistent document/context retention through the relevant schema or product configuration, Claix may retain the processed document content, related metadata, document identifiers, schema references, and generated context necessary to provide the selected feature.

This retained content may be used only to:

• retrieve the document at the customer’s request;
• answer questions about the retained document;
• answer questions across documents associated with the same Knowledge Space;
• support deletion requests initiated by the customer;
• maintain the selected retention setting; and
• secure, troubleshoot, and operate the Service.

The customer controls whether document/context persistence is enabled through the applicable product configuration.

E. Bring Your Own Key (“BYOK”) Configuration Data

Claix offers an optional BYOK feature that allows customers to connect an API key or equivalent credential for a supported third-party AI provider and select a compatible provider and model for applicable Claix workflows.

When BYOK is enabled, Claix may process:

• the selected third-party AI provider;
• the selected model or deployment configuration;
• a customer-provided API key or credential;
• a masked key hint or suffix, where applicable;
• the date and status of key creation, validation, replacement, disabling, or deletion;
• provider-connection labels or configuration names;
• usage metadata necessary to operate the connection; and
• error metadata related to provider connectivity, authentication, compatibility, rate limits, or service availability.

Claix stores BYOK credentials using encrypted secret-management mechanisms, including Supabase Vault where applicable. Claix does not intentionally display the full credential after it has been saved and does not include full BYOK credentials in ordinary API responses, dashboard views, or customer-facing logs.

Claix uses a BYOK credential only to make the AI-provider request initiated by the relevant customer through the Service. The credential is not used for any unrelated purpose.

The customer is responsible for:

• ensuring that it is authorized to provide and use the BYOK credential;
• complying with the selected provider’s terms, policies, pricing, rate limits, and data-processing conditions;
• selecting an appropriate provider and model for its use case;
• monitoring charges incurred with the selected provider;
• rotating, replacing, disabling, or deleting the credential where necessary; and
• ensuring that the Customer Content submitted through BYOK is appropriate for processing by the selected provider.

4. Legal Basis for Processing

Claix processes personal data on one or more of the following legal bases, as applicable:

A. Performance of a Contract

Processing is necessary to create and manage an account, provide the Dashboard and API, process Customer Content according to customer instructions, operate selected AI configurations, provide document context and Knowledge Space features when enabled, provide support, and perform our contractual obligations.

B. Legitimate Interests

Processing may be necessary for our legitimate interests in:

• protecting the security, integrity, availability, and reliability of the Service;
• preventing fraud, abuse, unauthorized use, attacks, and denial-of-service incidents;
• debugging and resolving technical issues;
• maintaining service logs and operational records;
• enforcing our Terms and usage limits; and
• improving the safety, reliability, and usability of the Service without using Customer Content for model training.

Where we rely on legitimate interests, we balance those interests against the rights and freedoms of affected individuals.

C. Compliance with Legal Obligations

Processing may be necessary to comply with legal obligations, including tax, accounting, fraud-prevention, record-keeping, regulatory, security, and lawful-authority requirements.

D. Consent

Where required by law, we rely on consent for optional cookies, marketing communications, newsletters, or other processing activities that require consent. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

5. AI Processing Modes

Claix offers two AI processing modes: Claix Managed AI and Bring Your Own Key (“BYOK”).

A. Claix Managed AI

When a customer uses Claix Managed AI, Claix selects and manages the AI-provider configuration used for the applicable Service feature.

Claix may use one or more third-party AI inference providers to process Customer Content strictly for the purpose of providing the requested document-processing, Agent Mode, document context, or Knowledge Space functionality.

The identity of applicable subprocessors and the details of relevant data-processing arrangements are governed by the Claix DPA, subprocessor information, provider documentation, and the configuration in effect at the time of processing.

B. Bring Your Own Key (“BYOK”)

When a customer enables BYOK, Claix uses the third-party AI provider and model or deployment selected by that customer, using the customer-provided credential.

In this mode:

• Claix sends the Customer Content necessary to perform the requested task to the selected AI provider;
• the selected provider processes that content under the customer’s direct provider relationship, account settings, selected product tier, geographic configuration, and applicable provider terms;
• Claix may process and retain limited connection and operational metadata necessary to provide the BYOK feature;
• Claix does not charge an additional Claix BYOK processing fee where the product page or applicable pricing terms state that BYOK processing is free; and
• the customer remains responsible for third-party provider charges, token usage, quotas, rate limits, and provider-level service terms.

Different AI providers and models may have different capabilities, output behavior, data locations, retention practices, availability, latency, safety controls, and data-use policies. Claix cannot guarantee that all third-party providers or models will provide identical behavior, performance, or output quality.

Customers should review the applicable provider terms and select a configuration suitable for their use case, especially before submitting personal data, sensitive information, confidential information, or regulated content.

6. Data Storage, Infrastructure, Subprocessors, and International Transfers

A. Claix Infrastructure

Claix uses third-party service providers to operate the Platform, including infrastructure, database, authentication, secure secret management, storage, communications, monitoring, payment, and AI inference providers, where applicable.

Claix may use Supabase for relevant application infrastructure, including database, authentication, Edge Functions, and secure secret-management capabilities. The relevant Claix Supabase project may be configured in the European Economic Area, including Stockholm, Sweden, depending on the service and configuration in use.

Supabase operates on cloud infrastructure provided by Amazon Web Services for applicable services.

B. AI Providers and Subprocessors

When Claix Managed AI is used, Customer Content may be sent to one or more AI inference providers selected and managed by Claix for the purpose of delivering the Service.

When BYOK is used, Customer Content may be sent to the AI provider selected by the customer.

Examples of providers that may be involved depending on the selected product configuration include:

• Google, including Gemini services;
• OpenAI;
• Anthropic;
• xAI;
• Supabase;
• Amazon Web Services; and
• other providers identified in Claix’s current subprocessor information or applicable service documentation.

Not every provider listed above processes every customer’s data. The provider involved depends on whether the customer uses Claix Managed AI or BYOK, the selected provider/model, the relevant feature, service availability, and the configuration in effect at the time of processing.

C. International Data Transfers

Claix is established in Spain and seeks to operate its core application infrastructure within the European Economic Area where possible.

However, Customer Content, account data, or technical data may be transferred to, accessed from, or processed in countries outside the EEA where this is necessary to provide the Service, including where:

• a customer selects a non-EEA AI provider through BYOK;
• Claix Managed AI uses an applicable AI provider;
• an authorized subprocessor provides infrastructure, support, security, monitoring, communications, payment, or other service functions from outside the EEA; or
• a customer accesses the Service from outside the EEA.

Where personal data is transferred outside the EEA to a country that is not subject to an adequacy decision, Claix will seek to use an appropriate transfer mechanism under applicable law, such as the European Commission’s Standard Contractual Clauses, an adequacy decision, the EU–U.S. Data Privacy Framework where applicable, or another lawful transfer mechanism.

The customer acknowledges that, when it selects BYOK, the selected provider’s data-processing location, transfer mechanisms, retention, security, and data-use policies are governed primarily by that provider’s terms and the customer’s relationship with that provider.

7. Data Retention

Claix retains personal data only for as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

A. Account, Billing, and Contractual Data

Account, billing, tax, contractual-acceptance, and related business records are retained for the duration of the customer relationship and thereafter for the periods required by applicable tax, accounting, legal, dispute-resolution, fraud-prevention, or regulatory obligations.

B. Customer Content Without Document or Context Persistence

Where a customer does not enable temporary or persistent document/context retention, Claix processes Customer Content for the duration necessary to complete the requested API or Dashboard operation and does not intentionally retain it as a persistent document/context record after processing is complete.

This does not necessarily mean that every technical trace disappears instantly from all systems. Limited operational metadata, security records, error information, logs, backups, or provider-level records may be retained for limited periods where necessary for security, abuse prevention, incident response, debugging, service reliability, backup, legal obligations, or compliance.

C. Customer Content With Temporary or Persistent Context Enabled

Where a customer enables temporary document/context retention, Customer Content and associated context may be retained for the configured temporary period.

Where a customer enables persistent document/context retention, Customer Content and associated context may be retained until the customer deletes the relevant document, disables or changes the retention configuration, closes the account, or otherwise requests deletion, subject to limited retention required for security, backup, legal, or compliance purposes.

D. BYOK Credentials

BYOK credentials are retained in encrypted form only while the customer keeps the relevant BYOK connection active or until the customer replaces, disables, deletes, or requests deletion of the credential, subject to limited technical, security, backup, legal, and audit retention requirements.

Claix does not intentionally retain the full plaintext value of a BYOK credential in ordinary account records, dashboard views, or API responses.

E. Third-Party Provider Retention

Where Customer Content is sent to a third-party AI provider, including through Claix Managed AI or BYOK, that provider’s retention and deletion practices are governed by the provider’s own applicable terms, policies, account configuration, product tier, and contractual relationship.

Customers using BYOK should consult the selected provider’s documentation and terms for information about provider-level retention, logging, training, regional processing, and deletion practices.

8. Use of Customer Content for Training and Service Improvement

Claix does not use Customer Content, including uploaded files, prompts, payloads, documents, document context, schema content, questions, or generated outputs, to train or retrain Claix AI models.

Claix does not sell Customer Content.

Claix may use aggregated, de-identified, and non-content operational information to understand service performance, prevent abuse, improve security, identify reliability issues, and improve the user experience, provided that such use does not involve using identifiable Customer Content to train a model.

When Customer Content is processed by a third-party AI provider:

• under Claix Managed AI, the processing is subject to the applicable provider agreement and Claix’s service configuration; and
• under BYOK, the processing is subject to the selected provider’s terms, data-use policies, account settings, product tier, and the customer’s direct relationship with that provider.

Claix does not control the independent data-use practices of a BYOK provider selected by the customer. Customers are responsible for reviewing and selecting a provider configuration that is appropriate for their data and use case.

9. Data Processing Agreement (DPA) Summary for B2B Customers

Where Claix processes personal data included in Customer Content on behalf of a business customer, Claix generally acts as a processor and the customer acts as controller.

The Claix DPA, which forms part of the applicable contractual documentation where accepted or incorporated by reference, governs such processing.

Subject to the DPA and applicable law:

A. Customer Instructions

Claix processes Customer Content only on the customer’s documented instructions, including instructions transmitted through the Dashboard, API, schema settings, retention settings, AI processing mode selection, document context settings, Knowledge Space settings, and supported integrations.

B. Confidentiality

Claix requires persons authorized to process personal data to be subject to appropriate confidentiality obligations.

C. Security

Claix applies technical and organizational measures designed to protect the confidentiality, integrity, availability, and resilience of the Service and Customer Content, including encryption in transit, access controls, authentication mechanisms, tenant separation, and secure handling of secrets.

D. Subprocessors

The customer authorizes Claix to engage subprocessors as necessary to provide the Service, subject to the subprocessor provisions, notice requirements, and objection rights set out in the DPA.

Subprocessors may include application infrastructure providers, cloud providers, AI inference providers, authentication providers, communications providers, payment providers, monitoring providers, and other technical service providers necessary to operate the Service.

Where BYOK is used, the customer’s selected AI provider may process Customer Content as part of the customer’s direct relationship with that provider. The customer is responsible for ensuring that its selected provider is appropriate for its processing activities.

E. Assistance and Rights Requests

Claix will provide reasonable assistance to customers, taking into account the nature of processing and available information, in responding to valid data-subject requests, security obligations, data-protection impact assessments, consultations, and other obligations required under applicable law, as described in the DPA.

F. Deletion or Return

Upon termination of the Service or at the customer’s request, Claix will delete or return Customer Content in accordance with the DPA, applicable product settings, and applicable law, unless retention is required by law.

10. User Rights

Subject to applicable law, you may exercise your data-protection rights by contacting info@claix.dev and specifying the right you wish to exercise.

Depending on the circumstances, rights may include:

• access to your personal data;
• rectification of inaccurate or incomplete data;
• erasure of personal data;
• restriction of processing;
• objection to processing based on legitimate interests;
• portability of personal data in a structured, commonly used, machine-readable format;
• withdrawal of consent where processing is based on consent; and
• the right not to be subject to a decision based solely on automated processing where applicable law grants that right.

Where Claix processes personal data on behalf of a business customer, the customer is generally responsible for responding to requests from the individuals concerned. Claix may direct such requests to the relevant customer or assist the customer as required by the DPA and applicable law.

If you believe your rights have not been adequately addressed, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) at https://www.aepd.es/.

11. Security Measures

Claix applies technical and organizational measures designed to protect personal data and Customer Content against unauthorized or unlawful processing and against accidental loss, destruction, damage, alteration, or disclosure.

These measures may include:

• encryption in transit through HTTPS/TLS;
• encryption at rest where supported by the applicable infrastructure and configuration;
• secure authentication and access controls;
• hashed or protected authentication credentials;
• tenant and workspace separation;
• API-key controls;
• rate limiting and abuse prevention;
• logging and monitoring for security and reliability;
• restricted access to sensitive systems;
• secure secret-management practices for BYOK credentials, including encrypted storage through Supabase Vault where applicable;
• masking of BYOK credential hints in customer-facing interfaces;
• deletion controls for document context and Knowledge Spaces; and
• processes designed to support incident detection, investigation, and response.

No method of transmission, storage, or processing is completely secure. Claix therefore cannot guarantee absolute security, but we take reasonable measures designed to protect the information processed through the Service.

12. Customer Responsibilities

Customers are responsible for:

• ensuring they have a lawful basis to submit personal data to Claix;
• providing appropriate privacy notices to individuals where required;
• obtaining consent where consent is required;
• configuring retention settings appropriately;
• selecting an appropriate AI processing mode;
• reviewing provider terms before enabling BYOK;
• protecting their Claix API keys, user credentials, and BYOK provider credentials;
• avoiding the submission of unnecessary sensitive data;
• implementing appropriate access controls within their own systems;
• validating outputs before using them for consequential decisions; and
• maintaining appropriate human review, governance, and safeguards for high-impact, legal, financial, employment, healthcare, compliance, or other sensitive use cases.

13. Changes to This Privacy Policy

Claix may update this Privacy Policy to reflect legal, regulatory, technical, security, product, infrastructure, or operational changes.

Where a change is material, Claix will provide notice to registered users by email, through the Dashboard, or by another appropriate communication method before the change takes effect, where required by applicable law or the applicable contractual documentation.

The “Last updated” date at the top of this Privacy Policy indicates when it was most recently revised.