PerizIAl

GDPR overview

GDPR implementation is documented in unusual detail. The publisher claims compliance with Regulation (EU) 2016/679 and Spain's LOPDGDD, and backs it with an article 28 data processing agreement published as Annex I of the terms. A subprocessor table names every provider, what it handles and where, with thirty days' notice, a right to object and a right to terminate before any addition. International transfers rest on the 2021/914 standard contractual clauses, plus EU-U.S. Data Privacy Framework adherence for Google and Stripe; the publisher states that Railway Corp.'s status is still being checked. A qualitative transfer impact assessment is handed to the account holder on request within thirty days. Breaches are notified to the controller within twenty-four hours. No data protection officer is appointed, which the privacy policy justifies as falling outside article 37. The legal notice is dated 15 August 2026, version 2.2.

Who owns the data?

Under the terms of service, customer content remains the customer's property. Uploading it grants Cyber Vault, S.L. a worldwide, non-exclusive, royalty-free licence, limited to the contract term plus statutory retention, and strictly to host the material, process it, display it back to the customer and deliver the service, including passing it to indispensable subprocessors such as Vertex AI and S3. That licence expressly excludes any commercial exploitation of its own, advertising, or model retraining. Finished reports the customer exports belong to the customer, who stays legally answerable for their content. The platform's source code, report templates and the PerizIAl trademark belong to the publisher. Under the GDPR the customer is controller and PerizIAl is processor.

Reuse rights

Customers may reuse their own material freely and without asking permission: the reports and files they download or export are theirs, and they alone decide what is filed, to whom it is delivered and how it is reused afterwards. What the publisher may do with that material is deliberately narrower. Every piece of text bound for the model first passes a pseudonymisation shield that swaps IP addresses, e-mail addresses, Spanish national ID numbers, IBANs, phone numbers, card numbers and MAC addresses for reversible markers, and the model's answer is rehydrated on the way back. The data processing addendum signed with Google Cloud rules out any retraining on customer content, and the terms forbid the publisher from using that content for its own commercial, advertising or model-training purposes. Every AI output stays a draft until the adjuster validates it, and adjuster notes are written in reported speech for as long as they lack documentary support. One exception runs the other way: suggestions and feedback a customer volunteers may be built into the product without compensation.

Data retention & training

Hosting summary

Hosting is split across several providers and the publisher maps each one. The generative model runs on Vertex AI Gemini 2.5 Flash in Google's europe-southwest1 region in Madrid, Spain. Case files — PDFs, photos, video and audio — sit in Amazon S3 eu-west-1 in Ireland by default, and a customer may point the platform at their own bucket in another region. The application and its PostgreSQL database are hosted by Railway Corp., a US company, deployed inside the European Union in Amsterdam under a data processing agreement and standard contractual clauses. Transactional mail goes through Resend in Frankfurt, Germany. Video appraisal audio and video bypass the web path entirely and reach a dedicated server at OVH in France. Cloudflare, a US company on a free plan, provides DNS, the reverse proxy and inbound mail routing; it terminates TLS, sees request content and offers no regional routing control. Gmail API and Google Maps calls are processed in the United States under standard contractual clauses and Data Privacy Framework adherence, and Stripe operates from Ireland with US fallback.