Alighieria

GDPR overview

GDPR implementation is documented in concrete terms. The data protection policy, effective 1 July 2025, claims compliance with both the EU General Data Protection Regulation and Spain's LOPDGDD (Organic Law 3/2018 of 5 December). It names the controller, Alighieria Systems SL in Barcelona, with a postal address, a telephone number and a contact email. Four legal bases are listed: performance of the contract, consent, legitimate interest and legal obligation. Seven data subject rights are set out individually, exercisable by email or post, with a one-month response deadline extendable by two months, and a right of complaint to the Spanish supervisory authority, the AEPD. Transfers outside the European Economic Area are said to rely on adequacy decisions or standard contractual clauses. No Data Protection Officer is named, and no customer-facing DPA is published.

Who owns the data?

Under the terms of service, the customer keeps every right over their original content: processed documents retain their original authorship, and Alighieria Systems SL states that it acquires no rights over user content. The company owns the platform itself and grants only a non-exclusive licence to use it. It commits to absolute confidentiality over uploaded material and to accessing it only for specific technical needs. Personal data may be shared with processors handling hosting, email, payment and technical support, with the authorities where the law requires it, and with third parties only on explicit consent. The privacy policy states that personal data is never sold, rented or traded.

Reuse rights

Customers may export their content at any time and remain free to use it as they wish, since Alighieria acquires no rights over it. The terms explicitly state that user content is not used to train algorithms. What is forbidden is reverse-engineering, reproducing, distributing or modifying the software itself, and users must respect intellectual property rules for whatever they upload. The vendor gives no guarantee that automated corrections are infallible and declines responsibility for editorial decisions taken on the strength of its suggestions, so the publisher remains accountable for the final text. After cancellation, access continues until the end of the paid period; where payment fails, the service is suspended after seven days and data is kept a further thirty days before permanent deletion becomes possible.

Data retention & training

Hosting summary

No hosting country or region is declared anywhere on the site. What is established is the jurisdiction: the controller, Alighieria Systems SL, is based in Barcelona, Spanish law governs the contract and the courts of Barcelona have jurisdiction. The privacy policy states only that any transfer of data outside the European Economic Area is covered by adequacy decisions or standard contractual clauses, which implies but never confirms European hosting. Processors are acknowledged for hosting, email, payment and technical support, but none is named. On the technical side the vendor describes a closed, encrypted environment, encryption in transit and at rest, firewalls and intrusion detection, encrypted backups, multi-factor authentication for administrative access and continuous monitoring, with third-party language models reached through secure APIs. No security certification such as SOC 2 or ISO 27001 is claimed. The domain resolves to a Cloudflare anycast address, which says nothing about where data actually sits.