Privacy Policy

1. Data Controller

The data controller for HolaNolis is Pixel Solution, S.L., the company operating the service, based at Casafranca, 35, 08017 Barcelona, Spain. For any privacy-related inquiries, you can contact us at info@holanolis.com.

2. Data We Collect

We collect only the data strictly necessary to provide the service:

• Account information: name, email address, date of birth (for minors), language preference.
• Conversation data: messages exchanged between minors and Nolis, encrypted at rest with AES-256-GCM using per-user Data Encryption Keys (DEK).
• Usage metadata: session timestamps, message counts, feature usage — used for reports and safety monitoring.
• Payment data: processed exclusively by Stripe. We never store credit card numbers on our servers.
• Device information: browser type, operating system — used for compatibility and security. On the website we use Google Analytics in consent mode: without your consent, no analytics cookies are stored.

3. Legal Basis for Processing

• Contract performance: processing necessary to provide the HolaNolis service you subscribed to.
• Legitimate interest: safety monitoring, crisis detection, and fraud prevention.
• Consent: marketing communications (you can opt out at any time).
• Legal obligation: data retention required by applicable law.

4. Children's Data

HolaNolis is designed for children, teens and young people aged 10 to 20. We take the protection of children's data extremely seriously:

• The account of anyone under 18 is always authorised and linked by a parent or legal guardian. Digital consent ages vary by country (for example 14 in Spain, 15 in France, 13 in the UK); regardless of those thresholds, HolaNolis requires a responsible adult for everyone under 18.
• The parent or guardian gives consent for the processing of the minor's data. The linked guardian sees what the agreed supervision level allows (reading conversation history requires the Full level and the Premium plan); authorised HolaNolis staff only access conversations when needed for safety, support or legal requirements.
• All conversation data is encrypted at rest with per-user encryption keys.
• We designed the service with GDPR Article 8 (conditions for child consent), COPPA (for US users) and the EU AI Act's transparency rules in mind; external legal review is pending.
• Minors can exercise their data rights themselves or through their parent or guardian. If you are 18 or over, supervision can only continue with your consent, and you can ask for it to be removed by writing to info@holanolis.com.

5. Data Sharing

We do not sell personal data. We share data only with:

• AI processing: conversations are processed with Claude models (Anthropic) through AWS Bedrock in European Union regions (eu.* inference profiles, Frankfurt). By default, AWS Bedrock does not store prompts or responses after processing them, does not use them to train models, and does not share them with the model provider; we also keep invocation logging disabled. Embeddings are computed on our own infrastructure within the EU and are not sent to external providers. Hosting runs on Hetzner (EU). We do not use user data to train AI models.
• Stripe: for payment processing.
• Google Workspace (Gmail): for transactional email delivery (crisis alerts, account notifications).
• Google: for Sign in with Google (if you choose it) and reCAPTCHA on the website forms.
• Browser push services (Google, Apple or Mozilla): to deliver push notifications, if you enable them.
• Google Analytics: website analytics, in consent mode.
• Brevo: to send the downloadable guide and emails to people who subscribe on the website.
• Law enforcement: only when required by valid legal process.

6. International Data Transfers

AI inference and service hosting run in data centers located in the European Union. However, some of our providers (such as AWS, Stripe or Google) are US-parented companies, so limited international data transfers may occur, for example for support or administration tasks. These transfers are covered by each provider's data processing agreement (DPA) and by the standard contractual clauses approved by the European Commission.

7. Security

• Names, email addresses, dates of birth and message content are encrypted at rest using AES-256-GCM with per-user Data Encryption Keys; operational metadata (such as timestamps or language) is not.
• All communications are encrypted in transit via TLS 1.2+.
• JWT-based authentication with short-lived access tokens (15 min) and secure refresh tokens (7 days).
• Audit log with SHA-256 hash chain for tamper detection.
• Regular security reviews and dependency auditing.

8. Your Rights

Under GDPR, you have the right to:

• Access: request a copy of all personal data we hold about you.
• Rectification: correct inaccurate data.
• Erasure: request deletion of your data ("right to be forgotten").
• Portability: receive your data in a structured, machine-readable format.
• Restriction: limit how we process your data.
• Objection: object to processing based on legitimate interest.
• Withdraw consent: at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, email us at info@holanolis.com. We will respond within 30 days.

9. Data Retention

• Account data: retained while the account is active. Deleted within 30 days of account deletion request.
• Conversation data: retained according to the supervision level and tutor preferences. Fully deleted upon account deletion.
• Payment records: retained for the period required by applicable tax and accounting laws.
• Audit logs: retained for 2 years for security and compliance purposes.

10. Privacy contact

For any questions about this privacy policy or how we handle your data, write to us:

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. In Spain, the supervisory authority is the Agencia Española de Protección de Datos (AEPD).