Privacy Policy

Ubex AI / Qira

1. Introduction

This Privacy Policy explains how personal data is collected, used, stored and otherwise processed when you access or use Ubex AI and Qira (together, the “Services”).

The Services are operated by TechVision Mallorca SL, a company incorporated in Spain, with CIF B72772940, and registered in Marratxí, Mallorca, Spain (“Ubex AI”, “we”, “us” or “our”).

We are committed to protecting personal data and processing it in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), applicable Spanish data protection legislation and other applicable privacy laws.

This Policy applies to visitors to our websites, registered users, customers and individuals whose personal data we process in connection with the Services.

2. Who is responsible for your personal data?

The data controller is:

TechVision Mallorca SL

CIF: B72772940

Marratxí, Mallorca, Spain

Email: privacy@ubex.ai

Depending on the circumstances, Ubex AI may act as:

• Data controller, when we determine the purposes and means of processing, such as managing user accounts, operating our websites, handling customer relationships and providing our Services.
• Data processor, when we process personal data on behalf of a business customer under that customer's documented instructions.

Where Ubex AI acts as a processor, the relevant customer is generally responsible for determining the purposes and legal basis of the processing. The relationship is governed by the applicable Data Processing Agreement (“DPA”).

3. Personal data we collect

The personal data we collect depends on how you use the Services.

3.1 Account and contact information

This may include:

• Name or username.
• Email address.
• Account credentials and authentication information.
• Subscription and account status.
• Customer support communications.

3.2 User content and AI interactions

When you use the AI features, we may process:

• Prompts, questions and instructions you submit.
• Files, text, images or other content you upload.
• Generated responses and conversation history.
• Model selections and related interaction settings.
• Feedback you provide about generated responses.

Please do not submit sensitive personal data unless it is necessary for your intended use and you have an appropriate legal basis to do so.

3.3 Technical and usage information

We may collect technical information such as:

• IP address.
• Browser type and version.
• Device and operating system information.
• Date and time of access.
• Usage events and interaction logs.
• Diagnostic, error and performance information.

3.4 Payment and transaction information

Where paid Services are offered, payment-related information may be processed by our payment service providers. We may receive limited information such as transaction identifiers, payment status and billing details.

We do not necessarily receive or store full payment card details.

3.5 Communications and support

If you contact us, we process the information you provide so that we can respond to your enquiry, provide support and maintain relevant records.

4. Why we process personal data and our legal bases

We process personal data only where an applicable legal basis under the GDPR permits us to do so.

Where we rely on legitimate interests, we consider the impact on individuals and their rights and freedoms.

Where consent is required, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

5. AI processing and external model providers

The Services use artificial intelligence models supplied by external providers. To generate responses, the relevant prompt and associated information may be transmitted to the provider responsible for the selected model.

We currently use three distinct processing routes:

• Together AI: Certain models are accessed through the Together AI API. In those cases, the relevant input is transmitted to Together AI for model inference.
• Mimo: Mimo models are accessed directly through Mimo's own API. These requests are not routed through Together AI.
• Other model providers: Remaining models are accessed directly through the respective providers' APIs.

The provider involved depends on the model selected and the functionality being used.

5.1 What external providers process

The relevant provider may technically process the information necessary to fulfil the API request. This may include prompts, uploaded content, contextual information and technical request data.

The provider's role, retention practices, permitted uses of data, security measures and access arrangements depend on its applicable terms, privacy documentation, technical configuration and contractual arrangements.

We do not represent that every provider follows identical retention or data-use practices. Users should avoid submitting information they are not authorised to disclose or that is unnecessary for their intended interaction.

5.2 AI outputs

AI-generated responses may be inaccurate, incomplete, misleading or unsuitable for a particular purpose. They should be reviewed before being relied upon, particularly in legal, medical, financial or other high-impact contexts.

AI outputs should not be treated as professional advice or as a substitute for independent verification.

6. Hosting and data storage

Our main application infrastructure and servers are hosted on Google Cloud in the Frankfurt, Germany region.

This means that the principal application environment is hosted within the European Union.

However, the use of external AI model APIs and other third-party services may involve separate processing by those providers. Their processing locations, access arrangements and retention practices may differ from the location of our main application infrastructure.

Accordingly, we do not claim that every item of personal data is necessarily stored or processed exclusively in Frankfurt or within the European Economic Area.

We take appropriate steps to assess the services we use and to protect personal data in accordance with applicable data protection requirements.

7. Data retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including the provision of the Services, account administration, security, dispute resolution and compliance with legal obligations.

Retention periods may vary depending on the type of information and the context in which it is processed.

For example:

• Account information is generally retained while an account remains active and for a reasonable period afterwards where necessary.
• User conversations and uploaded content are retained according to the applicable product functionality, account settings and operational requirements.
• Support communications are retained for as long as reasonably necessary to handle the enquiry and maintain relevant records.
• Billing and transaction records may be retained for the periods required by applicable accounting and tax laws.
• Technical and security logs may be retained for a limited period necessary for security, troubleshooting and abuse prevention.

Information may be retained for longer where required by law or where necessary to establish, exercise or defend legal claims.

External AI providers may apply their own retention periods to API requests and related information, subject to their applicable terms, settings and contractual commitments.

8. Sharing personal data and service providers

We may share personal data with third parties where necessary to operate the Services, fulfil contractual obligations, comply with law or protect our legitimate interests.

These recipients may include:

• Cloud hosting and infrastructure providers, including Google Cloud.
• AI model and API providers, including Together AI, Mimo and other providers whose models are available through the Services.
• Payment providers, where payment processing is required.
• Security, monitoring and technical support providers, where used.
• Professional advisers, such as lawyers, accountants and auditors.
• Public authorities and regulators, where disclosure is legally required.

We seek to ensure that service providers are subject to appropriate contractual, confidentiality and data protection obligations.

Where a third party processes personal data on our behalf, we seek to put the required data processing arrangements in place.

Further information about relevant subprocessors and service providers may be provided in a separate Subprocessor Disclosure, which should be read together with this Privacy Policy where applicable.

We do not sell personal data as a commercial product.

9. International data transfers

Our main application infrastructure is hosted in Frankfurt, Germany. Nevertheless, certain third-party services, particularly external AI model APIs, may process personal data outside the European Economic Area (“EEA”).

Where personal data is transferred to a country outside the EEA, we take steps to ensure that the transfer complies with Chapter V of the GDPR.

Depending on the recipient and the circumstances, this may involve:

• A European Commission adequacy decision.
• An applicable EU-US Data Privacy Framework certification, where the recipient and transfer are covered.
• Standard Contractual Clauses adopted by the European Commission, together with supplementary measures where required.

The location of a model developer or provider does not, by itself, establish where a particular API request is processed or where data can be accessed.

We therefore assess international transfers by reference to the relevant service provider, its contractual arrangements and the actual processing and access arrangements.

10. Data security

We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

These measures may include:

• Access controls and authentication.
• Encryption in transit, where supported and appropriate.
• Secure infrastructure and hosting arrangements.
• Monitoring and logging for security purposes.
• Limiting access to personal data to authorised personnel who need it for legitimate operational purposes.
• Reviewing relevant service providers and their security arrangements.

No system or method of transmission over the internet can be guaranteed to be completely secure. We therefore cannot promise absolute security.

11. Your data protection rights

Subject to the conditions and limitations established by the GDPR, you may have the right to:

• Access your personal data.
• Rectify inaccurate or incomplete personal data.
• Erase personal data in certain circumstances.
• Restrict processing in certain circumstances.
• Object to processing based on legitimate interests.
• Data portability, where applicable.
• Withdraw consent, where processing is based on consent.

You may exercise your rights by contacting us at:

privacy@ubex.ai

We may request information necessary to verify your identity before responding to a request.

You also have the right to lodge a complaint with a competent data protection supervisory authority. In Spain, the supervisory authority is the Agencia Española de Protección de Datos (AEPD).

Website: https://www.aepd.es/

12. Cookies and similar technologies

Our websites may use cookies and similar technologies to support essential website functionality, remember preferences, understand website usage and, where applicable, support analytics or other optional features.

Where consent is legally required, non-essential cookies or similar technologies will only be used after the appropriate consent has been obtained.

You can manage your preferences through the cookie consent mechanism made available on our website and, where applicable, through your browser settings.

Further information about the cookies and similar technologies we use, their purposes, providers and retention periods is provided in our separate Cookie Policy.

13. Children's privacy

The Services are not intended for children under the age of 16 unless applicable law permits their use with appropriate authorisation.

We do not knowingly collect personal data from children in circumstances where such collection is prohibited by applicable law.

If you believe that a child has provided personal data to us inappropriately, please contact us at privacy@ubex.ai so that we can review the matter.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our Services, technology, providers, business practices or legal requirements.

When we make material changes, we will take appropriate steps to inform users, where required by law.

The latest version will be made available on our website with its effective date.

15. Contact

For questions about this Privacy Policy or how we process personal data, please contact:

TechVision Mallorca SL

CIF: B72772940

Marratxí, Mallorca, Spain

Email: privacy@ubex.ai

Document history