Legal

Privacy policy

Last updated: 4 November 2026

This policy explains how ExoHuman processes personal data on this website and in ExoHuman Cloud. For data your organisation stores in its instance, your organisation is the controller and we act as processor.

Data we collect

• Account data: name, work e-mail, company and a salted hash of your password.
• Billing data: billing address, tax ID and payment details, collected and stored by our payment provider. We only store a customer reference.
• Instance configuration: chosen address, region, plan and compute profiles.
• Usage data: compute minutes and storage per profile, used for billing.
• Enquiries: what you send through contact and enterprise enquiry forms.
• Technical data: IP address and request logs, kept for security and rate limiting.

Why we use it

• To provide and bill the Service (performance of contract).
• To answer enquiries and prepare enterprise proposals (pre-contractual steps).
• To secure the Service and prevent abuse (legitimate interest).
• To meet tax and accounting obligations (legal obligation).

Customer data in your instance

Content your agents process stays in your dedicated instance in the region you chose. We access it only to operate and support the Service, under a data processing agreement. We do not sell it and do not use it to train models.

Processors

We use infrastructure providers in your selected region, a payment provider, an e-mail provider and, if you enable it, the managed model gateway. Model providers you connect with your own keys are your processors.

Cookies

This website uses a single strictly necessary cookie to keep you signed in. We do not use advertising or analytics cookies.

Retention

Account and billing records are kept for the duration of the contract and as required by tax law. Instance data is deleted within 30 days of cancellation. Enquiries are kept for up to 24 months.

Your rights

You can request access, correction, deletion, restriction, portability or object to processing by writing to [email protected]. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) or your local authority.