legal document

Privacy Policy

Last updated: October 24, 2026

# Privacy Policy

**Last updated:** October 24, 2026

## 1. Controller

Antonio Fernández Porrúa, sole trader operating promethia.dev.\
Spanish tax ID (NIF): 71643249C.\
Address: Muros del Nalón 7 5N, 33012 Oviedo, Spain.\
Contact: [support@promethia.dev](mailto:support@promethia.dev).

## 2. What we collect and why

- **API keys for GitHub Actions:** the account owner can create and revoke keys to deliver source versions to the application the key belongs to. We store hash, prefix, name, creation date and last authorized use, never the complete key. Keys do not expire automatically; revocation removes their record. A key can deliver ZIPs but cannot read reports, configure rules or administer the account. GitHub holds the repository secret. The Action records the version identifier, commit and ZIP fingerprint. The rule selected and confirmed by the owner determines whether delivery starts an assessment; delivery does not initiate a charge or confirm that analysis has finished.

- **Accounts and invitations:** Clerk manages identity and sessions. Promethia stores the account identifier, company, stage, milestone, shared questions, terms acceptance and dates to manage the request and service (GDPR art. 6.1.b). Assessment invitations are limited to one assessment; we store their hash, revision and expiry, never the complete secret. The link allows the team to read and update shared context and access the report, but not administer other assessments. The account owner can revoke it. ZIP archives are stored privately with their size, fingerprint and receipt date. The report and its method belong to the same assessment.

- **Contact and contracting:** if you contact us, we use your email, language and the information you provide to respond. When an assessment is purchased, we record its currency and contractual consents to provide the service (GDPR art. 6.1.b). Signing in does not authorize publication.
- **Billing:** Stripe processes payment methods, invoices and billing details. Promethia stores the association between your account and its Stripe Customer, per-application subscriptions, orders and payment confirmations (arts. 6.1.b and 6.1.c). Card details and tax information remain with Stripe. Uploading a ZIP does not authorize extra charges; subscriptions and additional assessments are confirmed in Stripe.
- **Technical logs:** Cloudflare processes IP addresses and request metadata to serve and protect the site (legitimate interest, art. 6.1.f).

- **Certificate verification:** when you upload a PDF to the public validator, we process it temporarily to check its signature, the certified document and its inclusion in the registry. We do not store the file or send it to the AI provider. Exported PDF metadata includes the signed document and its inclusion proof; blocks contain hashes, without documents or actual identifiers from other accounts.

- **Notifications:** the private dashboard stores important delivery, assessment and payment events, their resource identifiers, dates, amounts where applicable and read status. Only the account owner can access them. They do not contain source code, supporting documents or card details and do not send emails.

Optional website review uses only the pages, resources and actions authorized in the dashboard. Private access accepts a test user, temporary link or token, encrypted separately from assessment context, with a maximum 24-hour lifetime and revocation. Maintenance removes expired secrets from the active record; backups follow their separate retention lifecycle; their use is blocked at expiry even if removal is pending. The agent does not receive credentials. With explicit authorization, visible private-page text may contain real data, be processed by the analysis provider and be retained as private evidence; complete anonymization is not guaranteed. Screenshots of private sessions are omitted. Do not include secrets in ZIPs, documents or context.

- **Application members:** For application sharing, we store the invited email address, application and account identifiers, role, invitation creator, dates, status and revision. Invitations expire after seven days and can only be accepted after sign-in with the invited verified email. Owners and administrators manage members. Administrators can also publish or revoke certificates after reviewing the exact document; editors can update context and documents and request assessments; read-only members can consult authorized materials and results. Membership does not grant access to the owner’s account billing. Invitations appear in the recipient’s account; no email is sent automatically.

## 3. Private applications, documents and reports

Context belongs to the application: description, declared data practices, users, markets and documentation. Each assessment keeps the version used, its ZIP, evidence readings and separate reports. Documents can be plain text, Markdown, PDF or DOCX. Removing a document from active context does not remove copies referenced by assessments already started. Contact support for erasure requests.

The history also retains versions that are not assessed. The same retention and erasure policy applies to those ZIPs.

The selected AI provider —OpenAI or Anthropic— processes instructions and the portions of source code, context and documents needed for analysis. Public sources are accessed through a closed catalog; requests do not include private application content. Reports remain private. The owner may publish a signed certificate containing the dated findings only after reviewing its content and confirming publication. Source code and supporting materials remain private.

## 4. Cookies

Promethia sets the first-party functional cookie, `promethia_lang`, to remember your language for one year. Account access also uses the necessary authentication cookies managed by Clerk to maintain and verify the session. See [Clerk’s cookie documentation](https://clerk.com/docs/guides/how-clerk-works/cookies). No analytics or advertising scripts load with the page.

The functional cookie `promethia_application` remembers the last application opened in your private workspace for one year. It contains only its identifier; access is checked against your account on each request.

## 5. Processors

We use **Clerk** for account identity and sign-in, **Cloudflare** for hosting, D1 structured storage and private R2 object storage, **OpenAI or Anthropic** for AI-assisted analysis, and **Stripe** for billing where configured. Some processing may occur outside the EEA under an applicable transfer mechanism. We do not sell personal data.

## 6. Retention

Assessments requested through your account and their private files are reviewed for deletion no later than 12 months after their last activity, unless a legal obligation or justified need requires retention. Promethia reviews the retention of these files and handles erasure requests.

## 7. Your rights

You can request access, rectification, erasure, restriction, portability, withdraw consent where applicable, or object to processing by writing to [support@promethia.dev](mailto:support@promethia.dev). You may also complain to the Spanish Data Protection Agency ([aepd.es](https://www.aepd.es)) or your local supervisory authority.

1. Controller

Antonio Fernández Porrúa, sole trader operating promethia.dev.
Spanish tax ID (NIF): 71643249C.
Address: Muros del Nalón 7 5N, 33012 Oviedo, Spain.
Contact: support@promethia.dev.

2. What we collect and why

API keys for GitHub Actions: the account owner can create and revoke keys to deliver source versions to the application the key belongs to. We store hash, prefix, name, creation date and last authorized use, never the complete key. Keys do not expire automatically; revocation removes their record. A key can deliver ZIPs but cannot read reports, configure rules or administer the account. GitHub holds the repository secret. The Action records the version identifier, commit and ZIP fingerprint. The rule selected and confirmed by the owner determines whether delivery starts an assessment; delivery does not initiate a charge or confirm that analysis has finished.
Accounts and invitations: Clerk manages identity and sessions. Promethia stores the account identifier, company, stage, milestone, shared questions, terms acceptance and dates to manage the request and service (GDPR art. 6.1.b). Assessment invitations are limited to one assessment; we store their hash, revision and expiry, never the complete secret. The link allows the team to read and update shared context and access the report, but not administer other assessments. The account owner can revoke it. ZIP archives are stored privately with their size, fingerprint and receipt date. The report and its method belong to the same assessment.
Contact and contracting: if you contact us, we use your email, language and the information you provide to respond. When an assessment is purchased, we record its currency and contractual consents to provide the service (GDPR art. 6.1.b). Signing in does not authorize publication.
Billing: Stripe processes payment methods, invoices and billing details. Promethia stores the association between your account and its Stripe Customer, per-application subscriptions, orders and payment confirmations (arts. 6.1.b and 6.1.c). Card details and tax information remain with Stripe. Uploading a ZIP does not authorize extra charges; subscriptions and additional assessments are confirmed in Stripe.
Technical logs: Cloudflare processes IP addresses and request metadata to serve and protect the site (legitimate interest, art. 6.1.f).
Certificate verification: when you upload a PDF to the public validator, we process it temporarily to check its signature, the certified document and its inclusion in the registry. We do not store the file or send it to the AI provider. Exported PDF metadata includes the signed document and its inclusion proof; blocks contain hashes, without documents or actual identifiers from other accounts.
Notifications: the private dashboard stores important delivery, assessment and payment events, their resource identifiers, dates, amounts where applicable and read status. Only the account owner can access them. They do not contain source code, supporting documents or card details and do not send emails.

Application members: For application sharing, we store the invited email address, application and account identifiers, role, invitation creator, dates, status and revision. Invitations expire after seven days and can only be accepted after sign-in with the invited verified email. Owners and administrators manage members. Administrators can also publish or revoke certificates after reviewing the exact document; editors can update context and documents and request assessments; read-only members can consult authorized materials and results. Membership does not grant access to the owner’s account billing. Invitations appear in the recipient’s account; no email is sent automatically.

3. Private applications, documents and reports

The history also retains versions that are not assessed. The same retention and erasure policy applies to those ZIPs.

4. Cookies

Promethia sets the first-party functional cookie, promethia_lang, to remember your language for one year. Account access also uses the necessary authentication cookies managed by Clerk to maintain and verify the session. See Clerk’s cookie documentation. No analytics or advertising scripts load with the page.

The functional cookie promethia_application remembers the last application opened in your private workspace for one year. It contains only its identifier; access is checked against your account on each request.

5. Processors

We use Clerk for account identity and sign-in, Cloudflare for hosting, D1 structured storage and private R2 object storage, OpenAI or Anthropic for AI-assisted analysis, and Stripe for billing where configured. Some processing may occur outside the EEA under an applicable transfer mechanism. We do not sell personal data.

6. Retention

7. Your rights

You can request access, rectification, erasure, restriction, portability, withdraw consent where applicable, or object to processing by writing to support@promethia.dev. You may also complain to the Spanish Data Protection Agency (aepd.es) or your local supervisory authority.