Privacy Policy

In compliance with GDPR, we inform about the processing of personal data collected through this platform.

Data Controller

Overthings, S.L. (VAT B57925703), registered address: Pl. Alexandre Jaume 3, 2, 07002, Palma de Mallorca, Balearic Islands, Spain.

Types of Data

We collect identification data (name, email), employment data (role, company), and platform usage data. The user guarantees that the data provided is true, accurate, complete, and up to date.

Purposes

Manage registration and access, provide the HR software service, billing and customer support, and service-related communications.

Lawful Basis

Contract performance (Art. 6.1.b GDPR), legal obligations (Art. 6.1.c GDPR), and legitimate interest (Art. 6.1.f GDPR). For marketing communications, your consent (Art. 6.1.a GDPR).

Retention

Data is retained while the contractual relationship exists and for the legally required periods.

Recipients

Your data may be shared with technology service providers (data processors) necessary for the provision of the service (e.g., hosting, payment processing). Data will not be shared with third parties unless required by law.

International Transfers

Some providers may be located outside the EEA. In such cases, we ensure transfers are made with appropriate safeguards (e.g., Standard Contractual Clauses approved by the European Commission).

Google user data (Google Calendar and Google Drive)

If you connect your Google account, Zindra only accesses what you authorize on Google's consent screen. Google Calendar: we read and write events to show them in your Zindra calendar and to create or move the meetings you schedule. Google Drive (read-only): when you ask a Zindra agent in a conversation, the agent searches your Drive and reads the files it needs to answer you; it never does so when someone else asks. To generate the answer, the necessary content is sent to our AI provider (Anthropic, via Vercel AI Gateway) solely for that purpose and is not used to train models. We do not sell this data, use it for advertising or share it with third parties except as described, and no one at Zindra reads it unless you ask us for support, for security, or as required by law. We store the access token in our database, encrypted at rest and inaccessible to other users. "Disconnect Drive" stops agents from reading your Drive; disconnecting Google deletes the token and the copy of your events immediately. You can also revoke access at any time at myaccount.google.com/permissions. Zindra's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Data Security

We implement appropriate technical and organizational security measures to protect your data against unauthorized access, loss, or alteration.

Cookie Policy

For more information on the use of cookies and tracking technologies, please refer to our Cookie Policy.

User Rights

You have the right to access, rectify, and delete your data, as well as to restrict or object to its processing and to request portability. You can exercise these rights by writing to the controller's address. You also have the right to lodge a complaint with the AEPD (www.aepd.es).

Contact & DPO

For any questions regarding data protection, you can contact us at the indicated address or via our support email.