Privacy Policy

1. Data controller

Controller: Trade name: Cabyvox Tax/VAT ID: Address: Privacy email:

2. Data we process

We may process the following categories of data:

• Identification data: name, email address, language, country.
• Account data: username, encrypted password, sign-up date, account status, subscribed plan.
• Billing data: billing address, country, VAT ID, payment history, invoices and data provided to Stripe or another payment provider.
• Service usage data: podcasts, episodes, sections, cards, ideas, references, marks, exports and settings.
• Technical data: IP address, device, browser, security logs and session events.
• Support data: messages, incidents, requests and communications.
• Consent data: terms acceptance, cookie preferences and marketing consent if applicable.

We do not request special categories of personal data. Users should avoid entering unnecessary sensitive data into their content.

3. Purposes

We process data to:

• Create and manage accounts.
• Provide the Cabyvox service.
• Manage subscriptions, payments, billing and taxes.
• Maintain service security.
• Provide support and communications.
• Comply with legal obligations.
• Improve the product through aggregated or consent-based analytics.
• Send marketing communications only where a valid legal basis exists.

4. Legal bases

The legal bases may include:

• Performance of a contract: account, subscription, service provision and support.
• Legal obligation: billing, taxes, accounting and compliance.
• Legitimate interest: security, abuse prevention, operational improvement and essential service communications.
• Consent: non-essential cookies, marketing and certain optional features or communications.

5. Recipients and providers

We may share data with providers necessary to operate the service, such as hosting, transactional email, payments, billing, consent-based analytics, technical support and security tools.

Expected payment provider: Stripe.

These providers will act as processors or independent controllers as applicable and under appropriate contractual safeguards.

6. International transfers

Some providers may be located outside the European Economic Area. In such cases, appropriate GDPR safeguards will be used, such as adequacy decisions, standard contractual clauses or other valid mechanisms.

7. Retention

We will keep data while the account is active and for the periods necessary to comply with legal obligations, resolve disputes, prevent abuse and address liabilities.

Billing data will be retained for applicable legal periods.

User content may be deleted or anonymised after cancellation or account deletion, according to the applicable retention policy and unless legal retention obligations apply.

8. Rights

You may exercise your rights of access, rectification, erasure, objection, restriction, portability and withdrawal of consent by contacting .

You may also lodge a complaint with the competent supervisory authority. In Spain, the authority is the Spanish Data Protection Agency.

9. Security

We apply reasonable technical and organisational measures to protect data, including encryption in transit, access control, authentication, backups, security logs and logical data separation.

10. Children

Cabyvox is not intended for children under 16. If we detect an account created by a child without valid authorisation, we may delete it.

11. International users

Cabyvox uses GDPR and Spanish/European data protection rules as its baseline. Users in other jurisdictions may have additional rights under their local laws. Where applicable, we will handle such requests according to the relevant law.

12. Changes

We may update this policy to reflect legal, technical or functional changes. We will publish the current version and indicate the last updated date.

13. Regional notes

EU/EEA, UK and Swiss users: Cabyvox uses GDPR and equivalent principles as its baseline, including transparency, minimisation, security, data subject rights and safeguards for international transfers.

Users in the Americas: if you live in a jurisdiction with specific privacy rights, you may contact to exercise any applicable rights. In the MVP, Cabyvox does not sell personal data or share personal data for behavioural advertising purposes.

California users: Cabyvox does not initially expect to be subject to CCPA/CPRA thresholds by volume or revenue, but it does not sell personal information and will handle reasonable access, deletion or information requests where applicable.

Users in Brazil, Canada, Latin America, Asia and other regions: Cabyvox will apply a GDPR-equivalent privacy baseline where reasonably possible, without prejudice to mandatory local requirements that may apply.