Privacy policy

The controller is [[COMPLETAR: razón social o nombre legal del titular y su número de identificación]], which operates Avilumen under the Xentris Tech brand. Address: [[COMPLETAR: domicilio postal y país del titular]].

For any privacy matter, write to [[COMPLETAR: correo de contacto legal, p. ej. privacidad@xentris.tech]]. We reply within 30 days at most.

We only process the data each feature needs:

• Browsing: when any page loads, our hosting provider (Vercel) receives your IP address, browser and operating system, the requested page and the date. This is used to serve the page, prevent abuse and diagnose errors. We currently use no analytics or advertising tools.
• Species images: photographs load from Wikimedia Commons (upload.wikimedia.org), so Wikimedia receives your IP when showing them, under its own privacy policy.
• Search: the text you type in the search box is sent to OpenAI to turn it into a vector and find similar species. Do not type personal data into the search box. We do not store your searches linked to you.
• Purchases: payment is processed by Stripe. We never see or store your card number. Stripe passes us, and we store, your email address, the product bought, the amount, currency, language, payment identifiers and order status, plus the download link and its expiry. Stripe may also ask for your billing name and country.
• AI avatar: if you buy an avatar and the service asks you for a photo of your face, we will use it only to create that avatar. We will not use it to identify you or to train models, and we will delete it no later than 30 days after delivering the result.
• Communications: if you write to us, we process your address and the message content to reply.

We process your data for these purposes and on these legal bases (Article 6 GDPR and equivalent laws):

• Delivering the product you buy and supporting you: performance of a contract.
• Keeping the sales records required by tax and accounting laws: legal obligation.
• Keeping the site secure and working, and preventing fraud: legitimate interest.
• Measurement or advertising cookies or pixels, if we ever use them: your consent, which you can withdraw at any time.

We do not sell your personal data or share it for anything of value. These providers process it on our behalf under contracts that require them to protect it:

• Vercel Inc. (United States): hosting and delivery of the site.
• Supabase Inc. (United States): database where orders are stored.
• Stripe (Stripe Payments Europe Ltd. or Stripe, Inc.): payment processing and fraud prevention. Stripe also acts as an independent controller for its own legal obligations.
• OpenAI, L.L.C. (United States): processing of search text through its API.
• File storage and delivery providers we use to deliver downloads.
• Public authorities, only when a law requires it.

We may advertise Avilumen on Google (Search, Shopping, YouTube), Meta (Facebook and Instagram) and TikTok. When you see or tap one of those ads, or interact with our pages on those platforms, the platform processes your data under its own policy: Google https://policies.google.com/privacy, Meta https://www.facebook.com/privacy/policy, TikTok https://www.tiktok.com/legal/privacy-policy.

Today the site has no pixel or tag from those platforms installed (Meta Pixel, TikTok Pixel, Google Ads, Google Analytics). If we install them to measure campaigns, we will do so only with your prior consent where the law requires it, through a cookie notice, and we will say so in this policy and in the cookie policy.

The catalog data we send to Google Merchant Center is product data (title, price, image) and contains no personal data.

If Avilumen uses the YouTube API Services, for example to show or publish our species videos, by using those features you agree to the YouTube Terms of Service (https://www.youtube.com/t/terms) and the Google Privacy Policy applies (https://policies.google.com/privacy).

If you ever authorize us to access data in your Google or YouTube account, we will use only the data needed for the feature you asked for, will not share it with third parties, and will delete it when you revoke access. You can revoke it at any time at https://security.google.com/settings/security/permissions.

Several providers are in the United States. When your data leaves the European Economic Area, the United Kingdom or another country with similar rules, the transfer relies on the EU-U.S. Data Privacy Framework where the provider is certified, or on the standard contractual clauses approved by the European Commission.

• Orders and billing: the period required by the applicable tax law, usually between 5 and 10 years.
• Download links: expire after 48 hours; the order record is kept as above.
• Avatar photos: no more than 30 days after delivery.
• Hosting technical logs: as long as Vercel keeps them, which is limited.
• Support emails: up to 2 years after the request is closed.

You can ask for access to your data, its correction or deletion, restriction of or objection to processing, portability, and you can withdraw consent at any time. Write to [[COMPLETAR: correo de contacto legal, p. ej. privacidad@xentris.tech]]. We may ask you to confirm that the email address is yours before acting.

If you are not satisfied, you can complain to the data protection authority in your country (for example the ICO in the United Kingdom or your national authority in the EU).

California and other U.S. state residents: we do not sell or share personal information for cross-context behavioral advertising. You can exercise your rights to know, correct and delete by writing to us, and you will not be treated differently for doing so.

To delete your data, follow the instructions on the data deletion page: https://avilumen.com/en/data-deletion.

Avilumen is an encyclopedia suitable for all ages, but purchases are intended for adults. We do not knowingly collect data from children under 16. If you believe a child has given us data, write to us and we will delete it.

The whole site runs over HTTPS. The orders table cannot be reached from the browser: only the server can write to it. Payment and database keys never reach your device.

If we change this policy, we will publish the new version here with its effective date. If the change is significant, we will highlight it on the site. Effective from 2026-10-16.