1. Data Controller

The data controller responsible for the processing of personal data collected through the Engrammer website and online service (https://engrammer.eu) is:

• Name: Instituto de Física de Cantabria (CSIC)
• Registered address: Edificio Juán Jordá, Avda. de los Castros s/n
• Contact email: drodrig@ifca.es
• Data Protection Officer: delegadoprotecciondatos@csic.es

2. Personal Data We Collect

Engrammer only collects the data strictly necessary to provide its artificial intelligence-based services:

3. Legal Basis for Data Processing

Due to the nature and purpose of collecting the different categories of personal data listed above, different legal bases apply to the lawful processing of each category. In all cases, these are the legal bases set out in Article 6(1) of the GDPR. The following are the legal bases used and the categories of personal data to which each one applies:

• Processing necessary for the performance of a contract: The collection of your account data, usage data, and interaction history is necessary to perform the Terms of Service and provide you with the functionalities of Engrammer applications. Included categories: “Registration/account data”, “Usage and learning data”, and “Data from interactions with AI models and processed data”.
• User Consent: For sending newsletters, product updates, or marketing communications, as well as for enabling non-essential (analytical) cookies and conducting studies on the use of the service using demographic data.
• Legitimate Interest: To ensure network and information security, prevent fraudulent or abusive activities, and technically improve the operation of the platform. Category: “Technical and browsing data”.

4. Use of Artificial Intelligence Models

Engrammer integrates artificial intelligence models to provide its functionalities, both for storing and interacting with personal memories (RECUERDA) and for supporting learning in different subjects and providing an interactive educational environment (APRENDE).

Engrammer does not sell or commercially exploit your interactions or personal data to third parties for the training of public models or for any other purpose.

5. Data Retention

Your data will be retained for as long as you maintain an active account with Engrammer.

During the development period of the platform, your data, including your account, may be deleted due to service requirements without prior notice.

Account cancellation: following a cancellation request, your data will be deleted or anonymized within a maximum period of 30 days, except for data that must be retained and blocked to address legal liabilities, for a maximum period of 5 years as legally required.

6. Recipients and International Data Transfers

Engrammer does not sell or disclose personal data to third parties for commercial purposes.

We only share data with key service providers (data processors) for hosting and cloud infrastructure.

7. User Rights (GDPR)

Under the GDPR, you have the following rights regarding your personal data:

• Access: Request access to the personal data we hold about you.
• Rectification: Request the correction of inaccurate or incomplete data.
• Erasure ("Right to be forgotten"): Request the permanent deletion of your data when it is no longer necessary for the purposes for which it was collected.
• Restriction of processing: Request the restriction of processing under certain circumstances.
• Data portability: Receive your data in a structured, commonly used, and machine-readable format (for example, JSON or CSV).
• Objection: Object to processing based on legitimate interest or direct marketing.
• Withdrawal of consent: Withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

8. Changes to the Privacy Policy

Engrammer reserves the right to modify this policy to reflect changes in legislation or case law. Any significant changes will be notified to registered users by email or through a prominent notice on the platform at least 15 days in advance.