Privacy Policy
Last updated: 27 October 2026
What we collect
Only what is strictly needed to run your Dekimu account: email, your password (securely hashed — we never see the plain value), display name, language, timezone, and a short audit log of security events (sign-ins, password changes, session revocations).
What we do not collect
No advertising identifiers, no tracking cookies, no third-party analytics, no device fingerprinting. The only cookie we set is a strictly-necessary session cookie required to keep you signed in.
Where it lives
Data is stored on EU-region infrastructure. Our third-party processors are: Vercel (hosting, EU region), Upstash (Redis identity database, EU region), Resend (transactional email delivery), and Stripe (payment processing). No data is sold or shared for marketing purposes.
Waitlist (closed)
Until October 2026, the sign-in page offered a waitlist for when registration opened, and buyers whose tax ID was registered outside Spain were offered a separate waitlist. If you joined, we hold your email address, which of the two lists you joined, and when. We also hold a country: for the outside-Spain list, the country your tax ID is registered in, where our checkout recognised it; otherwise, where recorded, an approximate country derived from your connection. If you confirmed your sign-up by email, we also hold when you confirmed, the version and language of the consent wording you accepted, a company-size range if you chose to give one, and a random token that makes your unsubscribe link work; a sign-up that is not confirmed is deleted automatically after 48 hours. Where a sign-up was taken without email confirmation, we hold the address until deletion, and which list and when for 30 days. If you unsubscribed, we keep a marker for 30 days so we do not email you again. If we send you the one email described below, we keep a record that it was sent, keyed by a one-way hash of your address. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by writing to legal@dekimu.com or with the unsubscribe link in our email; withdrawal does not affect processing carried out before it. These records are stored with Upstash and the emails are sent through Resend (see Where it lives). Neither list accepts sign-ups any longer. We may send one email to each address that confirmed its sign-up on the sign-in page, telling it that registration is open, and we will delete all of these records by 30 November 2026.
Your rights (GDPR)
Under the GDPR (Regulation (EU) 2016/679) and Spanish Organic Law 3/2018 (LOPDGDD), you may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing, and portability over your personal data. You can request export or deletion of your account at any time from the Privacy Center, or by emailing legal@dekimu.com. Deletion is permanent and cascades across all Dekimu apps. You may also lodge a complaint with a supervisory authority.
Changes to this policy
Material changes are announced in-app and by email before they take effect. The "Last updated" date at the top of this page always reflects the current version.
Inactive accounts
Accounts with no login activity for 24 months and no active paid plan are deleted automatically after a 30-day email warning. You can keep your account by signing in once during the warning period. Deleted account data is removed across the entire Dekimu ecosystem. After deletion, a minimal audit record (including your account email address) is retained for 90 days on a legitimate-interest basis for abuse investigation, then permanently erased.
Governing law
This policy is governed by the laws of Spain. You may lodge a complaint with the Agencia Española de Protección de Datos (AEPD) or the supervisory authority of your habitual residence.
Contact
Dekimu Labs, S.L. · CIF B55431357 — identificación completa en el Aviso Legal.
Back to sign in · See also Terms of Service · Legal Notice