HMIx.tech is owned and operated by Sergio Fernández Blanco, with registered address at El Cañaveral, Madrid, Spain, 28052. As the data controller, we are responsible for the processing of your personal data in accordance with:

• The General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679 of the European Parliament and of the Council.
• The Spanish Organic Law 3/2018 on the Protection of Personal Data and guarantee of digital rights (LOPDGDD).
• The ePrivacy Directive (Directive 2002/58/EC) regarding electronic communications.
• Any other applicable data protection legislation within the European Union and the Kingdom of Spain.

We are committed to ensuring that your personal information is protected, used lawfully, and handled transparently. This Privacy Policy describes what data we collect, how we use it, with whom we share it, and what rights you have.

We collect the following categories of personal data depending on how you interact with HMIx.tech:

a) Account Registration Data:

• Full name (first and last name).
• Valid email address.
• Password (stored in encrypted/hashed form).
• Profile information you voluntarily provide (avatar, bio, company).

b) Transaction and Billing Data:

• Billing address, payment method details (processed securely through our payment providers).
• Purchase history, order confirmations, and download records.

c) AI Generator Data:

• Prompts, descriptions, and input parameters you provide to the HMIx AI Generator.
• Generated output metadata (type, configuration, timestamps).
• Credit usage and balance information.

d) Marketplace Interaction Data:

• Product reviews and ratings you submit.
• Questions asked to sellers and responses received.
• Store creation and management data (if you are a seller).
• Wishlist and browsing preferences.

e) Technical and Device Data:

• IP address, browser type and version, operating system.
• Device identifiers, screen resolution, and language preferences.
• Pages visited, time spent, click patterns, and referral sources (via analytics tools).

We process your personal data based on the following legal grounds under Article 6 of the GDPR:

• Contract Performance (Art. 6(1)(b)): Processing necessary to provide our services, including account management, order processing, AI generation, credit management, and resource delivery.
• Legitimate Interest (Art. 6(1)(f)): Processing for platform security, fraud prevention, service improvement, internal analytics, and marketing (where not overridden by your rights).
• Consent (Art. 6(1)(a)): Processing based on your explicit consent, such as marketing communications, non-essential cookies, and the publication of AI-generated content.
• Legal Obligation (Art. 6(1)(c)): Processing required to comply with applicable laws, such as tax regulations, accounting requirements, and legal proceedings.

Your personal data is processed for the following purposes:

• Service Delivery: To provide and maintain the HMIx platform, process registrations, authenticate users, manage accounts, and deliver purchased or downloaded resources.
• AI Generator: To process your prompts through our AI engine (powered by third-party APIs), generate Custom Web Controls and Dynamic SVGs, manage your credit balance (which resets automatically every 6 hours), and deliver the generated output.
• Marketplace Operations: To facilitate transactions between buyers and sellers, process payments, manage stores, handle reviews and questions, and ensure marketplace integrity.
• Communications: To send transactional emails (order confirmations, download links, account notifications), and — with your consent — promotional communications about new features, products, or updates.
• Analytics and Improvement: To analyze usage patterns, optimize platform performance, improve the AI generator's capabilities, and develop new features based on aggregated, anonymized data.
• Legal Compliance: To comply with applicable laws, respond to legal requests, prevent fraud, and enforce our Terms of Use.

HMIx.tech uses cookies and similar tracking technologies. These include:

a) Essential Cookies: Strictly necessary for the operation of the website (authentication sessions, shopping cart, language preferences, security tokens). These cannot be disabled.

b) Analytics Cookies: We use Google Analytics to collect anonymized data about how visitors interact with our platform. This includes page views, session duration, bounce rates, geographic location (country/city level), and traffic sources. Google Analytics may set cookies such as _ga, _gid, and _gat. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

c) Performance Cookies: Used to monitor site performance, identify errors, and optimize loading times.

You can manage your cookie preferences at any time through your browser settings. Please note that disabling essential cookies may prevent you from using certain features of the platform.

To deliver the HMIx AI Generator service, we transmit your prompts and input parameters to third-party AI model providers. Currently, we use:

• OpenAI API — for generating Custom Web Controls and related code.
• Google Gemini API — for generating Dynamic SVGs and related visualization components.

When transmitting data to these providers, we take the following measures:

• We do not send your personally identifiable information (name, email, etc.) to AI providers. Only the prompt content, configuration parameters, and necessary technical context are transmitted.
• We anonymize and minimize the data shared to the extent technically feasible.
• We rely on the data processing agreements (DPAs) and privacy policies of these providers regarding their handling of input data.

Important: Please be aware that the AI providers may retain and process input data according to their own privacy policies. We strongly encourage you to review the privacy policies of OpenAI and Google. If you do not agree with the data processing practices of these third-party AI services, we respectfully urge you not to use the HMIx AI Generator.

Beyond the AI sub-processors described above, we may share your personal data with the following categories of third parties:

• Payment Processors: To process transactions securely (e.g., Stripe). Payment data is handled directly by the payment processor and is subject to their privacy policy and PCI DSS compliance standards.
• Hosting and Infrastructure Providers: Cloud hosting services that store and process your data on our behalf, under appropriate data processing agreements.
• Email Service Providers: To send transactional and promotional emails on our behalf.
• Analytics Providers: Google Analytics, as described in Section 5.
• Legal and Regulatory Authorities: When required by law, regulation, or legal process (e.g., court orders, subpoenas).

We do not sell, rent, or trade your personal data to any third party for their own marketing purposes.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit (TLS/SSL) and at rest where applicable.
• Secure password hashing and storage.
• Access controls and role-based permissions for internal personnel.
• Regular security reviews and vulnerability assessments.
• Secure hosting infrastructure with redundancy and backup systems.

While we strive to protect your personal data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security but commit to taking all commercially reasonable steps to safeguard your information.

We retain your personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable law:

• Account Data: Retained for the duration of your account's existence. If you request account deletion, your personal data will be erased within 30 days, except where retention is required by law.
• Transaction Records: Retained for a minimum of 5 years as required by Spanish tax and commercial regulations.
• AI Generation Data: Prompt data and generation logs may be retained for up to 12 months for quality assurance, platform improvement, and abuse prevention purposes.
• Analytics Data: Aggregated and anonymized analytics data may be retained indefinitely as it does not constitute personal data.
• Communication Records: Emails and support requests are retained for up to 3 years after the last interaction.

Under the General Data Protection Regulation, you have the following rights regarding your personal data:

• Right of Access (Art. 15): You have the right to obtain confirmation as to whether personal data concerning you is being processed and, if so, to access said data along with information about the purposes, categories, and recipients of processing.
• Right to Rectification (Art. 16): You have the right to request the correction of inaccurate personal data and the completion of incomplete data.
• Right to Erasure / Right to be Forgotten (Art. 17): You have the right to request the deletion of your personal data when it is no longer necessary for the purposes for which it was collected, when you withdraw your consent, or when the data has been unlawfully processed. Users may exercise this right and request the complete deletion of their data from HMIx at any time.
• Right to Restriction of Processing (Art. 18): You have the right to request the restriction of processing of your personal data under certain circumstances.
• Right to Data Portability (Art. 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller.
• Right to Object (Art. 21): You have the right to object to the processing of your personal data based on legitimate interests, including profiling. You also have the right to object to processing for direct marketing purposes at any time.
• Right Not to Be Subject to Automated Decisions (Art. 22): You have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects or similarly significantly affects you.

To exercise any of these rights, please contact us at contact@hmix.tech or by phone at +34 609 180 622. We will respond to your request within 30 days. If your request is complex, we may extend this period by an additional 60 days, notifying you accordingly.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es if you believe your rights have been violated.

The HMIx platform uses automated logic in the following areas:

• AI Content Generation: The AI Generator uses machine learning models to produce Custom Web Controls and Dynamic SVGs based on your input prompts. This is an automated process and the output is generated without human intervention.
• Credit System: The deduction and restoration of AI credits is fully automated. Credits are consumed upon generation requests and are automatically restored every 6 hours.
• Content Moderation: Certain automated filters may be applied to detect spam, abuse, or inappropriate content in reviews, questions, and published resources.

If you believe there has been an error in any automated transaction, credit deduction, or content moderation decision, you have the right to request a human review of the decision by contacting us at contact@hmix.tech.

HMIx.tech is not directed at individuals under the age of 16 (or the applicable minimum age in your jurisdiction). We do not knowingly collect personal data from children. If we become aware that a child under the applicable age has provided us with personal data without verified parental consent, we will take steps to delete such data as promptly as possible. If you believe that a child has provided us with personal data, please contact us at contact@hmix.tech.

Your personal data may be transferred to, stored in, and processed in countries outside of the European Economic Area (EEA), particularly in connection with the use of third-party AI services (e.g., OpenAI in the United States, Google Cloud services). When such transfers occur, we ensure that appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Adequacy decisions by the European Commission for the destination country.
• The EU-U.S. Data Privacy Framework, where applicable.

These safeguards ensure that your personal data receives an equivalent level of protection as it would within the EEA.

We reserve the right to update or modify this Privacy Policy at any time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you via email or through a prominent notice on our platform. Your continued use of HMIx.tech after any changes to this Privacy Policy constitutes your acceptance of the revised terms. We encourage you to review this page periodically to stay informed about how we protect your data.

If you have any questions, concerns, or requests regarding this Privacy Policy, your personal data, or the exercise of your rights, please contact us through any of the following channels:

• Email: contact@hmix.tech
• Phone: +34 609 180 622
• Postal Address: Sergio Fernández Blanco, El Cañaveral, Madrid, Spain, 28052

For complaints regarding data protection, you may also contact the Spanish Data Protection Agency (Agencia Española de Protección de Datos — AEPD) at www.aepd.es.