Privacy Policy

Last updated: July 12, 2026

1. Data Controller

The AV Index acts as the Data Controller for this service, based in Spain. For privacy requests, rights exercises, or complaints, you can contact us at privacy@theavindex.com.

• Controller: The AV Index
• Country: Spain
• Privacy Contact: privacy@theavindex.com
• Legal Contact: hello@theavindex.com

If a formal postal notice is required, contact us first by email and we will provide the appropriate correspondence address.

2. Why We Process Data (Legal Bases)

We process personal data only for clear service-related purposes:

• Contract Performance: To provide the services you request, including account access, rankings, bookmarks, and saved insights.
• Consent: For optional analytics cookies and newsletters, which you can withdraw at any time.
• Legitimate Interests: To prevent abuse, maintain security, troubleshoot incidents, and improve reliability.
• Legal Obligations: To comply with applicable accounting, tax, and legal requirements.

3. Information We Collect

We believe in strict data minimization. We only collect the following personal information:

• Email Address: Used strictly for account identification, transactional emails, and password resets.
• Name: Used to personalize your experience.
• Authentication Credentials: Passwords are cryptographically hashed. If you use Google OAuth, we only receive identity claims needed for authentication (such as email and provider account ID). We do not store provider access or refresh tokens.

4. How We Use Your Information

Your personal data is used exclusively to:

• Create and maintain your account.
• Track your usage limits and service access.
• Save your personal bookmarks and industry insights.

We do not sell, rent, or trade your personal data with third parties.

5. Data Retention

We retain your personal data only for as long as your account is active or as needed to provide you with the services. If you delete your account, your personal data is purged from our active databases immediately. Backups may persist for up to 30 days but are inaccessible for regular processing.

6. Third-Party Processors

We use trusted partners with appropriate data protection standards to handle specific technical tasks:

• Neon & Supabase: Secure database hosting.
• Render & Vercel: Secure application hosting and delivery.
• Resend: Transactional and newsletter email delivery.

7. International Data Transfers

Some processors we use operate outside the European Economic Area (including in the United States). Where this occurs, we apply appropriate safeguards such as the European Commission Standard Contractual Clauses (SCCs) and, when available, reliance on adequacy mechanisms such as the EU-U.S. Data Privacy Framework.

8. Use of Cookies

We use necessary session cookies for authentication. Non-essential analytical cookies are only used if you explicitly click “Accept All” on our consent banner. You can manage your preferences at any time.

9. Your Data Rights

Depending on your location, you may have the following data rights:

• Access: View and export your data from your Dashboard.
• Deletion: Delete your account instantly in Settings → Danger Zone.
• Correction: Update your profile information at any time.
• Restriction / Objection / Portability: Request restricted processing, object to certain processing, or request portable copies where applicable.
• Questions or Complaints: Contact us if you believe we are not handling your data correctly. If you are in Spain, you may also contact the Agencia Espanola de Proteccion de Datos (AEPD).

10. Changes to This Policy

Material changes to this policy will be notified via email or a prominent notice on our platform.