Courtesy translation. The Spanish version of these documents is the only legally binding one: if the two differ, the Spanish text prevails. Read the Spanish version.
Legal
Privacy policy
This is an English translation provided for convenience. The Spanish version is the legally binding one. If the two texts differ, the Spanish text prevails: Política de privacidad.
Última actualización: 21 September 2026
1. Data controller
- Responsable: Braian Axel Barros Miranda
- NIF: 26901445R
- Domicilio: Gran Via de les Corts Catalanes 769, piso 3, 08013 Barcelona
- Contacto: contact@cymatica.es
There is no data protection officer, as one is not mandatory for this activity.
2. What data we process and why
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Anonymous use of the app and enforcement of the daily limits of the free version | Signed technical cookie cymatica_u (counters for the day, no personal identifier), IP address hashed with a daily salt for the per IP cap | Legitimate interest (Art. 6(1)(f)): providing the service and preventing abuse | Cookie: 48 h. IP hash: 24 h |
| User account (Google or email with a code) | Email, name (if Google provides it), account identifier, sign up date, session | Performance of a contract (Art. 6(1)(b)) | While the account exists and for up to 30 days after it is deleted |
| Paid plans and billing | Stripe customer identifier, plan, subscription status, payment history, billing address, tax ID if provided | Performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c): invoicing and tax) | Invoices: 4 years for tax purposes (6 years under Spanish commercial law). Subscription data: while the account exists |
| Progress on The Path, streak, presets in the cloud (Pro) | Levels completed, sessions (date, minutes, type), saved settings | Performance of a contract (Art. 6(1)(b)) | While the account exists; presets 90 days after the plan ends |
| Download of the Ableton device | Date of first download, daily counter | Performance of a contract (Art. 6(1)(b)) | While the account exists |
| Product analytics (PostHog, servers in the EU, cookieless, in memory persistence) | Usage events (app open, audio start, export, pricing view, checkout start and success, meditation session completed, scheduling and unsubscribing of the news email with a pseudonymous identifier), device and browser type, truncated IP | Legitimate interest (Art. 6(1)(f)): improving the service. | 12 months |
| User support and the guarantee | Email and the content of the conversation | Performance of a contract and legitimate interest | 2 years |
| Service emails (changes to the terms, incidents) | Performance of a contract | While the account exists | |
| Commercial emails about Cymatica to people who gave their consent: app news (with no committed frequency), a single email with the Cymatica Pro offer three days after confirming, and delivery of the Pack 528 | Email, sign up language, country, city (optional), date and version of the consent wording, a fingerprint of the IP address used to sign up (salted hash; the IP itself is not stored) and the identifier of the email scheduled in Resend | Consent (Art. 6(1)(a) GDPR and Article 21 LSSI), collected with double opt in: nothing is stored until the link in the email is clicked | Until withdrawal, which deletes the sign up and cancels the scheduled email if it has not gone out yet. An unconfirmed sign up expires on its own after 48 hours and the download permission after 24 |
There is no advertising, no profiling with legal effects, and data is not sold or shared with third parties for commercial purposes. No newsletters are sent without prior consent (Article 21 LSSI). Cymatica does not process special categories of data; the answer to the question at the end of a session is optional and is stored only if the user presses Save.
3. Processors and recipients
| Provider | Service | Where the data sits | Transfer safeguard |
|---|---|---|---|
| Clerk, Inc. | Authentication and account management | United States (an EU region is available; confirm which one is configured) | EU-U.S. Data Privacy Framework (DPF) and Standard Contractual Clauses (SCCs) |
| Stripe Payments Europe, Ltd. / Stripe, Inc. | Payments, invoicing, tax (Stripe Tax), customer portal | Ireland / United States | DPF and SCCs. Stripe acts as an independent controller for fraud prevention |
| Upstash, Inc. | Redis database (counters, progress, presets, cache) | EU region | DPF and SCCs for support from the United States |
| PostHog, Inc. | Product analytics | EU region (eu.i.posthog.com) | DPF and SCCs for support from the United States |
| Resend (Plus Five Five, Inc.) | Sending Cymatica emails (confirmation, Pack 528, news and the scheduled email about Pro, which Resend stores until it is sent) | United States | DPF and SCCs |
| Vercel, Inc. | Hosting, functions and delivery network | EU (functions in a European region) and global delivery network | DPF and SCCs |
| Google LLC | Sign in with Google (only if the user chooses it) | United States | DPF |
Where a provider processes data outside the European Economic Area, the transfer relies on an adequacy decision (DPF) or on Standard Contractual Clauses approved by the European Commission, with supplementary measures where appropriate. Users may request a copy of these safeguards at contact@cymatica.es.
Public authorities may be recipients where the law requires it.
4. Your rights
You can exercise your data subject rights of access, rectification, erasure, objection, restriction of processing and portability by writing to contact@cymatica.es from the email address of your account or attaching proof of identity. You can also delete your account from the Service itself (Account → Delete my account), which erases your data except for what the law requires us to keep (invoices).
You have the right to withdraw your consent to Cymatica emails at any time, with one click on the unsubscribe link at the bottom of each email, by replying to any of them or by writing to contact@cymatica.es. Unsubscribing deletes your sign up at once and cancels any email that was scheduled. Withdrawal does not affect the lawfulness of processing carried out beforehand.
If you consider that the processing does not comply with the law, you can lodge a complaint with the supervisory authority, the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.
5. Minors
The Service is intended for people over 14. Under 14s need authorisation from their guardians.
6. Security
Communications are encrypted (TLS). Session cookies are HttpOnly and Secure. The anonymous counters are signed with HMAC-SHA256 and contain no personal data. Card data never passes through Cymatica's servers: Stripe collects it directly. Data held in Upstash has automatic expiry times.
7. Changes
Any material change will be communicated by email to users with an account and published here with the date of the update.