1. DATA CONTROLLER
The data controller for the data collected through this website is Jose Gutierrez (Digixop), with tax identification number ES30563749S and registered address at Garaizar 2 – 48004 Bilbao (Bizkaia). Email: jose.g@digixop.com.
Important note for Clients: In the case of the installation of Xabia AI software on Client servers, the Client acts as the Data Controller of its end users’ data, and Digixop acts only as the technology provider.
2. PHILOSOPHY: PRIVACY BY DESIGN AND DATA SOVEREIGNTY
Unlike other AI solutions, Xabia AI has been designed under the principle of total sovereignty :
Local Storage: Knowledge bases (CSV, SQL) and chat histories reside exclusively on the Client’s server.
No Training: Customer data is NOT used to train third-party public AI models.
Anonymization in Transit: During the query, Xabia sends anonymized data fragments (tokens) to the AI API (OpenAI/Google) to generate the response, but never sends information that personally identifies the end user without express consent.
3. PURPOSE OF THE TREATMENT
Personal data that may be collected directly from the user (name, email in contact forms) will be processed for:
Manage the purchase of licenses and setup services.
Provide technical assistance and maintenance services.
Send commercial communications about software updates (only if authorized).
4. LEGITIMACY
The legal basis for processing your data is the execution of the license agreement and, in the case of commercial communications, the explicit consent of the interested party.
5. DATA RETENTION
The personal data provided will be kept for as long as the business relationship is maintained or for the years necessary to comply with legal obligations (tax and accounting).
6. RECIPIENTS AND INTERNATIONAL TRANSFERS
No data will be shared with third parties, except where legally required. However, for the AI to function, the software makes technical calls to LLM providers (such as OpenAI or Google Cloud). These calls are protected by the privacy agreements of these platforms for enterprise environments (Enterprise APIs), which guarantee that the data will not be used for purposes other than generating the response.
7. USER RIGHTS
Everyone has the right to obtain confirmation as to whether we are processing their data. Those concerned have the right to:
Access your personal data.
Request the correction of inaccurate data.
Request deletion when, among other reasons, the data is no longer necessary.
You have the right to object to or request the restriction of processing of your personal data. To exercise these rights, you can send an email to clientes@digixop.com attaching a copy of your ID.
Bilbao, February 21, 2026
