Privacy Policy
Last updated: 30 October 2026
This policy explains how Mazinger Ventures, S.L. processes personal data on spen.ai and in the Spen service, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Controller
- Controller: Mazinger Ventures, S.L., Tax ID B55061451, Avinguda de Perpinyà, 31, 17600 Figueres (Girona), Spain.
- Privacy contact: privacy@spen.ai
2. Our role depending on who you are
- Website visitors, individual Customers (Consumers) and business contacts: Mazinger is the controller.
- Users of a Business Customer: the Business Customer (your employer or organization) is the controller of the Content Spen processes, and Mazinger acts as processor on its instructions and under the Data Processing Agreement. To exercise your rights over that Content, contact your organization; we will help if asked. Mazinger remains the controller of your account, billing and security data.
- Private cloud and self-hosted: data is processed on the Customer's infrastructure. Mazinger only accesses it if the Customer authorizes it (for example, for support).
3. What data we process, why, and for how long
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Answering enquiries and demo requests | Email, name, company, message | Pre-contractual steps at your request and legitimate interest in responding | Until the enquiry is resolved plus 12 months |
| Creating and managing your account | Name, email, phone number and Channel handle, company, job title, language, time zone | Performance of contract | While the account is active |
| Providing the service | Content from the Integrations you connect (emails, events, contacts, documents, CRM records, invoices, transcripts), messages and voice notes you send, Routines and preferences, Spen's context memory | Performance of contract | While the account is active; deleted within 30 days of closure, except backups, deleted within 35 days |
| Processing third-party data within your Content (senders, meeting attendees, contacts) | Name, email, job title, company, communication content, public professional information | Legitimate interest of the User and Mazinger in delivering the requested feature | Same as Content |
| Billing and legal obligations | Tax details, payment history | Legal obligation | 6 years (Spanish Commercial Code) and tax limitation periods |
| Security, abuse prevention and activity logs | IP address, device, access and action logs | Legitimate interest in protecting the service | 12 months |
| Improving Spen | Aggregated or pseudonymized usage metrics (features used, errors, timings). Never the content of your emails or documents | Legitimate interest | 24 months |
| Sending Spen news | Consent or, for customers, Art. 21.2 LSSI-CE | Until you unsubscribe | |
| Cookies and web analytics | See the Cookie Policy | Consent (except technical cookies) | See the Cookie Policy |
Voice notes are automatically transcribed so Spen can understand the request. The audio is kept with your conversations, like any other file you send, until you delete it or close your account.
4. What we do not do
- We do not use your Content or Outputs to train AI models, and we do not allow our model providers to do so.
- We do not sell personal data or use it for advertising.
- No Mazinger staff read your Content unless you expressly authorize it (for example, to resolve an issue), it is necessary for security, or the law requires it.
- Spen does not make decisions based solely on automated processing that produce legal effects on you or similarly significantly affect you (Art. 22 GDPR). Significant actions require your approval or your prior configuration.
5. Google and Microsoft data
Spen's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- We only use data from Gmail, Google Calendar, Google Drive and other Google services to provide and improve Spen features visible to you.
- We only transfer it to third parties where necessary to provide those features (for example, to the AI model providers processing your request), for security, to comply with the law, or in a corporate transaction with prior notice.
- We do not use it for advertising or to train generalized AI models.
- No person reads it except with your express consent, for security or as required by law.
We apply the same commitments to Microsoft 365 data and all other Integrations. You can revoke access at any time from Spen or from the security settings of your Google or Microsoft account.
6. Who we share data with
Only with the providers needed to deliver Spen, under data processing agreements, and with authorities where required by law. The current list of sub-processors is in the Annex to the Data Processing Agreement.
| Category | Function | Location |
|---|---|---|
| Infrastructure and hosting | Data and application hosting | European Union |
| AI model providers (currently including Anthropic, OpenAI, Google, MiniMax and open models hosted by Mazinger) | Processing requests and generating Outputs | US, China and EU, depending on the model |
| Integration connectivity | Connecting the tools you authorize | US |
| Speech-to-text | Converting voice notes to text | European Union (our own infrastructure) |
| Messaging Channels (Meta/WhatsApp, Slack, Microsoft, Telegram, SMS carrier) | Communicating with you | Depends on the provider |
| Payments, transactional email and support | Billing, notifications and customer support | EU and US |
We use several model providers and may change them to deliver the best results. Before adding a new one we update the list and notify Business Customers under the Data Processing Agreement.
When you connect an Integration, Spen sends or updates information in that service on your instructions; that third party processes the data under its own policy.
7. International transfers
Some providers, particularly AI model providers, are located outside the European Economic Area. In those cases transfers rely on an adequacy decision (such as the EU-US Data Privacy Framework for certified providers) or on the European Commission's Standard Contractual Clauses, with supplementary measures where needed. Data is stored in the EU; model processing may take place outside it. You may request a copy of the safeguards at privacy@spen.ai.
Business Customers may request that their Content be processed only with EU-hosted models, or deploy Spen on their own infrastructure.
8. Security
We apply appropriate technical and organizational measures: encryption in transit and at rest, least-privilege access control, activity logging, customer isolation and incident management. If a breach poses a risk to your rights, we will notify it as required by the GDPR.
9. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw your consent at any time, by writing to privacy@spen.ai and stating the right you are exercising. We will respond within one month.
If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (aepd.es) or the supervisory authority of your country of residence.
10. Minors
Spen is not intended for anyone under 18. If we detect that a minor has registered, we will delete the account.
11. Changes
We may update this policy. For material changes we will notify you by email or within Spen before they take effect and, where they affect the use of Google data, ask for your consent again where required.