Privacy Policy

1. Data Controller

LuciDario ("we" or "controller") is responsible for processing personal data collected through lucidario.com. For any privacy-related queries, contact us at privacidad@lucidario.com.

2. Data We Collect

We collect only the data necessary for the service to function:

• Account data: email address, username, and password (stored as a bcrypt hash — never in plain text).
• Journal content: dreams you record, including title, description, techniques, tags, and personal scales.
• Tutor history: messages exchanged with the AI assistant in the study area.
• Progress data: explored topics, session count, and study streak.
• Technical data: session token (stored in an HttpOnly cookie, 30-day duration). We do not use tracking or advertising cookies.

3. Purpose and Legal Basis

• Service provision (basis: contract performance, Art. 6.1.b GDPR): managing your account, providing journal and assistant access.
• Scientific dataset improvement (basis: legitimate interest, Art. 6.1.f GDPR): the document dataset is public and not linked to personal data.

We do not use your data for advertising, commercial profiling, or share it with third parties for marketing.

4. Data Processors (Sub-processors)

The assistant uses the Mistral AI API (Mistral AI SAS, Paris, France) as its language model. Processing takes place on European infrastructure. Queries may include dataset fragments and your study session context, but never your name, email, or other identifying data. See their privacy policy at mistral.ai/privacy-policy.

The server is hosted by Contabo GmbH (Munich, Germany), within the European Economic Area.

5. Data Retention

We retain your data while your account is active. If you delete your account, all your personal data (account, journal, tutor history, progress) is permanently and irreversibly deleted within 24 hours. Anonymous podcast comments are not linked to your account and are handled separately.

6. Your Rights (GDPR)

• Access: request a copy of all your data.
• Rectification: correct inaccurate data from your profile.
• Erasure (right to be forgotten): delete your account and all data from the account settings page. Deletion is immediate and permanent.
• Portability: request your data in JSON format by emailing privacidad@lucidario.com.
• Restriction and objection: request processing limitation at any time.

To exercise these rights, email privacidad@lucidario.com. We will respond within 30 days. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD).

7. Security

Passwords are stored with bcrypt (cost factor 10). Communications are encrypted with TLS 1.3. Server access is restricted by SSH key and firewall. We perform regular database backups.

8. Minors

This service is not directed at users under 16. If we detect a minor has created an account, we will delete their data immediately.

9. Changes to This Policy

For material changes, we will notify you by email at least 15 days in advance.