Informative translation; in case of discrepancy, the Spanish version prevails. Spanish version

Privacy

Carlos Bárez Sánchez (hereinafter, "the data controller") is responsible for the processing of the personal data collected on this Site. You can write to him at c.barezsanchez@gmail.com.

Tax identification number: NIF 70835996K. Address: Calle Sinforiano López 14, 15005 A Coruña (Galicia).

Nature of the project: a free financial research and education project assisted by AI. It is not an investment services company, it is not registered in the CNMV (Spain's securities regulator) registries as a firm, and it charges nothing for using the site or for receiving an answer: it is funded by advertising. See "Advertising".

Last revision date: 2026-09-30.

The summary, before the small print

• Without an account, the conversation is not stored on our servers. The chat history lives in your browser and is deleted when you close the tab. One nuance worth not skipping: the hosting servers automatically record the IP address and the browser when serving each page, and what you write in the chat does travel to the providers that generate the answer. See "The conversation" and "Recipients and processors".
• With an account it is stored, because that is what it is for: your portfolio, your saved notes, your two presentation preferences and the counter of the images you have uploaded to read a portfolio.
• "Personalise your experience" is two optional questions: your level (beginner, intermediate or advanced) and the depth you prefer (brief, standard or technical). They serve above all to adapt the vocabulary and the length with which Elisa explains things to you; the system may deviate, so they are not presented as a guarantee that the result will be identical in all cases. We do not ask you for age, income, assets, objectives or risk tolerance.
• We share data with the providers needed for the functions you use and, where applicable, for advertising. Their role and purposes depend on each service and contract; not all of them act solely on behalf of the operator. See the sections on recipients, advertising and cookies.
• Each purpose has its own legal basis, which is what the GDPR requires. It is not a single one.
• The daily newsletter can be requested by email from the footer of every page, with double confirmation and with unsubscribe in every send. See "Newsletter subscription".

What we process, for what purpose and on what legal basis

1. Browsing the site

What: the IP address, the browser and the pages requested. They are recorded by the hosting servers, contracted from Hetzner Online GmbH (Germany, European Union), automatically. There is nothing you have to fill in.

For what: so that the site works and abuses are detected.

Legal basis: legitimate interest (art. 6.1.f GDPR). It exists because without IP logging there is no way of stopping abusive automated use, and that benefit cannot be achieved otherwise.

Retention: the server connection logs are kept for 14 days and are then deleted automatically. We keep no copy of those logs.

In addition, a visit measurement with Umami, installed on our own server (the same Hetzner one, in the European Union), which is reached through the same domain as the site. It sets no cookies and stores no identifier on your device. It records which pages are viewed, where you come from, the device and browser type, and the approximate country and city; the IP address is used only for that — to find out where the visit comes from — and is not stored. It is shared with nobody: not with advertisers and not with providers. The only thing that leaves your browser is a "this page has been viewed" notification to cerebroinversor.com, through our own infrastructure.

Legal basis: legitimate interest (art. 6.1.f GDPR). The interest is knowing what is read in order to improve the site, which is a purpose of its own and not commercial. And it respects your browser's "Do not track" preference: if you have it enabled, nothing is recorded. See "Visit measurement" on the cookies page.

2. Usage metrics without content

What: an allowlist of fifteen fields: the page you ask from, the detected intent, the action, the evidence, the review, the prompt version, the model, the latency, the number of words, whether it was truncated and how many calls it made. The list is in the code and the text of your question and of the answer is not in it: what you write by this route is not stored.

For what: to measure whether the system is improving and to detect regressions.

Legal basis: legitimate interest (art. 6.1.f). The interest is improvement of the service, and it is satisfied because the data is aggregable and does not allow any conversation to be reconstructed.

Retention: for as long as the service exists. You can request its deletion by writing to us.

3. The chat, without an account

What: the text you write and the conversation history.

Where it lives: in your browser, in the tab's memory. It is sent with each question so that "and its debt?" has an antecedent, and it is deleted when you close the tab. Without an account there is no deliberate copy of your conversation stored on our servers. What does remain outside your browser is what we describe below: the hosting's technical logs and the processing carried out by the answer's providers.

For what: to answer you in the context of the conversation.

Legal basis: the declared basis is your consent (art. 6.1.a) to process the text for the purpose of generating the answer. That consent affects what is processed in future: you can withdraw it at any time, and from that moment on we stop using the previous material to answer you. Closing the tab empties the history that lives in your browser, but this is not a retroactive withdrawal: it does not withdraw from processing what has already been sent, nor does it by itself oblige the providers to delete it. If you want what has already been sent to be deleted, write to us at c.barezsanchez@gmail.com and we will process it.

Processor: Google LLC, through its Gemini API, processes the text in order to generate the answer. And Tavily when the chat needs to search the internet. TypeSafe receives your question and the draft of the answer in order to check, with its Jev model, that the figures match the sources (with no data from your account). See "Transfers".

Notice that matters: even though the conversation is not stored here, it does travel to those providers at the moment of the question. Do not write in the chat health data, ideological affiliation, sexual orientation, trade union affiliation, racial or ethnic origin, or other special category data under art. 9 GDPR: we have no legal basis to process it and we cannot give you any guarantees about it.

4. The account

What: your email address and a password that is stored encrypted and that we never see.

For what: so that you exist, so that your portfolio and notes survive you changing device, and so that you can delete your data.

Legal basis: performance of the contract (art. 6.1.b). Without an account there is nothing to manage.

Processor: Supabase Inc., which hosts the database and manages sign-in.

Retention: for as long as the account exists. You can request its deletion at any time; the account deletion button is inside your panel and deletes your data.

5. What lives inside the account

| What | For what | |---|---| | Holdings: symbol, number of securities and average price | so that the portfolio exists on more than one device | | Saved notes (your favourites) | so that you can retrieve them | | Preferences: level and depth | so that Elisa explains things to you at your level on any device | | Image counter: how many screenshots you have uploaded today | to set a limit of 10 a day on the transcription service |

Legal basis: performance of the contract (art. 6.1.b). All four are data needed for the account to serve its purpose, and all four are deleted along with the account.

Retention: for as long as the account exists. The "delete history" button empties the conversation of this session in your browser and does not touch the portfolio or the notes.

Your preferences travel to Elisa and nothing else. With each question your level and the chosen depth are sent in order to adjust the vocabulary and the length. You can answer them, change them or not answer them. We do not store the text of your questions nor use it to infer your interests.

Your holdings are not attached to the chat. This deserves its own line because it is easy to understand the other way round. The holdings in the table above are used for the portfolio section and for the scenarios: they are stored, synchronised and displayed. They are not sent to the model with your questions, not even if you have an account, and not even if you have chosen a vocabulary level. The chat answers on the basis of what you write, and therefore its answers are general and not personalised: they are not financial advice. If you include that information in a question, it travels as text that you write, under the same legal bases and the same processors as the rest of the conversation, and with no further processing than that of any other question. Bear in mind that such text may contain data that identifies you or identifies third parties: the educational limits and the absence of judgement about your suitability to invest remain in force even if you write out your portfolio, and we are not validating your situation.

What this is not, and why it matters: knowing your vocabulary level does not turn this site into a financial adviser. The system includes measures to reduce personalisation and to detect responses that deviate, but they are product measures and they can fail: the system is automatic and a response may contain an unanticipated personalised recommendation. If you detect an error of this kind, write to us at c.barezsanchez@gmail.com and we will review it. The Site is not registered in the CNMV registries as an investment services firm. See /legal/condiciones.

6. Portfolio import by image

You can upload a photo or a screenshot of your broker's screen so that the system can read the symbols, the securities and the entry price from it. What happens to that image is as follows, and it is the most important thing to know on this page.

Who receives the image: it travels to Google LLC, to its Gemini API, which is what transcribes it. We do not send it to anyone else.

We do not store it: neither in our database nor in our logs. The image exists for as long as the transcription lasts and is then lost.

What Google may do with it. The Gemini API terms, in force since 23 March 2026 (official text), require Paid Services for API clients available in the EEE, the United Kingdom or Switzerland. The definition of Paid Services requires a project with active Cloud billing; Paid Services data use rules also apply to users in those regions when they access free quotas. Under that regime Google declares that it does not use prompts and responses to improve its products, and it may keep limited logs to prevent abuse, protect the service and comply with legal obligations. This does not guarantee zero retention, the absence of human review or exclusive processing within the EEE: the data may be stored or processed in countries where Google or its agents operate. These terms do not by themselves certify the billing configuration or the operator's specific contracts. Before uploading an image, remove names, email addresses, account numbers and other unnecessary data.

What we do store about you from this service: a daily counter, the usos_ocr, with the number of images you have uploaded today. It exists so that an arbitrary account cannot spend the service quota in a single afternoon. The limit is 10 images a day; the next day the counter resets to zero.

Security names: when the image carries the name of a security instead of its symbol, that name is looked up in Yahoo Finance (Yahoo, United States) in order to resolve it. What is sent to Yahoo is the name of the security, not the image.

Processor: Google LLC (United States) and Yahoo (United States). See "Transfers".

7. The newsletter

What: your email address.

For what: to send you the newsletter you request.

Legal basis: your consent (art. 6.1.a GDPR; arts. 21 and 22.1 LSSI). It is withdrawn with the unsubscribe link in any send.

Retention: for the duration of the subscription and up to one year after unsubscribing, in order to be able to evidence that you consented.

7 bis. Newsletter subscription

This is the subscription requested in the footer of every page, through the form that says "Subscribe". It is not the same thing as the previous section: here we do not send you anything by hand, you subscribe to a list that sends itself.

What is stored: only your email address. The page does not measure who writes it, stores no cookies by this route and the text you write in the chat does not reach here. Buttondown, the provider, additionally stores the IP address and the sign-up metadata (browser and referrer page) at the moment of sign-up, as in any subscription form; we do not send them to it ourselves.

For what: to send you the daily newsletter by email.

Legal basis: your consent with double confirmation (art. 6.1.a GDPR). That is: you enter your email, Buttondown sends you a confirmation email and only when you click the link in that email do you start receiving the newsletter. Nothing is sent to anyone until you have confirmed. Buttondown applies this double confirmation by default to all of its newsletters, so the form's promise — "we will ask you to confirm" — does not depend on any setting of ours. You can unsubscribe with the link included in every send, and that unsubscribe ends your consent.

Retention: until unsubscribing. Every email you receive contains a link to unsubscribe.

Processor: Buttondown, LLC (United States), which hosts the subscriber list and sends the emails. Buttondown declares that it does not sell or share your data for advertising purposes, that it works only with the subprocessors it needs to provide the service, and that it handles unsubscribing and access to your data immediately if you ask it to. You can also exercise those rights through us.

Transfer: the addresses on this list are processed in the United States, outside the European Economic Area, and therefore they require safeguards. Buttondown publishes a data processing agreement (DPA) which incorporates, as Annex B, the European Commission standard contractual clauses for international transfers of personal data, and it relies on the European Commission adequacy decision of 10 July 2023 for the steps within the United States. Its servers are in the United States (AWS). If you want the details or the DPA, write to us and we will send it to you. See "International transfers".

8. Writing to us

What: the content of your message and the data you give us in order to reply to you. It includes the website's suggestions mailbox: it stores the text, the chosen tone, the section you are writing from, the email if you leave it and, if you are signed in, your account identifier.

For what: to reply to you.

Legal basis: your enquiry and the relationship it creates (art. 6.1.b).

9. The forum (Community)

What: your pseudonym, the threads and messages you write, their status (published, pending, not published or removed) with the reason, and the record of each moderation decision. If you report a message: the rule you choose, your explanation and, only if you leave it, your email. Your account email is never published; only the pseudonym appears alongside your messages.

For what: to publish what you write, to moderate it before publication according to the [forum rules](/legal/normas-foro), to handle reports and complaints, and to be able to explain each decision to you.

Legal basis: publishing and moderating, the conditions you accept when writing (art. 6.1.b); handling reports, giving reasons for decisions and keeping their record, the obligations of Reglamento (UE) 2022/2065 on digital services (art. 6.1.c).

Automatic moderation: before publication, the text of the message (and the title, if you open a thread) is sent to TypeSafe, which classifies it with its Jev model against the forum rules. Your email, your pseudonym and your account identifier are not sent to it. If the result is doubtful or the system does not respond, a person decides. If it is not published, you will see the rule, the reason and whether the system or a person decided, and you can ask for a person to review it by writing to c.barezsanchez@gmail.com.

Retention: the messages, for as long as your account exists (deleting it deletes them all; to delete a specific one, write to us). The record of decisions and the reports, twelve months from the decision, in order to handle complaints; those relating to your messages are deleted earlier if you delete your account.

Notice that matters: what you publish on the forum can be read by anyone. Do not write your own data or anyone else's, nor special category data under art. 9 GDPR.

Recipients and processors

We do not transfer data to third parties for commercial purposes. Data leaves the system only to the following providers, and only for what is explained above. For each one of them we do not publish here whether it is a processor or a recipient: that is in the contracts, and this table cannot verify it.

| Provider | What it receives | For what | |---|---|---| | Hetzner Online GmbH (Germany, EU) | connection logs and the data from the visit measurement | hosting the site and its analytics | | Supabase Inc. (US) | account, portfolio, notes, image counter and forum | database and session | | Google LLC (US) | the text of your question and your conversation history | generating the answer | | Google LLC (US) | the image you upload to read a portfolio | transcribing it | | Yahoo (US) | the name of a security, never the image | resolving the symbol | | Tavily (US) | what needs to be searched | searching the internet | | TypeSafe | your question to the chat and the draft of the answer | checking that the answer matches its sources | | TypeSafe | the text of each forum message (and its title), with no account data | moderating it before publication | | Buttondown, LLC (US) | your email address and the sign-up technical data, and nothing else | hosting the subscriber list and sending the newsletter |

In addition to them, public authorities may receive data in the exercise of their powers, and the fallback providers for the model (Groq, Cloudflare and OpenRouter, the latter together with the provider to which it routes each request) only if the primary provider does not respond, and then with the same content and the same purpose.

You can request the current list of processors by writing to the address above.

Advertising

The site is funded by Google AdSense advertising and therefore does not charge those who use it.

Who manages it: Google Ireland Ltd. and Google LLC act as operator and provider of the advertising. Google processes your identifiers and cookies in order to display and measure advertisements: without that there would be no way of knowing which advertisements are shown or what they are worth.

On what basis: on the basis of the consent collected by Google's consent manager, AdSense's "Privacy & messaging" notice. That notice is what allows you to decide, and it is what is used to set advertising preferences in your browser. There is no consent banner of the site's own: the one shown is Google's. You can change your decision at any time from Google's privacy controls on advertising (myadcenter.google.com) and from the consent notice itself.

What this means for you: the site's content is not conditioned on your data, and those identifiers are not used to decide what you are shown beyond advertising. What they do is serve you advertisements and measure them.

Partner sites policy: https://policies.google.com/technologies/partner-sites.

Ezoic Inc. placed the advertising from 29 to 30 September 2026; it did not pass the site review and was removed entirely (its script, its consent notice and its analytics). Since 30 September 2026 the advertising is again Google AdSense's.

International transfers

Several of the above processors handle data outside the European Economic Area, most of them in the United States. For those transfers there are two different routes and they should not be confused:

• Adequacy decision: the European Commission adequacy decision of 10 July 2023 (Decision (EU) 2023/1795) declares that the United States offers an adequate level of protection, provided that the recipient company adheres to the EU-US Data Privacy Framework and the processing it receives is covered by that framework. Only adhering companies may use this route.
• Other safeguards: when the above route is not available, the transfer needs other safeguards, such as the Commission's standard contractual clauses. Which one applies to each provider depends on each entity, and that information is not published here: it is in the contracts with each one.

That is why this page does not state that all transfers rely on an active adequacy mechanism: that depends on the effective adherence of each company and on what each one processes. You can write to us at c.barezsanchez@gmail.com asking about a specific provider and we will tell you which declared route applies to it. Bear in mind that this contact does not replace the right to complaint, which you can exercise before the Agencia Española de Protección de Datos.

Groq, Cloudflare and OpenRouter, which are the model's fallback, are United States companies. OpenRouter may additionally pass your request to a model provider that this site has not chosen, and that provider may be outside the EEE. That is why OpenRouter is only used when the primary provider does not respond. TypeSafe, which reviews the chat's answers and classifies the forum's messages, may also process text outside the EEE, and the same applies to it as to the others: the route depends on its adherence and on what it processes. Buttondown, LLC, which hosts the newsletter's subscriber list, is also a United States company and processes that list's email addresses from there. In its case the safeguard is published: its data processing agreement incorporates as Annex B the European Commission standard contractual clauses, and its data is hosted on AWS (United States). See "Newsletter subscription". To find out which declared route applies to a specific provider, write to us.

Your rights

You can exercise the rights of access, rectification, erasure, objection, restriction and portability by writing to c.barezsanchez@gmail.com, indicating which right you are exercising and attaching a document evidencing your identity.

Deleting the account

The account deletion button, inside your panel, deletes it immediately. When you do so:

• Your portfolio, saved notes, preferences and image counter are deleted.
• The suggestions you sent while signed in are also deleted, together with the email you left on them.
• Your pseudonym, your forum threads and messages are deleted (including other people's replies inside a thread you opened), along with the reports you made while signed in and the record of decisions about your messages.
• Those you sent without a session are not linked to any account: if you want us to delete them, write to us at c.barezsanchez@gmail.com from the email you left.

For everything else, write to us.

If you understand that we have not dealt with your request, you can complain before the Agencia Española de Protección de Datos (aepd.es, C/ Jorge Juan, 6, 28001 Madrid).

Minors

The site is not a service aimed at minors. If you believe that a minor has given us data, write to us and we will delete it.

Security

The site's traffic is encrypted over HTTPS. Passwords are stored encrypted and cannot be read, not from here and not from the database provider. Access to what is in your account is restricted to you by security rules that the database applies on the server: even if someone obtains your account identifier, they cannot read your holdings with another identifier.

Changes to this policy

Any substantial change will be announced on this same page with its revision date.