A
AlmaSuite

Privacy policy

Last updated: September 30, 2026

1. Who processes your data

Controller: CODELABS STUDIO, S.L., Tax ID (CIF) B88708797, registered office at Pasaje Federico García Lorca, 6, 3º E, 29130 Alhaurín de la Torre (Málaga), España, entered in the Companies Registry of Málaga (Registro Mercantil de Málaga), sheet MA-198508, entry 1. Email: legal@almasuite.coach.

AlmaSuite has two kinds of users. For visitors of this site and for the professionals who create their space on AlmaSuite, the controller is CODELABS STUDIO, S.L. For each professional's clients, the controller is that professional (or their company), and CODELABS STUDIO, S.L. acts as processor on their behalf (art. 28 GDPR): it only processes that data on their instructions and to provide them the service.

2. What data we process

  • Professionals: name, email, password (stored hashed, never in clear), data of their space (trade name, brand, colours, domain), their team and, if they create a video avatar, their image and the scripts they write.
  • Clients of the professional: name, email, progress in courses and quizzes, points and achievements, messages exchanged with the professional, the daily check-ins they choose to fill in (mood and energy on a scale, goals, difficulties, wins and gratitude) and, if they join a video session, its recording and transcript when the professional enables them.
  • Visitors: technical data needed to serve the website (IP address, browser) and the chosen language.

Mood or wellbeing check-ins may be considered data concerning health. The professional who collects them must inform their clients and obtain their explicit consent (art. 9(2)(a) GDPR) before enabling them.

3. Purposes and legal bases

  • Providing the platform to the professional who subscribes and managing their account: performance of a contract (art. 6(1)(b) GDPR).
  • Providing the client with the services the professional offers through AlmaSuite: on behalf of the professional, under the legal basis they rely on (usually the contract with their client and, for wellbeing data, explicit consent).
  • Service security, abuse prevention and technical error logging: legitimate interest (art. 6(1)(f) GDPR).
  • Meeting legal obligations such as tax duties: art. 6(1)(c) GDPR.

We do not sell data or use it for advertising. We do not use the data of a professional's clients for our own purposes.

4. Artificial intelligence

When the professional enables these features, AlmaSuite uses Google models (Gemini) to produce a summary and suggestions from the client's daily check-ins, to analyse a session transcript and suggest follow-up points, and for the conversational assistant. The output is indicative, is reviewed by the professional and produces no decisions with legal effects on anyone.

5. Providers processing data on our behalf

  • Hetzner Online GmbH (European Union): hosting of the platform and the database.
  • Cloudflare, Inc.: storage of files, recordings and videos (R2) and delivery network.
  • Google (Gemini API): the artificial intelligence analysis and text generation described above.
  • HeyGen: generation of the professional's avatar videos, only if they use it.
  • LiveKit: infrastructure for video sessions and their recording.
  • Technical error logging (GlitchTip): receives technical information about failures, filtered before sending to remove headers, request bodies, cookies and URL parameters.

6. International transfers

Google, HeyGen and Cloudflare may process data outside the European Economic Area, in particular in the United States. Those transfers rely on the EU-US Data Privacy Framework where the provider is certified or, otherwise, on the European Commission standard contractual clauses (art. 46 GDPR).

7. Retention

Professionals' data, while they keep their account; when they close it we delete it, except the data the law requires us to keep (for instance invoicing data for the tax periods), which stays blocked. Clients' data, for the time the professional decides as controller and, at most, while their contract with us lasts; at the end we return it or delete it as instructed.

8. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw your consent at any time, by writing to legal@almasuite.coach. If you are a client of a professional, contact them first; if you write to us, we will pass your request on to them without delay. You can also lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.