Privacy policy

Data controller

Occam Digital Solutions, S.L., tax ID B00000000, registered office in Spain. Contact: contacto@occam-ds.com.

What data this site collects

The server logs the technical data needed to deliver and protect the site, such as IP address, user agent and requested resource. If you accept analytics cookies, Google Analytics also collects information about pages viewed, sessions, device, browser and approximate location.

Analytics is disabled by default: the Google tag is not downloaded and no information is transmitted until you accept it. We use no advertising cookies, do not use analytics to profile anyone and share no data for advertising purposes.

Fonts are served from this same domain, so your browser makes no requests to third-party servers when loading the page.

We also process the data you voluntarily type into the contact form and, if you choose to answer it, into the questionnaire we send you afterwards.

Web analytics

With your consent, we use Google Analytics 4, provided by Google Ireland Limited, to understand in aggregate how many people visit the site, which pages they view and what kind of device they use. The legal basis is your consent (art. 6.1.a GDPR), which you may withdraw at any time through “Cookie settings” in the site footer.

Google signals and advertising personalisation are disabled. Analytics information is not used to display adverts and is not combined on this site with contact-form data.

Audit request form

The fields are name, company, sector and email address. On submission, that data reaches the owner’s mailbox by email and is stored as a request in the database on our server, which only Occam staff can access. It is not used for any other purpose.

We then send you an email with a personal link to a short questionnaire about your company and what you need. Answering it is optional. Based on your answers we give the request an indicative priority — cold, warm or hot — and some tags, to prepare the first conversation and organise the follow-up. This is not an automated decision with effects on you: how each request is handled is always decided by a person.

The purpose is to answer your request and, where applicable, to prepare the audit proposal. The legal basis is the application of pre-contractual measures at your request (art. 6.1.b GDPR).

We keep the request, the correspondence and the answers for the duration of the relationship and afterwards for the applicable statutory limitation periods. If the request does not lead to a commercial relationship, it is deleted automatically one year after we receive it. You can ask us to delete it sooner at any time.

Filling in the form is optional: you can always write directly to the address shown on the contact section.

The GlassFlow app

GlassFlow (Occam GlassFlow on the App Store and Google Play) is the field app of the glass, aluminium and joinery companies that work with Occam. You need an account set up by your company to sign in: accounts cannot be created in the app.

Work data — customers, jobs, measurements, photos, signatures, installations, incidents and notes — belongs to the company that gives you the account, which is the controller of that data. Occam processes it on that company’s behalf, under the agreement required by art. 28 GDPR, and only to provide the service.

The app also processes your email address and account, to identify you; an identifier of the registered phone, with the IP address and browser it connects from, so that a lost device can be removed; the dictations you choose to record; the phone’s location only while you are using the app, of which your office sees the latest point and never a route; and crash and usage logs (app opens, failed or pending uploads), to maintain the app.

The audio of a dictation is sent for transcription to Google (Gemini API), acting as a data processor, and our server does not keep it: only the text is stored. Whatever you do without coverage is kept on the phone until it can be sent.

The app shows no advertising, does not track you across other apps or sites and does not sell data. Its server is the one described below, hosted by IONOS Cloud, S.L.U. (Spain). Notifications to the phone go through Expo’s notification service (650 Industries, Inc., United States) and through Apple’s or Google’s.

To exercise your rights over work data, contact your company or write to us at the contact address and we will pass it on. Your company can close your account at any time.

If you connect your Google account

Connecting Google is optional. Each person does it with “Conectar con Google” (Connect with Google) on the app’s profile screen, and it only affects their own account.

Google user data accessed. With your permission, the app accesses your Google email address; the events in your Google Calendar, to view and edit them; sending email from your Gmail; and the name and email address of your Google contacts, read-only. It does not access your inbox or any other data in your account.

How it is used. Only for what you ask for in the app. The calendar, to add, move, change or remove the appointments you dictate or edit, and to check beforehand that they do not overlap with another of yours; only the days affected by that appointment are looked up. Gmail, to send the emails you dictate, and only after you see the recipient, subject and text on screen and tap “Enviar” (Send). Contacts, to know who a dictated email is for when that person is not among your company’s customers; the app never writes to your contacts. Your email address, to show on your profile which account you have connected. This data is not used for advertising, for profiling you or to train or improve artificial intelligence models.

Who it is shared with. No one. Google user data is not sold, shared, transferred or disclosed to third parties, including the AI provider that transcribes dictations: the model returns the name you said, and the lookup in your calendar and contacts is done by our server. It is processed only by that server, which we administer ourselves and which is hosted by IONOS Cloud, S.L.U. as a data processor. An email you confirm naturally reaches its recipient. No one at Occam accesses it unless you ask us to in order to solve a problem, for security or because the law requires it.

How it is protected. All communication between the app and our server, and between our server and Google, is encrypted (HTTPS). The long-lived permission Google issues (the refresh token) is stored encrypted with AES-256-GCM, using a key kept in the server configuration and not in the database; the access token for each use is not stored. Each person can only use their own connection and their own contacts, and the server logs do not record the content of Google’s responses.

Retention and deletion. The connected account (its address, the permissions granted and the encrypted token) and the copy of your contacts are kept while Google remains connected; each sync replaces the previous copy of your contacts. Nothing from your calendar or your Gmail is copied. A dictated email you do not confirm is not sent, and after 24 hours it can no longer be sent. For each appointment or email the app handles for you, a record is kept with your company’s notes that it was done, which address the email went to and the event identifier in Google, without the title, subject or text. “Quitar la conexión” (Remove connection), on the app’s profile screen, revokes the permission in Google and immediately deletes the connected account and the copied contacts. If you revoke the permission from your Google account, also remove the connection in the app or write to us so that the copied data is deleted. You can ask us to delete any of this data at contacto@occam-ds.com.

GlassFlow’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Google API Services User Data Policy
• Apps with access to your Google account

Processors

To deliver the form to our mailbox and send you the questionnaire link, our automation server sends the emails through Resend (Plus Five Five, Inc., United States), an email sending provider, and the mailbox itself is hosted with the owner’s email provider. Both act as data processors, under an agreement compliant with art. 28 GDPR, and do not use the data for their own purposes.

The request database and the questionnaire page run on a server we administer ourselves, hosted by IONOS Cloud, S.L.U. (Spain), which acts as a data processor under the same agreement. That server logs the technical data of each connection to the questionnaire in order to protect it against abuse.

When you accept analytics, Google Ireland Limited provides Google Analytics under its data processing terms.

Client data during a project

During an audit or a development project we may access data in your systems, including personal data of your employees or customers. In that case we act as a data processor under the corresponding agreement (art. 28 GDPR), with documented instructions, a duty of confidentiality and the agreed security measures. This policy does not cover that processing: the contract signed with each client does.

Hosting

The site is hosted by Railway Corporation (United States) which, like any web server, logs technical connection data — IP address, user agent, requested resource — in order to provide and protect the service. The legal basis is our legitimate interest in the security and availability of the site.

Railway acts as a data processor on the owner’s behalf, under the agreement required by article 28 GDPR. The controller for that processing is the owner of this site: choosing a provider does not move the responsibility onto the provider.

International transfers

The technology providers identified above may process data outside the European Economic Area. Where an international transfer takes place, it relies on an applicable adequacy decision — including the EU-U.S. Data Privacy Framework — or on standard contractual clauses approved by the European Commission.

You may ask us for further information about those safeguards at the contact address.

Your rights

You can request access, rectification, erasure, restriction, objection and portability by writing to contacto@occam-ds.com. You may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you believe the processing does not comply with the regulations.

Changes

We will update this policy before adding a new purpose or processing activity and will show the date of the change.