Privacy Policy

1. When you contact us through our communication channels or request a demonstration of our services:

How do we collect the data?

• Contact via Centinel's email addresses
• "Book a Demo" form

What data do we collect?

• Identification and contact information: We collect your name and surname, and email address.
• Employment details: We may process the name of the entity you work for or represent, if you include it.
• Other data: If you have contacted us via email, we may collect any other information that you voluntarily include in the messages you send us.

We may also request additional information if necessary to fulfill your request or inquiry.

What are the purposes of processing your personal data?

The main purpose of processing this data is to respond to your inquiries, provide the requested information, resolve your questions, and, if you request a demo, to schedule it and show you our services at the agreed time. In any case, we may conduct follow-up on your requests.

What is the legal basis that allows us to process your data? Is it mandatory to provide it?

Consent: The data provided for the above purposes will be processed based on your consent, which you grant when you voluntarily contact us through the means provided to request information, a demo, or make any request.

The information that must be provided as mandatory will be indicated with an asterisk (*) or similar. Without this information, it would not be possible to attend to your inquiries or requests.

How long do we retain your information?

All your personal information will be processed while we are handling your inquiries and, if necessary, to follow up on them. Once this period ends, Centinel will retain such information, in a blocked state, for the periods established by law to handle any possible responsibilities and to demonstrate compliance with our obligations.

To whom do we disclose your personal information?

We do not make any additional disclosures beyond those generally indicated in "Section 4: To whom do we disclose your personal information?". In this regard, some of the channels through which you can contact us are managed by service providers acting as Data Processors. You can find more information about these providers and their roles in Section 4.

2. When you access and use our services:

How do we collect the data?

• "Start your free trial" form
• Service subscription with Centinel

What data do we collect?

We may collect information from the legal representative and contact persons of the company you work for or represent, including:

• Identification and contact information: Name, surname, national ID number (DNI), email address, and/or phone number
• Employment details: Company information, job title, and/or department

What are the purposes of processing your personal data?

To execute and maintain the contractual relationship between the parties or to establish pre-contractual measures. The main purpose is to manage and execute the contractual relationship between the parties, which may include account registration and access to the platform and services, provision of the contracted services, invoicing and payment processing (where applicable), technical assistance and support, and communication of updates, improvements, or incidents related to the service. We may also process your data to send commercial communications related to our services by electronic means, unless you object to receiving them.

What is the legal basis that allows us to process your data? Is it mandatory to provide it?

Contract execution: Processing your data is necessary for the execution of the contract between the parties.

Legitimate interest: The sending of commercial communications is based on our legitimate interest when the recipient is a customer, in accordance with current legislation on electronic communications.

All data requested and processed by Centinel for the above purposes is necessary. If not provided, the services cannot be executed, nor the related administrative tasks performed.

How long do we retain your information?

All personal information will be processed during the duration of the contractual relationship between the parties. Once that period ends, Centinel will retain the data in a blocked state for the periods established by law to handle any potential liabilities and to demonstrate compliance with our obligations.

To whom do we disclose your personal information?

We do not make any additional disclosures beyond those generally indicated in "Section 4: To whom do we disclose your personal information?". In this regard, we may use service providers for the delivery of certain ancillary services (e.g., management software), who act as Data Processors. You can find more information about these providers and their roles in Section 4.

3. Integration with Gmail via Google API Services

If you choose to connect your Gmail account to Centinel, we will access and process certain Gmail data for the sole purpose of automating the extraction of invoice information. This functionality is entirely optional and only activated with your explicit authorization through Google's OAuth 2.0 flow.

What Gmail data we access

Once you authorize access, we may collect the following data from your Gmail account:

• Email metadata: sender, recipient, subject line, date, and time.
• Email body: limited to emails that appear to be related to invoicing (based on keywords or sender addresses).
• Attachments: PDFs, images, or other documents that are likely to contain invoices.

We do not access, process, or store any emails that do not meet invoice-related criteria. We do not access your entire inbox. Our access is scoped, filtered, and restricted solely to fulfill the invoice-processing feature you have opted into.

Purpose of access and use

The Gmail data we access is used exclusively for:

• Detecting invoice-related emails in your inbox
• Extracting structured data from invoice attachments
• Generating accounting entries, reports, or suggestions based on invoice content
• Storing extracted invoice information in your Centinel account for your internal financial operations

We do not use Gmail data for marketing, advertising, profiling, or any purpose unrelated to invoice automation.

How we store and retain Gmail data

We do not store entire email messages or raw attachments. Only the extracted invoice data and minimal metadata (e.g. sender, date, invoice number) may be stored in your Centinel account if required for your bookkeeping records or as part of service delivery.

You may disconnect Gmail at any time, in which case we will delete all Gmail-derived data associated with your account within thirty (30) days, unless retention is required by applicable law.

Human access policy

Centinel personnel do not access your Gmail data unless:

• You have explicitly requested support and provided consent for access
• It is necessary to investigate abuse, fraud, or a security incident
• Required by a valid legal obligation or enforceable government request

All access is monitored, logged, and subject to strict confidentiality and access control policies.

Revoking access

You may revoke Gmail access at any time via: (1) your Google Account settings: https://myaccount.google.com/permissions, and; (2) in Centinel app within "Settings > Service Integrations". You may also contact us at support@centinel.finance to request deletion of all Gmail-related data stored in your Centinel account.

Compliance with Google API Services User Data Policy

Centinel's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

This means:

• We only access the data we need to deliver the invoice automation feature
• We do not use Gmail data for advertising or user profiling
• We do not transfer Gmail data to third parties except subprocessors that help deliver the service, under strict data protection terms
• We do not allow human access unless explicitly authorized or required by law
• We maintain strong security measures to protect Gmail data (e.g. encryption in transit and at rest)

Your rights

As with all personal data processed by Centinel, you have the right to access, rectify, erase, restrict, and object to the processing of your Gmail-derived data. You may also request data portability or lodge a complaint with the relevant data protection authority.

To exercise these rights, please contact us at: support@centinel.finance

Browsing the Website (Cookies)

We use cookies and other tracking and tracing tools on this Website to collect information about how users interact with the Website. For more information on the processing carried out through these tracking tools, please visit our Cookie Policy.

Right to withdraw previously given consent

You may withdraw your consent at any time in relation to any processing based on it. However, withdrawing consent will not affect the lawfulness of processing based on consent before its withdrawal.

Right of access

You have the right to know whether your data is being processed, and if so, to obtain a copy of that data as well as information about:

• the origin and recipients of the data;
• the purposes for which it is being processed;
• whether there is any automated decision-making, including profiling;
• the data retention period; and
• the rights provided under the applicable regulations.

Right to rectification

You have the right to obtain the correction of your personal data or to have it completed if it is incomplete.

Right to erasure

You have the right to request the deletion of your personal data if it is no longer necessary for the purpose for which it was collected or, where applicable, if we are no longer authorized to process it.

Right to data portability

You have the right to request the portability of your data in cases where processing is based on your consent or the execution of a contract, provided the processing is carried out by automated means. If you exercise this right, you will receive your personal data in a structured, commonly used, and machine-readable format. You may also request, where technically feasible, that your data be transferred directly to another company.

Right to restriction of processing

You have the right to restrict the processing of your personal data in the following cases:

• When you have requested the correction of your personal data during the period in which we are verifying its accuracy.
• When you believe that we are not authorized to process your data, in which case you may request that we restrict its use instead of deleting it.
• When you believe that it is no longer necessary for us to continue processing your data but you wish us to retain it for the exercise or defense of legal claims.
• When there is processing based on our legitimate interest and you have exercised your right to object, you may ask us to restrict the use of your data during the verification of whether our legitimate interests prevail over yours.

Right to object

You have the right to object at any time to the processing of your personal data based on our legitimate interest, including profiling.

Unsubscribing from commercial communications: Remember that you may object to receiving this type of communication at any time by sending us an email at support@centinel.finance. You may also opt out by following the instructions included at the bottom of each electronic communication we send you.

Right to lodge a complaint with the supervisory authority

Remember that at any time, if you believe your right to the protection of your data has been violated, you may file a complaint with the competent Supervisory Authority. In the case of Spain, this is the Spanish Data Protection Agency (www.agpd.es).