Privacy policy

1. Who controls your personal data

RVLWorks, SL, a company based in Spain, is the controller for account, website, commercial and support data processed through AgooCloud. Contact: contact@rvlworks.com. When customers use AgooCloud to back up third-party personal data, the customer is normally the controller and RVLWorks, SL acts as processor under the Data Processing Agreement.

2. Data we process

• Account data such as name, email, password hash, email-verification state, plan and billing identifiers.
• Business workspace data such as workspace name, membership, member role, shared quota and aggregate storage usage.
• Service metadata such as devices, schedules, retention settings, filenames, paths, sizes, checksums, backup outcomes and restore activity.
• Backup payloads. Where client-side encryption is enabled, payload chunks reach AgooCloud encrypted and the encryption password is not sent to us.
• Security and technical data such as IP address, timestamps, logs, browser and agent version.
• Communications, transactional email delivery and custom-quota requests.

3. Purposes and legal bases

We process data to provide and secure the service, administer subscriptions, respond to requests, comply with law and improve reliability. The bases are performance of contract, legitimate interests in operating and protecting AgooCloud, legal obligations, and consent where required.

4. Recipients and processors

Service providers may include Stripe for billing, Wasabi for managed object storage, and the configured SMTP provider for transactional account email. OpenAI and Pexels are used only for administrator-controlled publishing workflows; customer backup content is not submitted to those services by this application. Providers process data under contractual safeguards appropriate to their role.

5. International transfers

Where a provider processes data outside the European Economic Area, RVLWorks, SL will use an applicable transfer mechanism, such as an adequacy decision or Standard Contractual Clauses, and supplementary safeguards where required.

6. Retention

Account and billing records are retained for the contract and legally required periods. Backup content and metadata follow the customer's retention settings and deletion requests, subject to technical deletion windows, security holds and law. Security logs are kept only as long as reasonably necessary for protection and investigation.

7. Your rights

You may request access, rectification, erasure, restriction, portability or objection, and withdraw consent without affecting earlier processing. Contact us at the address above. You may also complain to the Spanish Data Protection Agency (AEPD) or your local supervisory authority.

8. Security and changes

We use technical and organisational measures proportionate to the risk. No service can promise absolute security. We will post material updates here and provide additional notice when legally required.