PBMA Web privacy policy
*Courtesy translation. The Spanish version is the legally binding one.*
Last updated: 9 October 2026
1. Who is the controller
- Data controller: Mario López Garcerán ([[NIF/CIF]])
- Address: [[DOMICILIO]]
- Privacy contact: contact@pbma.app
PBMA Web (https://pbma.app) analyses Power BI reports (.pbix, .pbit, .bim files or .pbip projects): inventory of tables, columns, DAX measures and relationships, model diagram, memory size and a best-practices diagnosis.
2. What data we process and why
| Data | Source | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Account identifier from the identity provider and the public name of your profile. We do not store your email in our database. | Auth0 (with Google or another method you choose) | Create and maintain your account and sign you in | Art. 6.1.b (performance of the service you request) |
| Verified email address | Auth0 | Check, at the time you sign in, that your email is verified and that you have access to the service. Used only during sign-in | Art. 6.1.b and 6.1.f (security and access control) |
| Session data (hashed session identifier, expiry date) | Your browser | Keep the session open and protect it | Art. 6.1.b and 6.1.f |
| History: name of the file you uploaded, date, analysis status | You, when uploading a file | Show you your analysis history | Art. 6.1.b |
| File you upload (the Power BI model) and the analysis result | You | Carry out the analysis you request | Art. 6.1.b |
| Technical connection data (IP address, date and time, errors) | Your browser | Security, abuse prevention, diagnostics | Art. 6.1.f |
There is no profiling or automated decision-making with legal effects on you.
About your files
- The file is processed in an isolated, disposable environment with no internet access, which is destroyed when the analysis finishes. The original file is deleted when the analysis ends.
- The result (the model extracted for analysis) is kept in the server's temporary memory for at most 1 hour so that your browser can collect it, and is then deleted. The analysis itself is carried out in your browser.
- We do not use your files to train models or for any other purpose, nor do we share them with third parties.
- Do not upload third parties' personal data or confidential information that you have no right to process. Power BI models usually contain only metadata (table names, measures, relationships), but they may include data if the files are configured to do so.
Optional agent (your own key)
The PBMA agent is optional and works only if you paste your own Claude (Anthropic) API key. The key is stored only in your browser and does not reach our servers. When you ask the agent a question, your browser sends directly to Anthropic the model's metadata (names of tables, columns and measures, DAX expressions and relationships), never the model's data, and the content of the conversation. Anthropic acts as controller or processor depending on the terms of your account with them; see their privacy policy. You can delete the key at any time from the home screen.
3. How long we keep the data
| Data | Period |
|---|---|
| Account (identifier and name) | While you keep the account; deleted on your request |
| Analysis history | Up to 200 entries or 90 days, whichever comes first, or until you delete it |
| Sign-in session | Up to 1 hour; expired ones are deleted automatically every hour |
| Uploaded file | Deleted when the analysis finishes |
| Analysis result | At most 1 hour |
| Internal analysis ownership records (no content) | Up to 7 days after deletion |
| Encrypted backups (accounts and history, no files) | 14 days |
| Server technical logs (errors and system events; web requests and file contents are not logged) | 14 days |
4. Who we share data with (processors and providers)
| Provider | Service | Location |
|---|---|---|
| Hetzner Online GmbH | Server hosting | European Union (Finland / Germany) |
| Auth0 (Okta, Inc.) | Sign-in and email verification | EU region of the tenant; the parent company is US-based |
| Google LLC | If you choose to sign in with Google | According to Google's policy |
| Cloudflare, Inc. | DNS management of the domain (without proxying the website's traffic) | Global |
| Let's Encrypt (ISRG) | HTTPS certificate (receives no personal data of yours) | USA |
When a provider processes data outside the European Economic Area, it will do so with appropriate safeguards (adequacy decision or standard contractual clauses). We do not sell your data.
5. Cookies and storage
We use only strictly necessary cookies for operation and security, which do not require consent:
__Host-pbma_session: keeps your session open (expires after 1 hour at most).__Host-pbma_login: protects the sign-in process (expires in a few minutes).__Host-pbma_profile: stores in your browser, signed, your email, sign-in method and sign-in time to show them to you in "My account". Our server does not store them; it expires with the session (1 hour at most).
We also store in your browser's local storage your interface preferences (light or dark theme and that you have read the cookie notice). They contain no personal data and are not sent to the server. More detail in the cookie policy.
We do not use analytics or advertising cookies.
The page does not load fonts, scripts or other third-party resources: everything is served from our own server and the fonts are system fonts, so your browser does not contact any third party except the sign-in provider when you decide to identify yourself and, once signed in, to request your profile picture if you have one (for example, from Google). That picture is displayed by your browser directly: we do not download or store it, and we only store its web address in the __Host-pbma_profile cookie for the duration of the session.
6. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time by writing to contact@pbma.app. You can delete your history from the application itself. If you consider that your rights have not been met, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
7. Security
Encrypted connection (HTTPS), file analysis in isolated containers with no network and with resource limits, sessions with protected cookies and protection against cross-site requests, per-account usage quotas, encrypted backups and restricted access to the server. No system is infallible: if a breach affecting you were to occur, we will notify you in accordance with the applicable rules.
8. Minors
The service is aimed at professionals and not at minors. We do not knowingly process data of children under 14.
9. Changes
We will publish any substantial change here and update the date above.