Privacy Policy

1. Who is responsible

Montevive Artificial Intelligence S.L. (trading as Montevive AI) Tax ID: B25955527 Address: Calle María Zambrano 1, Esc 6 2A, 18620 Alhendín, Granada, Spain Data protection contact: rgpd@montevive.ai

noshadow.ai is an AI-literacy and shadow-AI training service operated by Montevive.

2. What we hold

If you ask for the free module, join a waiting list, or write to us from the team-enrolment assistant: your email address, the date and the version of the wording you were shown, your language, whether you opted in to commercial email, and your IP address in hashed form — never in the clear. The enrolment assistant also keeps the two answers you pick — how many people, and through which channel — and we do not keep the conversation.

If your employer enrols you: your email (or your mobile number, if your employer enrolled you by SMS), the name and company you type when claiming a certificate, which organisation you belong to and since when, your progress screen by screen including the answers you submit in the exercises (the choices you pick and the free text you type in the practice conversations included), and any certificate issued to you. Your employer's administrator can see your progress, your score, your certificate serial and your retraining date.

If you buy seats: your name, email, billing address and VAT number, entered directly into Stripe's payment page. Montevive keeps the organisation's country and VAT number for invoicing.

We process no special categories of data, and we do not profile you or make automated decisions with legal effects.

3. Purposes and legal bases

• Giving you the free module you asked for — steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
• Answering the enrolment enquiry you send us from the assistant — steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
• Delivering and assessing the course, issuing certificates, managing seats and billing — performance of a contract (Art. 6(1)(b) GDPR).
• Publishing the certificate verification registry — legitimate interests (Art. 6(1)(f) GDPR): a certificate an auditor cannot check independently is not evidence. See section 4.
• Preventing form abuse through rate limits on a hashed IP — legitimate interests (Art. 6(1)(f) GDPR).
• Sending you commercial email about the training — only with your consent (Art. 6(1)(a) GDPR). It is optional, it gates nothing, and you can withdraw it at any time.
• Keeping invoicing records — legal obligation (Art. 6(1)(c) GDPR).

4. The public certificate registry

Anyone holding a certificate serial can see, with no account and no authentication, the holder's name, organisation, score and the issue and retraining dates.

This is deliberate: it is what makes the certificate usable as evidence in front of an auditor. It also means your name and result are visible to anyone your employer gives the serial to.

What limits it:

• Serials are not enumerable — they carry a check group, so holding one certificate does not let you walk the registry.
• Verification pages are not indexed by search engines.
• If you ask us to remove your data, the certificate is pseudonymised — your name is replaced — and revoked.

If you share your certificate link, the platform you share it on — LinkedIn, Slack, WhatsApp and the like — will fetch the page to build a preview, and that preview contains your name and organisation. It is normal behaviour for those platforms, and it is what makes a shared certificate appear as a card rather than a bare link. It only happens if you choose to share it.

5. Who else receives your data

Your data may be shared with the following processors, acting on our instructions:

• Twilio Ireland Limited (Ireland): sending sign-in links, invitations and service notices, by email or by SMS.
• Stripe Payments Europe, Limited (Ireland): payment processing, invoicing and subscription management.
• Hetzner Online GmbH (Germany): hosting the platform and its database.

Other suppliers, which receive no personal data

• Porkbun LLC: domain registration and DNS records. It does not sit in the traffic path and receives nothing about your visits: requests go straight to our servers, with no proxy or CDN in between.
• Internet Security Research Group (Let's Encrypt): issuing the domain's TLS certificate. It only handles domain names.
• Google Search Console: reports aggregated search statistics about the public pages. It places no code on this site.

We do not sell your data or share it with third parties for their own commercial purposes. We use no analytics tools and no advertising networks.

6. International transfers

Hosting is within the European Union (Germany), so it involves no international transfer.

Twilio and Stripe are contracted through entities established in Ireland, but may process data from the United States via their parent companies. Those transfers rely on the standard contractual clauses approved by the European Commission and, where applicable, the EU-US Data Privacy Framework.

7. How long we keep it

• Contact details collected through the forms: until you withdraw your consent or ask us to remove them.
• Account, progress and exercise answers: for as long as your account is active. Deleted when you ask.
• Certificates: kept indefinitely, because they are the training evidence your employer may need to rely on. If you ask for deletion they are pseudonymised and revoked rather than removed, so your employer's audit file does not develop a hole and nothing left in it identifies you.
• Invoicing records: for the periods required by Spanish commercial and tax law.

8. Your rights

You have the right of access, rectification, erasure, objection, restriction of processing and portability, and the right to withdraw consent at any time without affecting the lawfulness of processing carried out beforehand.

To exercise them, write to rgpd@montevive.ai from the address you want to act on.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

9. Security measures

• There are no passwords: access is through a single-use link sent to your email.
• Access tokens are stored only as a SHA-256 hash.
• IP addresses are stored hashed, never in the clear.
• EXIF metadata is stripped from uploaded images.
• All traffic is encrypted with TLS.
• Administrative actions on an organisation are written to an audit trail.

10. Cookies

This site sets two cookies, both strictly necessary:

• ns_session: keeps you signed in to the course. Expires after 30 days.
• ns_taster: remembers that you already gave an email for the free module, so you are not asked twice. Expires after 30 days.

We use no analytics, advertising or tracking cookies. That is why there is no cookie banner: there is nothing to consent to beyond what the service needs to work.

11. Changes

We may update this policy when the service or the applicable law changes. The date of the last update appears at the top of this page.