Privacy Policy

Last updated: July 21, 2026

1. Data controller

  • Holder: Solutions2AZ SL (brand DocumenTo.MD)
  • Address: Calle Pedroches 20, 28915, Leganés, Madrid (España)
  • CIF (Tax ID): B70648688
  • Email: legal@solutions2az.net

2. Purpose of the processing

The personal data collected through the website has the following purposes:

  • Account management: registration, authentication and access to the user dashboard.
  • Provision of the service: document conversion and delivery of the resulting Markdown.
  • Email verification: sending OTP codes to confirm email ownership.
  • Billing: management of paid subscriptions (via Stripe).
  • Support: handling of enquiries and incidents.
  • Security: fraud prevention, rate limiting and protection against abuse (IP hashing for anonymous conversions).

3. Lawful basis

  • Performance of a contract: provision of the service requested by the user (Art. 6.1.b GDPR).
  • Consent: sending of communications, if authorised by the user (Art. 6.1.a GDPR).
  • Legitimate interest: platform security and abuse prevention (Art. 6.1.f GDPR).
  • Legal compliance: accounting and tax obligations (Art. 6.1.c GDPR).

4. Data processed

  • Account: name, email, password (bcrypt hash).
  • Usage: conversion history, API metrics, IP address (in anonymous conversion, solely as an irreversible hash).
  • Billing: payment data is managed directly by Stripe; Solutions2AZ SL does not store card data.

5. Data retention

  • Original files: deleted immediately after conversion.
  • Markdown results: configurable retention (24h by default), deletable by the user.
  • Account data: while the account is active. Deleted at the user's request or after a prolonged period of inactivity.
  • Usage logs: for the legally required period.

6. Recipients

Data is NOT transferred to third parties for commercial purposes. The following data processors are used:

  • Stripe: payment processing (PCI-DSS certified).
  • Resend / email provider: sending transactional emails (verification, password reset).
  • Google Analytics: web analytics, only after user consent (IP anonymisation enabled).
  • Cloudflare: anti-bot protection (Turnstile) and CDN.
  • Infrastructure provider: server and database hosting, located in the European Union.

7. International transfers

Some data processors (Google, Cloudflare) may be located outside the European Economic Area. In such cases, the standard contractual clauses approved by the European Commission and other guarantees required by the GDPR are applied.

8. User rights (data subject rights)

The user may exercise at any time their rights to:

  • Access their personal data.
  • Rectification of inaccurate data.
  • Erasure (right to be forgotten).
  • Objection to or restriction of processing.
  • Portability of their data.
  • Objection to automated decisions (none are made).

To exercise these rights, please write to legal@solutions2az.net indicating the right you wish to exercise. The request will be handled within a maximum period of one month.

Likewise, the user may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if they consider that their rights have been infringed.

9. Security measures

Solutions2AZ SL applies technical and organisational measures appropriate to the risk: password encryption (bcrypt), API keys stored as SHA-256 hashes, HTTPS communications, role-based access control and security monitoring.