Privacy policy for the AccesPub portal and API
Version 1.2 · in force from 6 November 2026 · English translation; the Spanish version prevails
This policy explains how personal data are processed in the AccesPub portal and the AccesPub API (api.accespub.app). The accespub.app site (self-service dashboard) has its own legal information.
Who is the controller
- Owner: Alberto Barajas González, trading as ab serveis
- Tax ID (NIF): 46629726D
- Address: Joan Miró, 19 — 08319 Dosrius (Barcelona), Spain
- Privacy contact: info@abserveis.net
Two different roles
AccesPub processes data in two different capacities:
- As a processor on behalf of the client organisation (publisher, distributor or service company). This covers the EPUB files and their content (which may include names, photographs or texts about people) and the review decisions. The client organisation is the controller and decides what it uploads and why. That processing is governed by the data processing agreement (DPA) and the terms of service.
- As a controller, for what is needed to provide the service to the people who use the portal and the API: their accounts, access security, support and invoicing the organisation. That is what this policy describes.
What data we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, role and organisation of each user | Giving access to the portal, applying permissions and sending emails (invitations, password changes, batch reminders) | Performance of the contract with the client organisation (Art. 6(1)(b) GDPR) and legitimate interest in managing the accounts the organisation creates (Art. 6(1)(f)) |
| Password (only its PBKDF2 hash; never the password itself) | Authentication | Performance of the contract |
| Session and preferences (technical cookies, see below) | Keeping the session, protecting forms, remembering language and mode | Performance of the contract; technical cookies exempt from consent (Art. 22.2 Spanish LSSI) |
| Record of who decided each review item and when | Traceability of the human review required by the conformance statement | Performance of the contract and legitimate interest in evidencing the review |
| Support messages and the contact details provided | Handling help requests | Performance of the contract |
| Organisation billing data (legal name, tax ID, address, contact) | Invoicing and accounting and tax obligations | Performance of the contract and legal obligation (Art. 6(1)(c)) |
| Sign-up form data (organisation, billing, administrator, plan) and the record of each acceptance of the terms (version, date, person and IP) | Processing the sign-up and being able to prove that the terms were accepted | Pre-contractual steps and performance of the contract (Art. 6(1)(b)) and legitimate interest in proving acceptance (Art. 6(1)(f)) |
| Technical connection data (IP, date, requested path) in the server logs | Security, rate limiting and troubleshooting | Legitimate interest in protecting the service |
We do not profile, we do not take automated decisions about people and we do not use data for advertising.
Artificial intelligence
When an AI suggestion is requested (because a user asks for it or because the organisation has turned on batch suggestions), AccesPub sends Google Gemini only what that suggestion needs:
- Alternative text for an image: the image, the text around it in the book (at most about 300 characters before and 300 after, or its caption) and the language it must be written in.
- Table caption: the table text and the text around it.
- Book description and subjects: an excerpt (about 4,000 characters from the start of the body, without cover or credits) and the title.
The paid API is used: Google does not use these data to train its models and keeps them for a limited time (55 days, according to its terms) only to detect abuse. The AI only suggests: nothing is applied to the book unless a person confirms or changes it.
Cookies
The portal uses only its own technical cookies. There are no analytics or third-party cookies, and the typeface is served from the portal itself (the browser does not connect to Google Fonts).
| Cookie | Purpose | Duration |
|---|---|---|
ap_session |
Keep the session signed in | 12 hours |
ap_form |
Protect the sign-in form (anti-CSRF) | 1 hour |
ap_flash |
Show a notice after saving | 2 minutes |
ap_lang |
Remember the chosen language | 1 year |
ap_mode |
Remember whether live or test data are shown | 1 year |
Who else accesses the data
We do not disclose data to third parties unless legally required. To provide the service we use the providers in the list of sub-processors (hosting, AI and email), under data processing agreements and, where they are outside the European Economic Area, with the safeguards stated there.
How long we keep the data
- User accounts: while the organisation keeps the service. When a person leaves, their account is deactivated and their name is kept only in the record of the decisions they took, as evidence of the review.
- EPUB files: deleted 30 days after each title is finalised (or fails). Titles under review are kept until they are finalised or the organisation deletes them.
- Reports, validation and decisions: for the term of the contract, to be able to evidence conformance.
- Backups: daily, kept for 14 days.
- Server technical logs: a short period, according to the hosting provider's log retention.
- Billing: the period required by law.
When the contract ends, the organisation's data are deleted within 30 days, except what the law requires us to keep.
Security
Encrypted connections (HTTPS), passwords stored as PBKDF2 hashes, two-factor authentication for internal administration, role-based permissions, form protection, sign-in attempt limits, separation of each organisation's data, encryption at rest and daily backups. Details are in Annex III of the DPA.
Your rights
You can exercise your rights of access, rectification, erasure, restriction, portability and objection by writing to info@abserveis.net. If your data are part of a book's content or of an account created by your organisation, we will forward the request to that organisation, which decides on those data, and help it respond.
You can also lodge a complaint with the Spanish Data Protection Agency (aepd.es).
Changes
If we change this policy, we will publish the new version here with its date and, if the change is significant, notify each organisation's administrators by email.