In force from 6 October 2026
This summary is here to help you read it: the full text is what counts.
Version in force from 6 October 2026
Here we explain which personal data we process, what for, on what legal basis, who we give it to, how long we keep it and what you can do. It is written to be understood: if anything is not clear, write to us at info@anuxis.com.
It applies to four kinds of people, and in each section we say which one we mean:
Surfer Koala, S.L. · Tax ID (CIF) B22655120 · Calle Trébol A, 14 · 14710 Córdoba (Spain) · info@anuxis.com
Anuxis is a trade name of Surfer Koala, S.L., which is the party that decides how your data is processed and answers for it. We do not have a data protection officer —the law does not require us to appoint one—, so for anything about your data, write to that same address.
| Data | What for | Legal basis |
|---|---|---|
| Name, email and mobile phone number | Creating your account, notifying you —renewals, the activity check, the status of your deliveries— and verifying that it is you | Performance of the contract with you (Article 6.1.b of the GDPR, Regulation (EU) 2016/679) |
| Password, stored only as a bcrypt hash, and, if you turn it on, two-step verification | Making sure only you can get in | Performance of the contract (Article 6.1.b) |
| What you store: files, folders, instructions | Storing it encrypted and delivering it to whoever you designate | Performance of the contract (Article 6.1.b). We do not see it: see section 7 |
| Billing details: name or company name, tax ID number (NIF), address and country | Issuing your invoices and applying the appropriate tax | Legal obligation (Article 6.1.c): invoicing and VAT rules |
| EU VAT number, if you are a business in another EU country | Checking it in the EU VIES database so we can invoice you without VAT | Legal obligation (Article 6.1.c) |
| Payment details: an identifier the gateway gives us, and the last four digits and expiry date of your card | Charging the renewals. Your card number does not pass through our systems | Performance of the contract (Article 6.1.b) |
| Security activity: IP address, logins, failed attempts, trusted browsers and a log of what is done in the account | Protecting your account, detecting unauthorised access and being able to explain afterwards what happened | Legitimate interest in the security of the service (Article 6.1.f) |
| Which terms you accepted: version, language, date and IP address | Being able to prove what you accepted and when | The obligation to be able to prove it (Article 7.1) and legitimate interest (Article 6.1.f) |
| Which campaign you came from, if it was through an ad or a campaign link: the network, the campaign, the ad and the landing page | Knowing which channels work. Nothing is stored in your browser for this: it travels in the page address itself | Legitimate interest in measuring our advertising (Article 6.1.f) |
| The language in which you use Anuxis | Talking to you and invoicing you in your language | Performance of the contract (Article 6.1.b) |
During the trial we write to you a few times to help you get your account ready. These emails are part of the service you are trying out, not advertising.
We do not use your data to send you advertising, we do not sell it and we do not profile you.
A customer has designated you to receive something if a condition they have set is met. Your details were given to us by them, not by you, and that is why we tell you about it here.
| Data | What for | Legal basis |
|---|---|---|
| Name, email and mobile phone number, stored encrypted | Notifying you, verifying that it is you and, if the time comes, delivering to you what is meant for you. The key with which you will open what is yours is derived from your email and your phone | Before you accept: the legitimate interest of the customer and our own in being able to ask you to confirm your details (Article 6.1.f). After that: your consent (Article 6.1.a) |
| Your acceptance: version of this policy, language, date, IP and browser | Being able to prove that you accepted | The obligation to be able to prove it (Article 7.1) |
| Delivery activity: verifications, downloads, IP | The security of the delivery and being able to explain what happened | Legitimate interest (Article 6.1.f) |
How your consent works. When a customer designates you, you receive a notice asking you to confirm your email and your phone. On that screen we explain what Anuxis is and who has designated you, and we ask you to accept this policy. If you do not accept, you are not verified and nothing will be delivered to you. We will not write to you about anything unrelated to that designation.
Your own rights, in addition to those in section 6: you can withdraw from a customer's folders, and you can ask us to stop processing your data. We then delete whatever identifies you and stop writing to you in connection with that designation. To be able to honour this we keep a fingerprint of your email and your phone —a value that cannot be reversed, not the data itself—, because you cannot stop writing to someone you cannot recognise. Only if you had verified them.
| Data | What for | Legal basis |
|---|---|---|
| Name, email and whatever you tell us; on the waiting list, also what you would use Anuxis for, which plan interests you and which campaign you came from | Replying to you and, on the waiting list, letting you know when access opens | Your consent, which you give us by sending the form (Article 6.1.a) |
| IP address and browser | Stopping automated submissions and abuse of the form | Legitimate interest (Article 6.1.f) |
Technical cookies, the ones the website needs in order to work, do not require your consent. Analytics does: Google Analytics is only loaded if you accept it, and if you reject it nothing is sent to Google. The details are in our cookie policy.
To have an account, yes: without a name, email, phone and password we cannot provide you with the service, and without your billing details we cannot charge you or issue your invoice. Your tax ID number (NIF) is optional: without it, your invoice will be a simplified invoice.
To write to us, a name and an email address we can reply to are enough.
We do not sell or pass on your data. To provide the service we work with these providers, who process it on our behalf and under our instructions, except for those indicated:
| Who | What for | Where |
|---|---|---|
| OVHcloud | Servers and hosting | European Union |
| Brevo | Sending emails | European Union |
| Mensatek | Sending SMS | Spain |
| Backblaze | Backups, encrypted with a key it does not have | European Union |
| Our corporate email: it receives what you write to us. And website analytics, only if you accept it | See section 5 | |
| Redsys | Card payments. It processes your card details as a controller in its own right, not on our behalf | Spain |
| Spanish Tax Agency (Agencia Tributaria) | Your invoice data, because the law requires us to send it to them (Veri*factu system) | Spain |
| European Commission (VIES) | Checking your EU VAT number, if you are a business in another EU country | European Union |
And to judges, courts or authorities when the law requires us to, and only then.
We do not use artificial intelligence services with your data or your content.
Your data and your content are stored in the European Union.
Some providers are companies from outside the EU or have group companies outside it —this is the case of Google and Backblaze, from the United States— and it cannot be ruled out that some data may leave the EU. When that happens, it is done with the safeguards required by the GDPR (Chapter V): an adequacy decision of the European Commission or its standard contractual clauses. In the case of Backblaze, what it stores are encrypted copies it cannot read.
You can, at any time:
Write to us at info@anuxis.com from your account's email address, or identifying yourself in some other way if you do not have one. We will reply within one month. You can view and change much of this data yourself from your account, and close your account there too.
If you think we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) (www.aepd.es), or with the data protection authority of the EU country where you live or work (Article 77 of the GDPR). We would like you to write to us first: almost everything gets sorted out sooner that way.
What you store is encrypted before it is stored, with AES-256-GCM, and no one at Anuxis can read its content. Your recipients' details and the names of your folders are also encrypted. What we do see in clear text is your customer data: name, email, phone and billing details. Exactly how it works, and why Anuxis is not a zero-knowledge service, is explained in clause 11 of the Terms and Conditions.
| What | How long |
|---|---|
| Your account and what you store | For as long as the account exists. If you do not renew, they are deleted 60 days after the end of the paid period; if you do not subscribe after the trial, 30 days after the trial ends; if you close your account, after 30 days. The details are in the Terms and Conditions (clauses 4 and 10) |
| Your recipients' details | For as long as you keep them in your account, or until the recipient asks us to stop processing them |
| Invoices and payments | Six years at least: Article 30.1 of the Código de Comercio (Spanish Commercial Code) requires it |
| Which terms were accepted, and when | For as long as they may be needed to defend ourselves against a claim or for you to bring a claim against us (Article 17.3.e of the GDPR) |
| The activity log | It is kept without data that identifies you after your account is closed: it is a chained log that cannot be altered |
| The fingerprint of someone who asked us not to write to them | For as long as that request remains in force: it is what makes it work. If it is lifted, it is deleted after 90 days |
| Access logs (IP, login attempts) | Twelve months |
| Contact forms and waiting list | Twelve months from when you write to us |
What we keep after an account is closed is based on Article 17.3 of the GDPR: the right to erasure does not extend to what there is a legal obligation to keep or what is needed for a claim.
We do not take decisions about you based solely on automated processing that produce legal effects concerning you (Article 22 of the GDPR). A delivery starting when a condition is met —for example, the customer no longer responding to the activity check— is carrying out an instruction they gave themselves, not a decision of ours about anyone.
Anuxis is for adults: anyone who signs up declares that they are at least 18 years old. If we find that a customer is a minor, we close the account.
If we change it, we will publish the new version with its date and keep a record of which version was in force at each point in time. If the change affects how we process your data, we will tell you by email beforehand.