Privacy Policy

1. Data controller

The controller of your personal data is Pau Serrano García (sole trader / autónomo), NIF 48059727P, registered at Carrer Orient, 4, 25318 Les Puelles (Lleida), Spain, contact email hello@hmilibrary.com.

2. What data we collect

3. What is public

HMI Library includes a community where users publish symbols. The following is visible to anyone on the internet, without an account, and may be indexed by search engines:

• Your public profile at /u/your-username: username, display name, avatar, bio, website, the symbols you have published, and counts of likes and downloads they have received.
• Published symbols: title, description, category, tags, the preview, the automatic ISA-101 check result, the publication date, and your username as the author. Files are licensed under CC BY 4.0 (see the Terms).
• Comments you post, with your username and the date.
• Likes: the number of likes on a symbol is public; which symbols you have liked is public information (readable through the API), even though it is not currently displayed on your profile.

Your email address, company, billing data, download history, private symbols and reports are never public. The name you enter at sign-up is your display name and is public: it is shown on your profile and is available, together with your username, to anyone viewing your symbols and comments; you can change or clear it in Settings.

You control this data: you can edit or clear your profile fields, unpublish (make private) or delete your own symbols directly from the Dashboard, and remove likes at any time; to remove a comment, email hello@hmilibrary.com. Note that copies of a symbol downloaded while it was published remain licensed under CC BY 4.0 and may be kept by the people who downloaded them. Please do not include personal data about yourself or others in symbol titles, descriptions or comments.

4. Why we use your data

• Service delivery — managing your account, authentication, storing your symbols, counting downloads and applying the monthly download quota of your plan.
• Community features — showing your public profile, published symbols, likes and comments to other users; linking remixes to the original symbol and its creator (CC BY attribution).
• Moderation and safety — handling reports and takedown notices, preventing spam and abuse, enforcing the Terms and the Community Guidelines.
• Billing — issuing invoices with your VAT/Tax ID and legal name when you subscribe to a paid plan.
• Support — answering queries you send to hello@hmilibrary.com.
• Operational communications — account confirmation, password reset, payment receipts, notices about your content (for example when it is reported or hidden). No marketing unless you expressly opt in.
• Product improvement — aggregate, anonymous analysis of which symbols are downloaded most, to prioritise new content.

Page counting (first-party, no identifier)

To know which pages lead people to the Symbol Builder and where they leave, we run our own page counter. It is worth being precise about what it does and does not do, because it is unusual:

• It stores nothing in your browser. No cookie, no local storage, no session storage, no fingerprint.
• There is no identifier of any kind. No visitor ID, no session ID, no account ID. Two page views from you are indistinguishable from two page views by two different people, so it cannot follow you and cannot build a profile.
• We do not store your IP address or your user agent. Our server unavoidably sees them to answer the request, and discards them.
• What is recorded is: the page path, the internal page you came from (or, for an external link, only the host — for example google.com — never the full address or any search terms), the site language, and whether the screen is phone, tablet or desktop size.
• Navigation is reconstructed only in aggregate, as counts of “page A → page B”, never by following an individual.
• These records are deleted after 90 days.
• If your browser sends Do Not Track or Global Privacy Control, nothing is sent at all.

This is first-party and self-hosted: no data reaches any analytics company. It remains true that we use no third-party analytics, no advertising and no profiling, and that no consent banner is required, because we store nothing on your device.

5. Legal basis

• Performance of a contract (Art. 6.1.b GDPR) — to deliver the service you signed up for, including the community features you choose to use and the download quota of your plan.
• Legal obligation (Art. 6.1.c GDPR) — to issue and retain invoices for the legally required period, and to act on valid legal notices.
• Legitimate interest (Art. 6.1.f GDPR) — for aggregate analytics, moderation, fraud and abuse prevention (including quota enforcement).
• Consent (Art. 6.1.a GDPR) — for non-transactional marketing communications.

6. Who we share your data with

Your data is stored and processed by the following sub-processors:

Public content (Section 3) is, by its nature, shared with anyone who visits the site. We do not sell or rent your data to third parties for commercial purposes.

7. Retention

• Active account — for as long as your account remains open.
• Public content — until you delete it or make it private, or until your account is deleted. When you delete your account, your profile, comments, likes and published symbols are removed from the site; copies already downloaded under CC BY 4.0 remain with the people who downloaded them.
• After account deletion — account data deleted within 30 days; billing data retained for the period required by applicable tax law (in Spain, up to 4–6 years).
• Download logs — 12 months for quota enforcement, audit and abuse prevention, then anonymised.
• Technical logs — kept for a short period under our providers' standard log retention, for security and debugging only.
• Reports and moderation records — 12 months after the case is closed, or longer if needed for a legal claim.

8. Your rights

As a data subject, you have the right to:

• Access — know what data we hold about you.
• Rectification — correct inaccurate data. You can do most of this directly from your account Settings and profile.
• Erasure ("right to be forgotten") — request deletion of your data. You can delete or unpublish your own symbols directly from the Dashboard; to remove a comment, email hello@hmilibrary.com.
• Restriction — restrict processing while a complaint is verified.
• Portability — receive your data in a structured format (JSON), including the symbols you created.
• Objection — object to processing based on legitimate interest.
• Withdraw consent — at any time, for processing based on it.

To exercise any of these rights, email hello@hmilibrary.com with "GDPR" in the subject. We respond within 30 days at most.

If you believe processing does not comply with the law, you may lodge a complaint with your local data protection authority — in Spain, the Spanish Data Protection Agency (AEPD).

9. Security

We apply appropriate technical and organisational measures: encryption in transit (TLS 1.3), encryption at rest, role-based access control, audit logs, encrypted backups. Passwords are stored as bcrypt hashes — never in plain text. Clean symbol files are served through authenticated, time-limited links; only watermarked previews are publicly cached.

10. Minors

HMI Library is aimed at professionals and does not knowingly collect data from minors under 16. If you believe a minor has provided us data, contact us and we will delete it.

11. Changes to this policy

If we update this policy we will notify you by email to the address associated with your account at least 15 days in advance when the changes affect material rights.