Privacy Notice

1. Who we are

RealityOS (the RealityOS console at realityos.io, the RealityOS SDK and its online services) is provided by TMRW Spain S.L.U. ("we", "us"), a company registered in Spain.

Registered address: Av. Jean Claude Combaldieu N5, 03008 Alicante, Spain
Tax ID (NIF/CIF): B42557777
Registry: Registro Mercantil de Alicante; Tomo 4139; Folio 57; Hoja A-160929
Privacy contact: info@holoh.com

This notice explains how we handle personal data when you use RealityOS. It applies under the EU General Data Protection Regulation (GDPR) and Spain's Organic Law 3/2018 (LOPDGDD).

2. Our role

We are the controller for the account, company, app and key data in section 3, and for security and service logs.
Content that your apps store in our online services, such as assets and synced app state, belongs to your company. We process it only to provide those services.

3. What data we process

Category	Examples	Source
Account data	Name, email address, sign-in identifier	You, and the TMRW sign-in service
Company data	Company (tenant) name, members, invitations (invitee email), licence type, usage limits	You and your teammates
Terms acceptance	Who accepted which version of the evaluation terms, and when	You
Apps and keys	App titles and IDs; the public part of each key, its creation date and when it was last used. We never store your private keys.	You
Usage	Use of our online services, measured against your company's limits	The services
App content	Assets and synced state that your apps send to our services	Your apps
Technical data	IP address (used briefly for rate limiting and security), browser and device type	Your device
Contact requests	What you send us when you ask about a commercial licence or for support	You

You must give your name and email address to create an account. Without them we can't provide RealityOS.

4. Why we process data, and our legal bases

Purpose	Legal basis (GDPR Art. 6)
Provide the console, accounts, companies, apps, keys and online services	Contract (6(1)(b))
Sign-in, security, abuse prevention, rate limiting and usage limits	Legitimate interests (6(1)(f)): keeping RealityOS secure and fair
Invitation and account email	Contract (6(1)(b)); for invitations to people who aren't users yet, the inviting company's legitimate interests
Answering commercial and support requests	Steps before a contract (6(1)(b)) or legitimate interests (6(1)(f))
Legal claims and requests from authorities	Legal obligation (6(1)(c)) and legitimate interests (6(1)(f))

5. How long we keep data

Data	How long
Account, company, apps and keys	For the life of the account. To delete an account or a company, write to info@holoh.com; we delete it within 30 days.
Revoked keys	The record stays, marked revoked, for the life of the company
Terms acceptance records	For the life of the account, plus the period in which claims can be made
Invitations	7 days, unless accepted
App content in our online services	Until your app or your company deletes it, or the account is deleted
Server logs	[L2 to confirm the period, e.g. up to 7 days]
Contact requests	Up to 2 years after the last contact

6. Who we share data with

We use service providers (subprocessors) to run RealityOS: [L2 to list: hosting (Cloudflare), the TMRW sign-in service, and the email sender for invitations, each with its location].
We do not sell personal data.
We share data with authorities only where the law requires it, and with professional advisers under confidentiality.

7. Where data is stored

We are based in Spain and store RealityOS data in the EU by default. This is our practice, not a promise that all data stays in the EU. Where a provider processes personal data outside the EEA, the transfer relies on an adequacy decision (including the EU-US Data Privacy Framework where the provider is certified) or the European Commission's Standard Contractual Clauses.

8. Your rights

You have the right to access, correct, delete, restrict and port your personal data, and to object to processing based on legitimate interests.
To use a right, write to info@holoh.com. We reply within one month. For complex requests this can be extended by two months. We may need to verify your identity.
You can complain to the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, or to the authority where you live or work.

9. Cookies

We use only cookies and device storage that are strictly necessary to keep you signed in and to protect sign-in. We use no advertising or analytics cookies.