Privacy policy

1. Who is responsible for your data

The data controller is GMAX International LLC, [registered address — complete before launch], Miami, Florida, USA. Contact for privacy matters: [email protected].

2. What data we collect

We collect only the data you give us and the minimum technical data needed to run the site securely:

• Consultation form: name, email, country of residence, approximate available capital (optional — you may choose "prefer not to say"), and any message you write.
• Investor portal (existing clients only): login credentials, and the property, financial, and messaging data associated with your account.
• Technical data: IP address, used for security rate-limiting and bot protection. In our application logs IP addresses are stored only as salted hashes.

We do not use advertising trackers or analytics cookies, and we do not buy data about you from third parties.

3. Why we process it and on what legal basis

• To respond to your consultation request and prepare the session you asked for — necessary to take steps at your request prior to entering into a contract (art. 6(1)(b) GDPR).
• To provide the investor portal and management services to existing clients — performance of a contract (art. 6(1)(b) GDPR).
• To protect the site against abuse, spam, and attacks — our legitimate interest in security (art. 6(1)(f) GDPR).
• To comply with legal obligations, such as accounting or anti-fraud rules (art. 6(1)(c) GDPR).

We do not use your data for automated decision-making or profiling, and we will not send you marketing communications unless you have asked for them; you can withdraw at any time.

4. Who receives your data

We do not sell personal data. We share it only with service providers who process it on our behalf under data-processing agreements:

• DigitalOcean, LLC — hosting and managed database infrastructure.
• Cloudflare, Inc. — bot protection on the contact form (Turnstile).
• Resend, Inc. — delivery of transactional email.

Data may also be disclosed where required by law or to competent authorities.

5. International transfers

GMAX is established in the United States, so data submitted through this site is processed in the US. For data of EU/EEA residents, transfers rely on the safeguards provided by the European Commission's adequacy decision for the EU-US Data Privacy Framework (for certified providers) and/or Standard Contractual Clauses, together with technical measures such as encryption in transit.

6. How long we keep it

• Consultation requests: for as long as needed to handle your inquiry and any follow-up you request, after which they are deleted or anonymized.
• Client and portal data: for the duration of the contractual relationship plus the retention periods required by law.
• Security logs: for a short rolling window consistent with their protective purpose.

7. Your rights

Under the GDPR you may, at any time, exercise your rights of access, rectification, erasure, restriction of processing, data portability, and objection, and withdraw any consent you have given, without affecting prior processing.

To exercise them, email [email protected] from the address you used with us, indicating the right you wish to exercise. We will respond within one month.

If you believe your rights have been infringed, you may lodge a complaint with your supervisory authority. In Spain this is the Agencia Española de Protección de Datos (www.aepd.es).

8. Security

We apply technical and organizational measures appropriate to the risk: encryption in transit (HTTPS), hashed credentials, session controls, access restricted by role, and defense-in-depth measures against abuse. No system is infallible, but minimizing the data we hold is part of the design.

9. Changes to this policy

If we change this policy, we will publish the new version on this page with an updated date. Material changes affecting how we use your data will be highlighted.