Privacy policy

Leer esta política en español

Controller: Carlos Moreno García (tax ID 09220234V), Travesía Arturo Barea 24, 06800 Mérida (Badajoz). Contact: contacto@formaestudio.org.

Purpose: what data we collect and why

When you request your website (business name, sector and email): to send you the access link, create your project and talk to you about your website. Legal basis: taking steps at your request prior to entering into a contract.
Inside the panel (what you tell us about your business, your photos and your logo): to build, publish and maintain your website. Legal basis: the contract.
To prevent abuse we keep a hash of the IP address from which the sign-up is requested (not the IP address itself), only to count attempts. Legal basis: our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR). Retention: 6 months; then we delete it (see "Retention period").

Panel sign-in security

When you sign in to your panel, we store the IP address and the browser and device type of that session to keep it open securely and to detect unauthorised access to your account. Legal basis: performance of the contract and our legitimate interest in protecting your account and our service (Art. 6(1)(b) and 6(1)(f) GDPR). Retention: while the session is active and for up to 30 days after it expires or you sign out; then it is deleted.

Visit and sign-up measurement

To understand how visitors reach our website and which channels work, we measure the use of formaestudio.org from our own server and, for clicks and scrolling, with a script from this same site, without cookies, without storing anything on your device and without third-party tools.

Visits. We record, in aggregate, the day, the page visited, the website you came from (domain only, e.g. "google.com") and the campaign parameters in the link (utm_source, utm_medium, utm_campaign). To count unique visitors per day, we compute a temporary code from your IP address and browser identifier, combined with a random value that changes daily and is deleted. We do not store your IP address to measure visits, and we cannot identify you or recognise you from one day to the next. At the end of each day we keep totals only.
Sign-up requests. If you send us a sign-up request, we store with it how you reached us: the referring domain, the page from which you sent the request and the link's campaign parameters. If you opened another page of ours first, those details stay from the first page of the visit: they stay in the form, with no cookies and no browser storage.
Clicks and scrolling. On public pages, a script from this same site tells our server — without cookies, without storing anything on your device and without third-party tools — when you use a main link (get started, a plan, an example, WhatsApp, a sector page or contact) and when you reach 25%, 50%, 75% or 100% of the page, once per threshold on each load. We keep only daily totals by page and by kind of notice. To count unique notices for the day we use the same temporary code as for visits; it is not stored. If your browser asks not to be tracked (the DNT header or Global Privacy Control), we record neither the visit nor these notices.
Legal basis: our legitimate interest in understanding how our website and campaigns perform (Art. 6(1)(f) GDPR), with minimal impact on your privacy. You can object by writing to contacto@formaestudio.org.
Retention: aggregated statistics, 13 months. Origin data attached to a sign-up request, the same period as the request itself (see "Retention period").
Recipients: no one outside Forma Estudio. Data is hosted on our server (Hostinger, EU). Internal summaries contain totals only.

We only share data with the providers that make the service work. Our processors may only process them on our instructions and may not use them for their own purposes.

Processors (they process data on our behalf and according to our instructions):

Hostinger International Ltd. (Cyprus, EU): the server that runs the platform, the database and the websites, and email for the formaestudio.org domain. Data is hosted in a data centre in Paris (France).
OpenRouter, Inc. (USA): gateway to the artificial intelligence models we use to prepare your website. For this we send your questionnaire answers, your content and your photos. We do not send your email or your payment details. OpenRouter is configured with zero data retention and no training on the data, and only routes requests to Google LLC (Google Cloud Vertex AI and Google AI Studio). Claude models (text and photo analysis) are served through Google Cloud Vertex AI, and Gemini models (images) through Google.
Resend (Plus Five Five, Inc.) (USA): sending the service emails (access link, sign-up, confirmations and reminders).
IONOS: DNS for the formaestudio.org domain.

Independent controllers:

Stripe (Stripe Payments Europe, Ltd., Ireland): collects the fees, calculates taxes and handles invoicing with your email, name, billing address, tax ID or VAT number and payment details. Stripe processes this data as an independent controller, under its privacy policy (stripe.com/privacy). We do not see or store your full card number.
Let's Encrypt (Internet Security Research Group, USA): certificate authority that issues the security certificates (https) for formaestudio.org and for clients' websites. It receives the domain names, which are published in public certificate transparency logs, and acts as an independent controller under its privacy policy (letsencrypt.org/privacy).

The personal data contained in your website (messages from its forms and the people who appear in your content) we process as a processor on your behalf, under the Data processing agreement (Spanish).

We do not sell data or use it for advertising. We do not use it to train our own artificial intelligence models.

Transfers outside the European Economic Area

Some providers process data in the United States. Each transfer is covered by these safeguards:

OpenRouter: standard contractual clauses of the European Commission (Implementing Decision (EU) 2021/914), included in its data processing agreement.
Google LLC: certification under the EU-U.S. Data Privacy Framework.
Resend: certification under the EU-U.S. Data Privacy Framework and standard contractual clauses of the European Commission in its data processing agreement.
Stripe: Stripe, LLC (USA) is certified under the EU-U.S. Data Privacy Framework.

You can ask us for a copy of the safeguards by writing to contacto@formaestudio.org.

Retention period

A sign-up request that is not completed is deleted after 12 months. Client data, for as long as the service lasts and afterwards for the time required by law (for example, invoicing).

Hash of the IP address of sign-up requests (abuse prevention): 6 months; then it is deleted.
Panel sessions (IP address and browser and device type): while the session is active and for up to 30 days after it expires or you sign out; then they are deleted.
Aggregated visit statistics: 13 months.
Aggregated click and scroll statistics: 13 months.

Your rights

You can request access, rectification, erasure, objection, restriction and portability by writing to contacto@formaestudio.org. If you are not satisfied with our response, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es).