Privacy policy.

Processing 01

Visits to this website

What is processed

The path you visited, the language, the country, the host of the site you came from, a campaign identifier if you arrived through one of our links, and an irreversible code derived from your IP address and the date.

How that code works

The IP address is not stored. What is stored is a truncated HMAC-SHA256 of (IP + day), which serves to avoid counting you ten times on the same day and nothing else. When the day changes the link breaks: it cannot follow you across days and it cannot reconstruct your IP. Neither your browser nor any device fingerprint is stored, nor the full URL of the site you came from.

Cookies

None. Not ours, not third-party. That is why you will never see a consent banner.

Legal basis

Legitimate interest (art. 6.1.f GDPR) in knowing whether the website works and which content is of interest, with the least data possible and without identifying anyone.

Retention

12 months.

Processing 02

Booking the 20-minute call

What is processed

Name, email address and, if you provide them, phone number and topic of the call, plus the day and time you chose.

Purpose

To schedule and hold that call, and to get back to you.

Legal basis

Steps taken at your request prior to entering into a contract (art. 6.1.b GDPR). Fields marked as optional are processed on the basis of your consent (art. 6.1.a), which you can withdraw at any time.

Recipients

None. The booking is stored in a file on our own server, not in a third-party service, so there is no external processor and no transfer outside the European Union.

Retention

24 months from the call, or until you ask for erasure.

Processing 03

Commercial prospecting (our CRM)

This is most likely the processing that brought you here, if you have received an email from us.

Where the data comes from

From two public sources, and no others. You did not give it to us and we did not buy it from anyone. This is the information art. 14.2.f GDPR requires us to disclose.

Source 1 — OpenStreetMap

An open, publicly accessible geographic database under the ODbL licence, queried through its Overpass API within a 50 km radius around Alicante. From this source we keep what it publishes: the licence allows that and requires us to credit it, which is what we are doing here.

Source 2 — Google Maps / Places

A slightly smaller area — 30 km — queried through the Google Places API. The regime here is different and far narrower: we only keep the identifier Google assigns to the place and its coordinates, and the coordinates are deleted after 30 calendar days. One precision we would rather give you: today that deletion is not scheduled on its own — it runs when a new ingest is launched and by hand, and we are putting a daily timer on it. This does not affect you today, because there is not a single Google Places record in the database; we are telling you because the day there is one, the promise has to be kept beforehand, not afterwards. The name, the address, the phone number and the website are never stored: we ask Google for them each time someone opens the record and discard them when it is closed. This is not a stylistic choice — storing them would breach the terms Google sets — but the effect for you is that from this source we hold less of your data, not more.

What is processed

If your record comes from OpenStreetMap: the trading name of the business, its address and coordinates, phone number, website and email address where OpenStreetMap publishes them, and the line of business. If it comes from Google Places: only the identifier, the coordinates for 30 days and the line of business. In both cases, plus data we generate ourselves — contact status, sales notes, a history of calls and visits, and a service proposal drafted by a language model.

A note on the AI

We use a language model, and what it receives depends on whether we are working in bulk or looking at your record in particular.

In bulk — the way most of this database was prepared, and the way an email is drafted — the model receives seven items and nothing else: the sector, the estimated size, the scope (whether the business sells to companies or to consumers), whether a website is on record, whether a phone number is on record, which gaps we have observed, and how many kilometres you are from the centre of the area. Note the wording “on record”: a yes or a no travels, never the web address or the phone number itself. Nothing there points at you: not the name, the address, the email or your coordinates.

When someone opens your record and asks for the opening line of a call or presses “Analyse this business”, we also send the trading name, the town, the opening hours we have on record, how many businesses in our own database are within 300 metres of yours, whether an email address is on record, and what Google publishes about your premises: the type of business, its description, the rating, how many reviews it has, the hours, whether it is still open and whether Google has a phone number and a website on file. Note the wording “on record” again: for those three, a yes or a no travels, never the number, the email address or the website. The phone number, the email, the exact address and the coordinates still do not travel. We say this in plain words because a trading name next to a town can point at you if the business is yours and trades under your own name — and because for one day this very page said the name never travelled, which was not true of this second case. Corrected on 27 August 2026.

In both cases the distance is rounded to the whole kilometre, which is a one-kilometre band around a fixed point: thousands of businesses fit inside it, so it cannot be used to locate yours. A person reviews what the model returns before it is used. There is no automated decision-making with legal or similarly significant effects (art. 22 GDPR).

Purpose

To offer you our software development services and to follow up on that contact.

Legal basis

Legitimate interest (art. 6.1.f GDPR) in business-to-business commercial prospecting, read together with art. 19 of Spanish Organic Law 3/2018, which presumes that basis covers the processing of contact data of sole traders and professionals when it relates only to their professional activity. We have documented the balancing of that interest against your rights and can send it to you on request.

About email

Sending commercial communications by email is further governed by art. 21 of Spanish Law 34/2002, which requires the recipient to have requested or expressly authorised them. That is why our first contact is by phone or in person, and we only email people who have asked us to.

Recipients

We do not sell or disclose this database to anyone. There are three caveats you should know about. First: when we open a record that came from Google Maps, we ask Google for the details of that establishment at that moment, so Google receives the query. Google already holds that data — it is the source — but it is better said out loud than written off as “none”. Second: when we work on your open record — preparing the opening line of a call, or pressing “Analyse this business” — the trading name and the town travel to Anthropic, who provide the language model. Anthropic acts there as a processor (art. 28 GDPR): it handles that data only to return the text to us, under a processing agreement that includes the European Commission’s Standard Contractual Clauses, and does not use it for anything of its own. And third: our mailbox is Google Workspace, so if we write to you — only if you asked us to — that email passes through their servers, as almost everyone’s does.

Transfers outside the EU

The CRM database sits on our own server and nothing leaves it. The send to the language model goes to Anthropic, PBC, a US company, so it is a transfer to the United States; it is covered by the processing agreement with Anthropic, which incorporates the European Commission’s Standard Contractual Clauses, controller-to-processor module, governed by Irish law and courts (arts. 46.2.c and 44 ff. GDPR). Queries to Google Maps also travel to the infrastructure of a US company; what is sent is a query — some coordinates, or the identifier Google itself assigned — not an extract of our database. The specific safeguard covering that transfer is [[CONFIRMAR ENTIDAD CONTRATANTE DE GOOGLE Y MECANISMO DE TRANSFERENCIA]]. We would rather leave that in plain sight than claim a safeguard we have not yet verified.

Retention

12 months from the last meaningful contact. If you ask to be removed, we delete the record and keep only your email address or phone number on a suppression list, for the sole purpose of never contacting you again (art. 21.3 GDPR).

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at [email protected], free of charge and without having to justify anything. We answer within one month at the most.

To stop receiving commercial communications, just reply BAJA to any email of ours, or write to [email protected]. We apply it the same day.

If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.