Privacy policy

This policy explains what personal data I handle, why, for how long, who else sees it, and what you can ask me to do with it. The short version comes first; the details follow, one activity at a time.

The short version

What this site does not do

• No analytics, no advertising and no tracking cookies. See the cookie policy.
• No requests to other companies when a page loads: fonts, scripts and images are served from this site.
• No accounts, no newsletter, and no form that sends your details to this site.
• Videos, LinkedIn, Google Scholar and press articles are plain links. Nothing from those sites loads until you click.

1. Emails and calls with prospects and clients

What: your name, email address, company and role, what you write to me, and my notes from our calls.

The questions on the home page send nothing to this site. When you finish them, your answers are placed either in a booking page on Cal.com, which opens in a new tab with your name, email and answers filled in, or in a draft email in your own email app. You decide whether to send it.

Why: to reply, to prepare and hold the call, and to send you a proposal if it makes sense.

Legal basis: steps you ask for before a possible contract (art. 6(1)(b)). When you write on behalf of your company, my legitimate interest in keeping in touch with that company through its contact people (art. 6(1)(f) and article 19 of the Spanish data protection law, LOPDGDD).

How long: while we are talking. If no project follows, I delete the conversation two years after our last contact. If you become a client, section 4 applies.

Who else: Hostinger, which hosts the contact@alfonsomedela.com mailbox, and Google (Gmail), where I read and answer it; Cal.com if you book through it, which then handles the booking under its own terms and privacy policy; and the video-call service named in the invitation.

I do not send marketing emails. If that ever changes, I will ask for your consent first, separately.

2. The few-shot demo

The few-shot image demo on the work page runs entirely in your browser. Its AI model files are downloaded from this site when you start it; the photos you add stay on your device and are never uploaded to this site or to anyone else.

3. Hosting and server logs

The site is hosted by Hostinger International Ltd. (Cyprus), which acts as my processor. When you visit any page, your browser sends your IP address and technical data (browser, page requested, time, referring page) to Hostinger’s servers, which deliver the page. Hostinger records these requests in server access logs, used to run the service, keep it secure and fix errors.

Hostinger’s network may also run an automatic security check on some visits, to block bots and attacks. The cookie policy explains what that can mean for your browser.

Legal basis: my legitimate interest in delivering a working, secure site (art. 6(1)(f)).

How long: I do not keep these logs myself. Hostinger keeps them for a limited period, as its terms set out.

4. Clients: contracts, invoicing and accounting

What: the names and contact details of the people I work with at your company; your company’s name, tax ID and address; proposals, contracts, invoices and payments.

Why: to carry out the contract, to invoice it and to keep the accounting and tax records the law requires.

Legal basis: the contract (art. 6(1)(b)); for contact people, my legitimate interest in the business relationship (art. 6(1)(f), LOPDGDD art. 19); and my legal obligations on invoicing, accounting and tax (art. 6(1)(c)).

How long: for the length of the contract. After that, invoices and accounting records for 6 years (Spanish Commercial Code, art. 30) and tax records for at least 4 years (General Tax Law, art. 66). Contract documents are kept while claims are still possible (generally 5 years, Civil Code art. 1964).

Who else: the Spanish Tax Agency and other authorities when the law requires it; my bank, for payments; and my tax advisor and invoicing software, as processors.

5. Data in client projects

When a client hires me and shares data that includes personal data (for example about its customers, patients or staff), the client is the controller and I am its processor. I use that data only on the client’s written instructions and under a data processing agreement signed with the client, as article 28 of the GDPR requires. That agreement sets the security measures, any subprocessors, and what happens to the data at the end.

If your data is in a client project, the client’s privacy policy applies. Please contact the client first; I will help them answer you.

Who receives data

These providers act on my behalf (as processors) and only for the purposes above.

Transfers outside the EU

Some providers may process data outside the European Economic Area (for example Cal.com or Google). Where data leaves the EEA, it is protected by the EU-US Data Privacy Framework (Commission Decision 2023/1795), for providers certified under it, or by the European Commission’s Standard Contractual Clauses (Decision 2021/914). You can ask me for a copy of the relevant safeguards.

Where I can choose, data stays in the EU: the site is hosted by an EU company, Hostinger International Ltd. (Cyprus).

AI in the demo, and automated decisions

No decision with legal or similarly significant effects on you is made by automated means (GDPR art. 22). The demo’s predictions are only an illustration.

The few-shot image demo runs entirely in your browser. The photos you add are never uploaded.

Your rights

You can ask me to:

• tell you what data I hold about you and give you a copy (access);
• correct it (rectification);
• delete it (erasure);
• stop using it where I rely on legitimate interest (objection);
• keep it but stop using it for a while (restriction);
• send it to you or to someone else in a common format (portability).

Write to contact@alfonsomedela.com with “Privacy” in the subject. I reply within one month. If I cannot tell who is writing, I may ask you to confirm your identity.

Note that the demo keeps nothing about you, so there is nothing to look up there.

If you think I have not respected your rights, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid) at sedeagpd.gob.es. I would be glad to hear from you first.

Do you have to give me data?

No. Without an email address I cannot reply to you. If you become a client, the invoicing details the law requires are needed to sign and invoice the contract.

Security

The site is served only over HTTPS, with strict security headers. It loads no third-party code when a page opens, and it collects as little as possible. Access to client data is limited to me and to the providers agreed with each client.

Changes

If this policy changes, the new version will be published here with a new date.