Privacy Policy

Controller

The controller responsible for the processing of personal data described in this policy is:

Emeldron S.L., Avenida Doctor Waksman 54, Apt. 14, 46013 Valencia, Spain.

You can reach us at info@emeldron.com for any question about data protection or to exercise your rights.

Scope of this policy

This policy explains how we process personal data on our website emeldron.com, in our customer portal at portal.emeldron.com, on the preview websites we build for businesses at sites.emeldron.com, and when we research and contact businesses that could benefit from our services.

Websites that we build and run for our customers have their own privacy policies. For those websites, our customer is the controller and we process data only on their behalf.

We process personal data in line with the EU General Data Protection Regulation (GDPR) and the Spanish data protection law (LOPDGDD).

Visiting our websites (server logs)

Our websites, the customer portal and the preview websites are delivered through Cloudflare, a content delivery network with servers in the European Union and worldwide. When you open a page, your browser necessarily sends technical data so that the page can be delivered to you.

This technical data can include your IP address, the date and time of the request, the page or file requested, the page you came from, and information about your browser and operating system. It is processed to deliver the pages, keep them secure, and defend against attacks.

The legal basis is our legitimate interest in operating secure and reliable services (Article 6(1)(f) GDPR). These technical logs are kept only for a short period and are not combined with other data to identify you.

Analytics on emeldron.com

We use PostHog to understand how our website is used. PostHog processes this data for us on servers in the European Union. It records which pages are visited, clicks on links and buttons, clicks that have no effect (so that we can find confusing elements), and how fast pages load.

When you first visit, we ask in a banner whether you accept analytics cookies. If you accept, PostHog stores a random visitor identifier in a cookie and in your browser's local storage (both named "ph_" followed by our project key and "_posthog"). This lets us recognise your later visits and see how visitors come back over time. The cookie expires after one year. It is set only for emeldron.com, and we do not use it for advertising.

Until you make a choice, and if you reject analytics cookies, PostHog does not load. It then sets no cookies, stores nothing on your device and receives no data about your visit.

We also use Cloudflare Web Analytics, which counts page views and measures loading performance. It uses no cookies, stores nothing on your device and does not build a profile of you.

The legal basis for analytics cookies is your consent (Article 6(1)(a) GDPR and Article 22(2) of the Spanish Information Society Services Act, LSSI). You can withdraw your consent at any time under "Cookie settings" at the bottom of every page. PostHog then stops, and we delete its cookie and its data in your browser. Withdrawal does not affect processing that took place before it.

The legal basis for Cloudflare Web Analytics is our legitimate interest in measuring and improving our website (Article 6(1)(f) GDPR). Because it does not store information on your device or read it from your device, it does not require your consent.

Information stored in your browser on emeldron.com

Unless you accept analytics cookies (see the previous section), our website sets no cookies. It keeps your choice in the cookie banner in your browser's local storage, together with the date of the choice and the version of this policy, so that we do not ask you again on every visit. After 12 months, or when we change this policy, we ask you again. It also keeps a small amount of technical information in your browser's session storage, which is deleted when you close the browser tab: the country code used to show prices in your currency (see the next section), the scroll positions of pages you visited so that the back button returns you to the same place, and, only after a page failed to load, a marker that prevents repeated reloads.

This information is strictly necessary to provide the website you requested and is not used for analytics or advertising. The legal basis is our legitimate interest in a functional website (Article 6(1)(f) GDPR).

Showing prices in your currency

To show prices in US dollars or in euros, our website asks Cloudflare for the country of your connection. Cloudflare derives the country from your IP address at its network edge. We receive only the two-letter country code, not your IP address, and we do not store it on our servers. Your browser keeps it in session storage until you close the tab.

The legal basis is our legitimate interest in showing you relevant prices (Article 6(1)(f) GDPR).

Contacting us

When you contact us by email or through the contact form, we process the information you provide, such as your name, company, email address, the package you are interested in and the content of your message. The contact form sends your message to our mailbox as an email through our email provider mailbox.org (Heinlein Support GmbH, Germany). We use this data only to handle and respond to your inquiry.

To protect the form against abuse, we keep a counter linked to your IP address for about one hour, which limits the number of messages that can be sent from one connection.

The legal basis is Article 6(1)(b) GDPR where your inquiry relates to a contract or to steps taken at your request before entering into a contract, and Article 6(1)(f) GDPR, our legitimate interest in responding to messages and preventing abuse, in all other cases.

We keep your message and contact details for as long as we need them to deal with your inquiry and any follow-up, and afterwards only where statutory retention obligations require it. We do not use the data you send us for advertising.

Payments through payment links

Some packages can be paid directly through a payment link. The payment then takes place on a page operated by Stripe, which processes your payment details, email address and billing address to complete the payment and to prevent fraud. Stripe's own privacy policy applies to that page.

The legal basis is the performance of the contract (Article 6(1)(b) GDPR) and our legal obligations under tax and commercial law (Article 6(1)(c) GDPR).

Customer portal

If you are our customer, we create an account for you in our customer portal. We process your name, company, email address, preferred language, country and, if you add one, a profile picture. You sign in with a one-time link or code sent to your email address, or with a password. To keep you signed in, the portal stores a session token in your browser's local storage. It also stores your language preference and drafts of forms you have not yet sent.

In the portal we process the content you give us to deliver our services, such as project briefs, requests, messages, documents and signatures, and the legal details of your business that your website needs, such as your imprint and privacy contacts. We send you emails about your account and orders, for example sign-in links, order confirmations, quotes and replies to your requests.

For billing we process your billing name or company, address, VAT number and country in our invoicing system Invoice Ninja (invoicing.co). Payments are processed by Stripe, which collects your payment details, billing address and, where needed, your tax ID. We store only the link between your account and your Stripe customer record.

The legal basis is the performance of our contract with you (Article 6(1)(b) GDPR), our legal obligations under tax and commercial law (Article 6(1)(c) GDPR), and our legitimate interest in keeping the portal secure (Article 6(1)(f) GDPR).

We keep your account data for as long as you have an account with us. Invoices and accounting records are kept for the periods required by Spanish commercial and tax law, generally six years. We delete other data when it is no longer needed.

Business research and outreach

We look for small businesses whose website we could improve and offer them our services. For this we use information that the business has made public: business listings on Google Maps, the business's own website, and public business directories and registers.

We process the business name, address, phone number, website, category, ratings and reviews from public listings, contact details such as email addresses and contact forms published on the business's website, and, where publicly listed, the name of the owner. We also analyse the business's website, for example by taking screenshots and measuring its performance.

We use this information to decide whether our services could help the business, to build a free preview website for it, and to contact it by post, email or text message. Postcards are printed and sent by Lob. To analyse websites and build preview websites we use AI services from Anthropic and OpenAI, which may receive the business information described above.

The legal basis is our legitimate interest in offering our services to businesses (Article 6(1)(f) GDPR). You can object to this at any time, for example by writing to info@emeldron.com or by using the removal link on a preview website. We will then stop contacting you and delete your data, except for the minimum we need to keep in a suppression list so that we do not contact you again.

Unless you object earlier, we keep the data for as long as we may still offer our services to the business.

Preview websites (sites.emeldron.com)

When you visit a preview website that we built for a business, we record the visit to understand whether our offer is of interest. We store your IP address, the approximate location derived from it (country, region and city), your network provider, your browser and device type, the pages you view and the page you came from.

On preview websites we also use PostHog, on servers in the European Union, to see how the page is used, including recordings of scrolling, mouse movement and clicks. Text you type into forms is masked and not recorded. PostHog and the preview website store an identifier for your visit in your browser's local or session storage.

If you send a message through the contact form on a preview website, the name, email address, phone number and message you enter are sent only to us. They are not passed on to the business shown on the preview website.

The legal basis is our legitimate interest in understanding interest in our offer and in answering your message (Article 6(1)(f) GDPR). The business shown can have its preview website removed at any time through the removal link on the website.

Former Website Check

We no longer offer the free Website Check. If you used it in the past, we still hold the email address you gave us, the address of the website that was checked, your consent records and the resulting report. You can ask us to delete this data at any time at info@emeldron.com.

Recipients and processors

We rely on carefully selected service providers who process data on our behalf and only on our instructions: Cloudflare (hosting, content delivery, security, web analytics and the country lookup), Supabase (database, sign-in and file storage for the customer portal), PostHog (analytics, on servers in the European Union), mailbox.org (email), Invoice Ninja (invoicing), Stripe (payments), Lob (postcards), Anthropic and OpenAI (AI services), and GitHub (storage of code and internal working records).

Where required, we have concluded data processing agreements with these providers in accordance with Article 28 GDPR. Stripe also acts as an independent controller for payment processing. We do not sell your personal data and do not share it for the marketing purposes of third parties.

International data transfers

Several of our providers, including Cloudflare, Supabase, Stripe, Lob, Anthropic, OpenAI and GitHub, are based in the United States, so personal data can be transferred to a country outside the European Economic Area. Such transfers take place only on the basis of an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework where the provider is certified under it, or of the standard contractual clauses adopted by the European Commission.

Automated decisions

We use automated analysis, including AI services, to assess which businesses our services might help. This only decides whether we offer our services. We do not carry out automated decision-making that produces legal effects for you or similarly significantly affects you.

Your rights

Under the GDPR you have the right to obtain confirmation of whether we process your personal data and to access that data (right of access), to have inaccurate data corrected (rectification), to have your data deleted (erasure), to have processing restricted (restriction), to receive your data in a portable format (data portability), and to object to processing based on our legitimate interests (objection). Where we process your data for direct marketing, you can object at any time and we will stop.

To exercise any of these rights, simply contact us at info@emeldron.com. We will respond within the periods set by law.

You also have the right to lodge a complaint with a data protection supervisory authority. In Spain this is the Agencia Española de Protección de Datos (AEPD). If you are located in another EU country, you may contact the supervisory authority of your place of residence.

Data security

Our websites, the customer portal and the preview websites are served only over encrypted HTTPS connections. We and our processors apply appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access.

Changes to this privacy policy

We update this privacy policy when our services or the legal requirements change. The current version always applies and carries the date of the last update shown at the top of this page.