Privacy Policy

Last updated: October 2026

1. Data controller

This policy describes how Tarraco App Lab processes the personal data of the users of this website, in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018, on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD).

  • Company name: Tarraco App Lab, S.L.U.
  • Tax ID (CIF): (in incorporation)
  • Registered address: C/ Pau Claris, 2 - 43005 Tarragona (Spain).
  • Contact telephone: (+34) 877 64 12 52
  • Privacy and GDPR rights contact: privacidad@tarracoapplab.com

2. What data we process

  • Contact data: the data you provide when filling in the contact form or subscribing to the newsletter (name, email address, phone number, business name or type and the content of your message; for the subscription, only the email address).
  • Technical data: IP address, session identifiers and logs necessary for security and operation.
  • Blog comment data: if you choose to comment, you sign in with an account from an external provider (Google, for example) and we store the public name and profile picture that provider gives us, together with your comment and its date. We do not publish your email address.

Please do not include special categories of data (sensitive data) or third-party data without their consent in your message.

3. Purposes and legal basis

  • Handling your request and responding to enquiries sent through the contact form — performance of a contract or pre-contractual measures.
  • Managing the sending of the newsletter with news and information about The AI Web Factory's services, through subscription with double confirmation (double opt-in) — consent (which you can withdraw at any time).
  • Publishing and displaying blog comments, and identifying who wrote them — consent, which you give by signing in and posting.
  • Security and abuse prevention — legitimate interest.
  • Analytics of website usage — consent.
  • Applicable legal obligations — legal obligation.

4. Recipients and data processors

To deliver the service we rely on the following providers (data processors), with whom the guarantees required by the GDPR are in place:

  • Netlify, Inc.: hosting of the website, delivery of its contents and handling of contact form submissions (Netlify Forms).
  • Brevo (Sendinblue SAS): sending of the newsletter emails (subscription confirmation email and subsequent communications).
  • Google Ireland Ltd.: verifying your identity when you choose to sign in with a Google account to comment. Google passes us your public name, your profile picture and your email address.
  • Supabase, Inc.: storage of blog comments and of the accounts used to post them.
  • Google Ireland Ltd. (Google Analytics 4) and Microsoft Corporation (Microsoft Clarity): aggregated measurement and analysis of website usage, only when the user accepts analytics cookies.

5. International transfers

Some providers are located outside the European Economic Area (mainly the USA). These transfers are covered by the Standard Contractual Clauses (SCCs) approved by the European Commission and by supplementary measures. You can request information about these safeguards by writing to privacidad@tarracoapplab.com.

6. Retention

We retain your data for as long as the relationship with the user exists and, afterwards, for the periods legally required to address potential liabilities; the data is then deleted or anonymised. In the case of the newsletter, we process your email until you unsubscribe, which you can do at any time using the link included in every email.

Blog comments are kept for as long as the post stays published. You can delete your own at any time from the blog itself while signed in, and deleting your account deletes all of your comments.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to privacidad@tarracoapplab.com. You may also withdraw your consent at any time and lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you consider that your request has not been addressed.

8. Security

We apply appropriate technical and organisational measures: encryption in transit (HTTPS), access control, secure secrets management and security event logging.

9. Changes to this policy

We may update this policy to reflect legal or service changes. The current version will always be published on this page.