1. Who is the data controller
In short: Carniatto Labs decides how and for what purposes your data is used; you can write to us at any time.
Laiz Hellen Alves da Silva, self-employed professional (sole trader), operating under the trade name Carniatto Labs, with NIE Z4893016R and professional address at Calle Santa Catalina Laboure 6, 4th floor, door 1, 07010 Palma, Illes Balears, Spain. Privacy contact e-mail: security@carniattolabs.com.
Given the size and nature of our activity, we have not appointed a Data Protection Officer (art. 37 GDPR and art. 34 LOPDGDD); the data protection contact is the e-mail address indicated above.
2. What data we process and where it comes from
In short: we only collect what is necessary to assist you and keep the site secure and functional. We do not ask for specially sensitive data.
Please do not include in the form health data, ideological opinions, religion, ethnic origin, sex life, criminal records or third parties' data without their authorization. If you do, we may delete it.
| Context | Data | Source |
|---|---|---|
| Contact form | Name, e-mail address, WhatsApp (optional), project type and message content. | You, when submitting the form. |
| Web analytics (Umami) | Pages visited, referring page (referrer), browser, operating system, device type and country (inferred from the IP address, which is not stored). No cookies are used. | Your browser, automatically. |
| Error monitoring (Sentry) | Visited address (URL), technical error traces, device and browser data, referring page and performance metrics. | Your browser and our servers, automatically. |
| Technical logs | Date, requested path and result of requests, for security and diagnostic purposes. They do not include form content. | Our servers. |
| Local preferences | Visual theme (light/dark) and chosen language, stored on your own device. | You, when choosing them. |
3. Purposes and legal bases
In short: every use has a specific legal ground. Where the basis is your consent, you may withdraw it at any time.
You may withdraw your consent at any time by writing to us; this does not affect the lawfulness of processing before withdrawal (art. 7.3 GDPR). You may object at any time to processing based on legitimate interest (art. 21 GDPR).
| Purpose | Legal basis (GDPR) | Detail |
|---|---|---|
| Answering your enquiry or preparing a proposal | Consent (art. 6.1.a), given by you before submission; and, should you request a proposal, pre-contractual measures at your request (art. 6.1.b). | Without your consent we cannot process the form. |
| Qualifying (classifying) your request with an artificial intelligence tool | Consent (art. 6.1.a). | See section 4. |
| Site usage statistics | Legitimate interest (art. 6.1.f). | Improving content and performance with aggregated, cookie-free data. |
| Security, error detection and correction | Legitimate interest (art. 6.1.f). | Keeping the site available and protected. |
| Complying with legal obligations and defending claims | Legal obligation (art. 6.1.c) and legitimate interest (art. 6.1.f). | Only if a contractual relationship or a legal requirement arises. |
4. Use of artificial intelligence
In short: AI only performs an initial classification of your message; a person reads it and decides.
Artificial intelligence is involved solely in the initial qualification of your request: from your name and message, a large language model (Gemma 4, running on Ollama on servers located in the European Union) classifies the project type. It does not draft or send replies, prepare proposals or make decisions: all of that is done by a person at Carniatto Labs, who reads your message. Your data is not sent to third-party AI providers nor used to train models. We do not make decisions based solely on automated processing that produces legal effects on you or similarly significantly affects you (art. 22 GDPR). If we ever use an external AI provider, we will update this policy and inform you before submission.
5. Who we share your data with
In short: we do not sell your data. We only share it with providers that help us deliver the service, under contract.
We may disclose data to public authorities, judges and courts where there is a legal obligation to do so.
| Recipient | Role | Conditions and location |
|---|---|---|
| ia-flow (controller's own platform) | Receives the form, stores it in a database and classifies it. | Own infrastructure, on EU servers (Hetzner / OVHcloud). |
| Umami (self-hosted at analytics.apps.carniattolabs.com) | Cookie-free usage analytics. | Controller's own instance: no sharing with third parties. |
| Sentry | Error and performance monitoring. | Processor under contract (DPA); data hosted in the EU region. As a U.S. company, transfer safeguards apply (EU-U.S. Data Privacy Framework or standard contractual clauses). |
| Hetzner and OVHcloud (hosting and servers) | Hosting and serving the website. | Processors under contract (DPA). |
6. International transfers
In short: your data is hosted and processed in the European Union; we do not send it to other countries.
The controller is established in Spain and data is hosted and processed on servers located in the European Union (Hetzner and OVHcloud). We do not transfer your data to countries outside the European Economic Area. The only possible exception concerns technical-layer providers with parent companies outside the EEA, such as Sentry (a U.S. company with data hosted in the EU): in such cases we require the safeguards of art. 46 GDPR (EU-U.S. Data Privacy Framework or the Commission's standard contractual clauses). You may request information about these safeguards.
7. How long we keep your data
In short: only as long as necessary; afterwards we delete or anonymize it.
| Data | Retention period |
|---|---|
| Form submissions with no subsequent contractual relationship | 12 months from the last contact; thereafter, deletion or anonymization. |
| Client data after entering into a contract | For the duration of the relationship and, thereafter, blocked for the limitation periods and applicable civil, commercial and tax obligations (art. 32 LOPDGDD). |
| Withdrawn consent or deletion request | Deletion without undue delay, except where legally required blocking applies. |
| Web analytics (Umami) | 24 months, in aggregated data with no direct identification. |
| Error monitoring (Sentry) | 90 days. |
| Security technical logs | 30 days. |
8. Your rights
In short: you can ask us to show, correct, delete or carry your data — free of charge.
To exercise them, write to security@carniattolabs.com stating the right you wish to exercise and a means of identifying you. We will respond within one month, extendable by up to two further months in complex cases, of which we will inform you (art. 12.3 GDPR). If you consider that we have not properly handled your request, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority of your place of residence. If you are in Brazil, you can exercise the rights under art. 18 of the LGPD through the same channel and turn to the ANPD.
- Access, rectification and erasure of your data.
- Restriction of processing and objection to certain uses.
- Portability of the data you provided, in a structured, commonly used format.
- Withdrawal of consent at any time.
- Not to be subject to decisions based solely on automated processing (art. 22 GDPR).
9. How we protect your data
We apply technical and organizational measures proportionate to the risk (art. 32 GDPR): encryption in transit (HTTPS), least-privilege access control, environment separation, access logging, filtering of personal data before error telemetry is sent, and periodic reviews. In the event of a personal data breach affecting you, we will notify the competent authority within 72 hours and, where there is a high risk, you as well (arts. 33 and 34 GDPR).
10. Cookies and local storage
In short: we use no tracking cookies — that is why you will not see a cookie banner.
This site installs no first-party or third-party cookies. We only use your browser's local storage (localStorage) to remember your visual theme and language — preferences that contain no personal data and that are necessary to provide the service you requested (art. 22.2 LSSI-CE). Umami analytics works without cookies, without session recording and without heat maps. You can delete these preferences from your browser settings.
11. Minors and external links
The site is aimed at professionals and businesses. We do not knowingly process data of children under 14 (art. 7 LOPDGDD); if you become aware that a minor has provided us with data, let us know and we will delete it. Our site contains links to third-party services (for example, YouTube, LinkedIn or GitHub); their own privacy policies apply when you access them.
12. Changes to this policy
We may update this policy for legal, technical or operational reasons. We will always publish the current version with its date, and if the change is substantial we will announce it visibly on the site.