Privacy policy

Last updated: 9 October 2026

The data controller is Lluc Mestre (Ductik Labs). Full details are in the legal notice, and for anything about privacy you can write to [email protected].

If you visit this website

We don’t use our own cookies or tracking tools; only the booking calendar, if you open it, sets its own (details). The site is hosted on Cloudflare, which processes your IP address only to serve the pages and protect them from attacks. Cloudflare acts as a data processor and is certified under the EU-US Data Privacy Framework.

If you use the configurator

• What data: what you choose and type (type of business, name, city, style, goal and tools) and, if you ask for the homepage by email, your address.
• What for: to build your homepage, keep it so you can open it with its link and, if you ask for it, send it to you and let us know you asked. Asking for it doesn’t sign you up for anything: we won’t send you anything else unless you ask.
• The headline: it is written by an AI model (Claude Haiku, by Anthropic) from the type of business, the name and the city. We don’t send it your email or anything else.
• Legal basis: your request (article 6(1)(b) GDPR) and our legitimate interest (article 6(1)(f)) in preventing abuse.
• How long: the homepage and the email, 12 months; then they are deleted automatically. To prevent abuse we count how many homepages and emails are requested each day from each connection: we don’t store your IP, only an encrypted code that changes every day, and we delete it after two days.
• Data processors: Cloudflare (hosting and database), Anthropic (the headline) and Brevo (sending the email, an EU company). Cloudflare and Anthropic may process data in the US, with the safeguards the GDPR requires (Data Privacy Framework or standard contractual clauses).

If you book a call

Calls are booked with Cal.com, which only opens when you press “Reservar llamada”. You give your name and email to Cal.com to confirm the appointment and send you the video call link; if you used the configurator, we keep the date next to your homepage. The legal basis is your request. Cal.com acts as a data processor and may process data in the US, with the safeguards the GDPR requires. We keep the appointment details for 12 months if we don’t end up working together.

If you write to us

We use your name, your email address and whatever you tell us only to reply and, if we end up working together, for the project. The legal basis is your request and, where applicable, the contract. We keep the conversation while the relationship lasts and then for as long as tax law requires. Email is handled by Google (Gmail) as a data processor.

If we emailed you

• What data: the business name, its website, its town and the email address published on that website.
• Where it comes from: your business’s public website. Only generic company addresses, never bought lists.
• What for: to write to you once to introduce our work and, at most, to send one reminder.
• Legal basis: legitimate interest (article 6(1)(f) GDPR) in offering a professional service to another business.
• Who it is shared with: no one.
• How long: while we keep offering our work to businesses in your sector. If you unsubscribe, we keep only your address on a suppression list, so we never write to you again.
• Unsubscribe: reply with the word “BAJA” or write here.

Your rights

You can ask for access, rectification, erasure, objection, restriction or portability of your data by writing to [email protected]. If you think we are not handling it properly, you can complain to the Spanish Data Protection Agency (aepd.es).