Legal
Privacy policy
In short. We collect what you send us through the project brief form and the technical data needed to deliver this website. We use it to reply to you and, if you ask, to prepare a proposal. We do not sell it, use it for advertising or send marketing emails. This website uses no cookies, analytics or tracking. You can access, correct or delete your data at any time.
Who is responsible for your data
The controller of your personal data is Alberto Campos, who offers services under the trade name Hesvian Labs.
- Controller
- Alberto Campos (Hesvian Labs)
- Address
- Paseo de la Castellana 135, 7ª planta, 28046 Madrid, Spain
- Privacy contact
- acamposlopez@hesvianlabs.com
What this policy covers
This policy covers this website, the project brief form and the emails we exchange as a result. If you become a client, the agreement with your company will describe how personal data is handled during the project.
The data we collect
When you send a project brief
Your name, work email, company, the type of project, the investment range, the tools you use (optional) and your description of the process you want to change, together with anything else you choose to write. The required fields are needed to reply to you; you do not have to give us any data, but without them we cannot answer.
Please do not include passwords, confidential business information, special categories of data (such as health data) or other people’s personal data.
When you email or message us
Your contact details and the content of your messages.
When you visit the website
- Our form endpoint uses your IP address to limit repeated submissions (no more than ten per hour). It is held in memory only, deleted within about an hour, never written to disk and not shared with anyone.
- The website runs on a virtual server that we manage, provided by IONOS and located in the United States. To deliver each page, the server processes your IP address and technical details of the request, such as the page requested and your browser type. It does not keep a log of the pages you visit. If a request fails because of a technical error, the error record includes the IP address and the details of that request; these records are kept in rotating files of limited size and are overwritten as new ones are written.
- We do not use analytics, advertising, fingerprinting or session recording.
Why we use it and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Replying to your brief, asking questions and preparing a proposal | Form data and the emails we exchange | Steps you ask us to take before a possible contract (GDPR art. 6(1)(b)). When you write on behalf of a company, our legitimate interest in answering business enquiries and keeping in touch with that company (GDPR art. 6(1)(f) and art. 19 of Spain’s Organic Law 3/2018). |
| Protecting the form against spam and abuse | IP address (in memory) and a hidden spam-trap field | Legitimate interest in keeping the form secure (GDPR art. 6(1)(f)). |
| Delivering the website securely | Technical data of each request and server error records | Legitimate interest in operating and securing the website (GDPR art. 6(1)(f)). |
| Meeting legal obligations if an engagement follows | The data needed for contracts, invoicing and accounting | Legal obligations (GDPR art. 6(1)(c)). |
Where we rely on legitimate interest, the processing is limited to what you would reasonably expect when you contact a business, and you can object to it at any time.
We do not make automated decisions or build profiles that have legal or similarly significant effects on you. We do not send marketing emails; if we ever want to, we will ask for your permission separately.
Who receives your data
- Arsys Internet, S.L.U. (Spain) hosts our email inbox. The form sends your brief there directly from our server, and it is where we receive and keep the emails we exchange.
- IONOS provides the virtual server, located in the United States, on which this website and its form run. The server passes your brief on to our inbox and does not store it.
- Anthropic: we may use Claude, its AI assistant, to read or summarise briefs and emails and to help us prepare replies and proposals. Anthropic processes that content to provide the service, as described in its privacy policy. We do not use it to make decisions about you.
We do not sell or rent personal data and do not share it for advertising. We may disclose data when the law requires it, for example to public authorities or courts.
International transfers
Part of this processing takes place outside the European Economic Area, in the United States:
- Website server (IONOS). The server is located in the United States, so the data you send through this website, including the content of the form, is processed there while it is delivered to our inbox. It is not stored on the server.
- Anthropic. Content we process with Claude may be transferred to the United States. According to its privacy policy, Anthropic relies on the European Commission’s standard contractual clauses for these transfers.
Our email provider, Arsys Internet, S.L.U., is established in Spain.
How long we keep it
- Briefs and related emails, when no engagement follows: for as long as needed to reply and follow up, and no longer than 12 months after our last exchange. Then we delete them.
- If an engagement follows: for the duration of the relationship and afterwards for the periods required by tax and commercial law or needed to handle possible claims.
- Content processed with Claude: Anthropic keeps it for the periods described in its privacy policy.
- IP addresses used to limit submissions: in memory, for about an hour.
- Server error records: in rotating files of limited size, overwritten as new records are written. The server keeps no log of visits and does not store briefs.
Your rights
You can ask us to:
- give you access to your personal data and a copy of it;
- correct data that is inaccurate or incomplete;
- delete your data;
- restrict how we use it;
- stop using it when we rely on legitimate interest (objection);
- receive the data you gave us in a portable format, where applicable.
Write to acamposlopez@hesvianlabs.com and say which right you want to exercise. We will only ask for more information if we need it to confirm your identity. We reply within one month; for complex requests this can be extended by two further months, and we will tell you if that happens. Exercising your rights is free.
You can also complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or, if you live or work in another EU or EEA country, to the supervisory authority there. We would appreciate the chance to address your concern first.
Cookies and similar technologies
This website does not set cookies and does not use similar technologies such as local storage, session storage, IndexedDB, tracking pixels or fingerprinting. We checked this on November 10, 2026 by visiting every page in a standard browser and using its interactive features: the motion and logo controls, the pricing details and the project brief form. Fonts, images and scripts are served from this website itself; there is no analytics, advertising or embedded third-party content. That is why there is no cookie banner.
The server that delivers this website is managed by us and does not set cookies either.
If this changes, we will update this section before using any cookie or similar technology and ask for your consent whenever it is required. Because we do not track visitors across websites, “Do Not Track” and Global Privacy Control signals do not change how this website behaves.
Security
We apply measures appropriate to the risk: the form endpoint validates and limits what it receives and blocks automated submissions, briefs are sent to our inbox over an encrypted connection and are not stored on the server, and access to the inbox is restricted. No system is completely secure. If a breach affected your data, we would notify the supervisory authority and, where required, you.
Children
This website is intended for businesses and professionals and is not directed to children.
Changes to this policy
We will update this policy when the way we handle data changes. The date at the top shows the current version, and significant changes will be highlighted on this page.