Privacy policy

Data controller

ARTEFACTO E2E S.L., NIF B67612382, with its address at Pl. Pau Vila 1, edifici Palau de Mar, piso 2, puerta 2A2, 08039 Barcelona, Spain.

You can contact hola@artefacto-studio.com or the address above for privacy matters and to exercise your rights. The contact telephone number is +34 629 390 854. The appointment of a data protection officer has not been confirmed.

Data we may receive

Enquiries and registrations: the fields displayed in each form, such as name, email address, company, message and selected options; the relevant form and event, language, date, referring page without query parameters and, if available, the last description submitted to the project search tool from that browser. The acceptance required by the form and the delivery status are also recorded.

Project search tool: the description submitted, language, date, outcome of the process and suggested projects. The text is saved in a private collection before a recommendation is attempted, so it may also be retained if there are no matches or an error occurs.

Security and operation: technical connection data needed to serve the website, verify forms and limit abuse. Request limiting uses an identifier derived from the IP address through a cryptographic function; this identifier should not be considered anonymous. Infrastructure logs and retention periods have yet to be inventoried.

Mandatory fields are indicated in each form. If you do not provide them, we will not be able to process that submission. You do not need to use the AI search tool or accept analytics to browse the website or contact us by email.

What the data is used for

Responding to enquiries and collaboration requests, managing registrations and necessary communications about events, and organising internal follow-up of those requests.

When the AI function is enabled, comparing your project’s context with published work to suggest relevant examples. Following a general enquiry, the system may also use the message and company context fields and the previous search description to suggest projects. This process does not apply to registrations identified as events.

Preventing automated submissions and abuse, maintaining security and managing authorised accounts for the editorial team. Editorial accounts are not visitor accounts.

Managing the newsletter through Synerise when you request it using a specific option. Submitting an enquiry, registering for an event or using the search tool does not in itself subscribe you.

If optional analytics is activated and you authorise it, measuring use of the website. PostHog or Google Analytics 4 are planned options that are not yet active, according to information from the website owner. There are no plans to install advertising pixels.

Legal bases: scope and outstanding confirmations

Optional analytics requires your prior consent. Voluntary newsletter subscription is envisaged on the basis of specific consent, separate from the enquiry or registration, which you may withdraw at any time. How that choice is evidenced and synchronised with Synerise and its mailings must be verified before launch.

The current forms require acceptance of processing to respond to an enquiry or manage a registration. That checkbox alone does not determine or establish the legal basis for all subsequent uses. The controller must confirm the basis applicable to enquiries and registrations, follow-up in Synerise, retention of descriptions and AI inference.

Depending on the request and the existing relationship, the appropriate basis may be taking steps at the data subject’s request prior to entering into a contract, performing a contract, complying with a legal obligation or obtaining specific consent. We do not state that all these bases apply simultaneously. If legitimate interests are relied on for security or internal organisation, the specific interest and the corresponding assessment must be identified. These matters remain subject to validation.

Access to data and external services

Authorised Artefacto staff can view stored requests and descriptions. The code allows enquiries to be notified to the team by email through Resend and form data to be sent to Synerise to create or update a profile by email address and record the submission and its context. These deliveries depend on activation and configuration. The website owner has confirmed the use of Synerise, including for the newsletter.

Server-side transmission to Synerise is independent of consent to its browser analytics. It includes form fields and may include context from a previous search. Rejecting analytics cookies does not in itself erase or block that processing of the request. The legal basis and subsequent uses of these profiles must be specified before launch.

Cloudflare Turnstile protects forms when configured. The browser connects to Cloudflare and the server verifies the security token. We do not send form fields to that verifier as part of the verification request. This does not mean that Cloudflare does not process other technical data.

The deployment documentation specifies Vercel for hosting, Neon for the database and Cloudflare R2 for files. The contracted entities, locations, access arrangements and actual terms must be confirmed. The code also supports local storage or other compatible services; the example configuration does not establish which is active.

Typesafe AI is the only AI provider integrated into the recommendations code. According to the website owner, it is not yet configured. Activating it involves sending the descriptions and project context specified in this policy to its API. OpenAI and Runware are planned providers, with no integration identified in these flows. Planning to use them does not mean they receive visitor data.

Data processing arrangements, subprocessors and any processing by providers for their own purposes remain subject to contractual verification. No guarantee is given here that providers exclude training, erase data immediately or operate solely within the European Economic Area.

International transfers

Providers’ hosting, support and processing locations have not been confirmed. This draft therefore does not state that all data remains in the European Union or that a particular transfer mechanism is already in place.

Before activating services involving transfers outside the European Economic Area, the destination and the basis permitting the transfers must be identified, together with the applicable safeguards and how to obtain information about them or a copy of them. You can request information at hola@artefacto-studio.com; this section must be completed with the actual contractual details.

Retention and deletion

No approved retention schedule has been provided for enquiries, registrations, the newsletter, AI descriptions, technical logs or backups. The code reviewed does not set automatic expiry for enquiries and descriptions saved on the server.

Specific periods or criteria, periods required by legal obligations and arrangements for data blocking and deletion must be defined before this policy is published in its final form. A delivery retry window or an API timeout is not a retention period.

The cookies policy describes verifiable periods for browser storage. Deleting a description or recommendation in the browser does not delete copies already sent to the server, email or other services. To request erasure, use the rights contact channel indicated below.

Your rights

You may exercise your rights of access, rectification, erasure and restriction of processing and, where applicable, your rights to data portability and to object. Where processing is based on consent, you may withdraw it without affecting the lawfulness of prior processing.

Write to hola@artefacto-studio.com or to the controller’s address, setting out your request and the details needed to locate it. Additional identity information will be requested only where necessary and proportionate. Requests are generally handled within one month; any permitted extension will be communicated as required by law.

You may unsubscribe from the newsletter using the unsubscribe mechanism in its communications or by writing to the same email address. Cookie preferences allow you to withdraw consent to analytics.

You may lodge a complaint with the Spanish Data Protection Agency through https://www.aepd.es/, particularly if you believe we have not properly addressed your rights.

Recommendations and automated decisions

The AI system ranks and selects published projects based on the text provided. It does not decide whether to accept clients, enter into contracts, set prices or grant access to rights or services. No solely automated decisions with legal or similarly significant effects have been identified in the flows reviewed.

Recommendations are displayed automatically and may be inaccurate. No individual human review of each result before display has been identified. You can explore the projects and request human assistance by email. Consult the AI transparency information to learn about how the system works and its limitations.

Updates

Adding new providers or purposes requires this information to be reviewed before processing begins and, where appropriate, fresh consent to be obtained. Services described as planned are not deemed authorised simply because they appear in this document.