Privacy policy

01 Who is responsible for your data

Capplet is operated by Daniel Poncelas Vargas, tax ID 73607275F, with a registered address in Valencia, Spain. You can reach us at hello@capplet.com about anything on this page.

We are the data controller for the personal data described here. We are established in Spain, so this site is governed by the EU General Data Protection Regulation and by Spanish data protection law, wherever in the world you happen to be reading it.

02 What we collect

From the contact form, only what you type into it: your name, your email address, and optionally your company, your role, how you heard about us, your expected investment range, the type of project you need, and whatever you write in the message field. Email and investment range are the only required fields.

From the booking calendar, if you choose to book a call: your name, your email address, your company website, what you tell us you need built, and optionally a budget range. The calendar is not loaded until you move towards a booking button, so simply reading this site sends nothing to it.

From your visit, our hosting provider keeps standard server logs: IP address, browser, the pages requested and the time. These are generated automatically by any web server and are used to keep the site running and secure.

We do not collect anything else. There is no analytics, no advertising pixel, no session recording and no profiling on this site.

03 Why we use it, and on what legal basis

To answer you and to prepare a quote. The legal basis is Article 6(1)(b) of the GDPR: steps taken at your request before entering into a contract.

To keep the site secure and working. The legal basis is Article 6(1)(f), our legitimate interest in operating a service that is not being attacked or abused.

To comply with accounting and tax obligations if you become a client. The legal basis is Article 6(1)(c), a legal obligation.

We do not send newsletters and we do not add you to any marketing sequence. If you write to us, we reply. That is the whole of it.

04 Who else sees it

Cloudflare, which hosts the site and keeps its server logs. Google Workspace, which delivers and stores our correspondence with you. Resend, which delivers the email generated when you submit the contact form. And Cal.com, which runs the booking calendar and holds what you enter when you book a call. Nobody else receives your data.

Each of these acts as a data processor under a contract that limits what they may do with the data. We do not sell your data, and we do not share it with anyone for their own purposes.

05 Where it goes

Our form email is processed in the European Union, in Ireland. Some of the other providers are established outside the European Economic Area or store data there. When that happens, the transfer relies on an adequacy decision by the European Commission or on Standard Contractual Clauses, as required by Chapter V of the GDPR.

06 How long we keep it

Enquiries that do not turn into work: up to twelve months from your last message, so we have context if you come back.

Client records: six years from the end of the engagement, which is the retention period Spanish commercial and tax law requires.

Server logs: no more than twelve months.

07 Your rights

You can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop processing it, and ask for it in a portable format. Where processing rests on legitimate interest, you can object to it.

Write to hello@capplet.com and we will respond within one month. We may ask you to confirm your identity first, so that we are not handing your data to somebody else.

If you think we have handled your data badly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es), or to the supervisory authority where you live.

08 Cookies

This site sets no cookies and runs no third-party scripts.

It does store one flag in your browser, in session storage, to remember that you have already seen the opening animation so that it does not play again. It contains no personal data, it never leaves your device, and it is deleted when you close the tab.

If we ever add analytics, we will ask for your consent before anything loads, and this page will say so.

09 How we protect it

We apply the technical and organisational measures appropriate to the risk: encrypted connections across the whole site, access limited to the people who need it, providers chosen for their own security record, and no copies of your data kept anywhere they do not need to be.

No system is perfect. If a breach ever affected your data and posed a risk to you, we would tell you and notify the Spanish Data Protection Agency, within the 72 hours the GDPR allows.

10 Changes

If we change this policy we will change the date at the top. If the change is significant and we have your email because you contacted us, we will tell you.

By using this site you accept this policy. If you do not agree with it, please do not use the site or send us your data.