Privacy policy

01 Who is responsible for your data

Capplet is operated by Daniel Poncelas Vargas, tax ID 73607275F, with a registered address in Valencia, Spain. You can reach us at hello@capplet.com about anything on this page.

We are the data controller for the personal data described here. We are established in Spain, so this site is governed by the EU General Data Protection Regulation and by Spanish data protection law, wherever in the world you happen to be reading it.

02 What we collect

From the contact form, only what you type into it: your name, your email address, and optionally your company, your role, how you heard about us, your expected investment range, the type of project you need, and whatever you write in the message field. Email and investment range are the only required fields.

From the booking calendar, if you choose to book a call: your name, your email address, your company website, what you tell us you need built, and optionally a budget range. The calendar is not loaded until you move towards a booking button, so simply reading this site sends nothing to it.

From your visit, our hosting provider keeps standard server logs: IP address, browser, the pages requested and the time. These are generated automatically by any web server and are used to keep the site running and secure.

And if you arrived from one of our ads, we measure whether that ad worked. That is what the Meta pixel does, explained under cookies below.

03 Why we use it, and on what legal basis

To answer you and to prepare a quote. The legal basis is Article 6(1)(b) of the GDPR: steps taken at your request before entering into a contract.

To keep the site secure and working. The legal basis is Article 6(1)(f), our legitimate interest in operating a service that is not being attacked or abused.

To comply with accounting and tax obligations if you become a client. The legal basis is Article 6(1)(c), a legal obligation.

We do not send newsletters and we do not add you to any marketing sequence. If you write to us, we reply. That is the whole of it.

04 Who else sees it

Cloudflare, which hosts the site and keeps its server logs. Google Workspace, which delivers and stores our correspondence with you. Resend, which delivers the email generated when you submit the contact form. Cal.com, which runs the booking calendar and holds what you enter when you book a call. PostHog, which measures how the site is used and records browsing sessions, hosted on servers inside the European Union. And Meta, which measures whether our advertising brought you here: when you submit a form, it receives a one-way encrypted version of your email address so it can match the visit to an ad, never the address itself. Nobody else receives your data.

Each of these acts as a data processor under a contract that limits what they may do with the data. We do not sell your data, and we do not share it with anyone for their own purposes.

05 Where it goes

Our form email is processed in the European Union, in Ireland. Some of the other providers are established outside the European Economic Area or store data there. When that happens, the transfer relies on an adequacy decision by the European Commission or on Standard Contractual Clauses, as required by Chapter V of the GDPR.

06 How long we keep it

Enquiries that do not turn into work: up to twelve months from your last message, so we have context if you come back.

Client records: six years from the end of the engagement, which is the retention period Spanish commercial and tax law requires.

Server logs: no more than twelve months.

07 Your rights

You can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop processing it, and ask for it in a portable format. Where processing rests on legitimate interest, you can object to it.

Write to hello@capplet.com and we will respond within one month. We may ask you to confirm your identity first, so that we are not handing your data to somebody else.

If you think we have handled your data badly, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es), or to the supervisory authority where you live.

08 Cookies and measurement

The site needs no cookies to work. It stores one flag in your browser session to remember that you have already seen the opening animation, so it does not play again: no personal data, it never leaves your device, and it disappears when you close the tab. And if you pick a language in the switcher, we keep that preference in a cookie for a year so we do not change it back on you.

We also run two measurement tools that do process personal data. The Meta pixel, to find out whether our advertising works. And PostHog, to understand how the site is used: which pages get visited, where a form gets abandoned and, through session recordings, how the page is navigated. Those recordings capture movement, clicks and scrolling; they do not capture what you type into form fields, which is masked before anything is stored.

PostHog is hosted in the European Union, so that data does not leave it.

You can block it from your browser or with any blocking extension, and the site works exactly the same. Nothing here depends on you accepting measurement.

09 How we protect it

We apply the technical and organisational measures appropriate to the risk: encrypted connections across the whole site, access limited to the people who need it, providers chosen for their own security record, and no copies of your data kept anywhere they do not need to be.

No system is perfect. If a breach ever affected your data and posed a risk to you, we would tell you and notify the Spanish Data Protection Agency, within the 72 hours the GDPR allows.

10 Changes

If we change this policy we will change the date at the top. If the change is significant and we have your email because you contacted us, we will tell you.

By using this site you accept this policy. If you do not agree with it, please do not use the site or send us your data.