Privacy Policy
This is a courtesy translation. The Spanish version is the legally binding one. You can read it here: Política de privacidad.
Data controller: Pedro Cantueso García de Vinuesa —
Spanish tax ID (NIF) 45748777Y — Avenida de la Arruzafa 50, 14012 Córdoba, Spain.
Contact: [email protected].
There is no data protection officer: one is not required given the type and volume of processing. When you write to that address, you are talking directly to the controller.
1. What data we process, and why
| Data | Why | Legal basis (GDPR) | How long we keep it |
|---|---|---|---|
| Recipient's name, date, time and place of the event, and the phrase you chose | To calculate and generate your product: this is literally the raw material | Art. 6.1.b — performance of the contract; afterwards, Art. 6.1.f — warranty and legal defense | Generated files: 30 days from delivery. The order record (the data you entered plus the delivery log): 2 years from delivery, so we can honor the statutory warranty of conformity and redo your order if needed; after that it is anonymized |
| Email address | To deliver your order, confirm your purchase, handle any issues, and ask you — once, and only once — for your opinion | Art. 6.1.b; for the one-time review invitation, Art. 6.1.f together with Art. 21.2 of the Spanish LSSI | 2 years from delivery (warranty period); then deleted |
| Billing details: name or company name, billing address and, if you buy as a business or professional and choose to provide it, your tax ID (NIF or EU VAT number) | To issue your invoice with the correct VAT, apply the reverse charge where applicable, and meet our tax obligations. Stripe collects these on its payment screen and passes them to us for invoicing | Art. 6.1.c — legal obligation (invoicing and VAT rules); Art. 6.1.b for what constitutes performance of the contract | Up to 6 years (accounting and tax obligations) |
| Proof of your consent to immediate delivery (text, date, IP address) | To prove your waiver of the right of withdrawal in the event of claims and chargebacks. The date, the IP address and a fingerprint of the text also travel to Stripe as transaction data, so the proof exists outside our server if there is ever a bank dispute | Art. 6.1.f — defense against claims | Up to 5 years (Art. 1964 of the Spanish Civil Code) |
| Review (first name and initial, city of the order, star rating and text) | Publishing verified reviews; your email is used only to confirm the purchase | Art. 6.1.b and, for the invitation, Art. 6.1.f | For as long as the review stays published; you can ask us to take it down at any time |
| Order reference, amount, package and date | Accounting and tax records | Art. 6.1.c — legal obligation (Arts. 29 and 30 of the Spanish Commercial Code; Art. 66 of the Spanish General Tax Law) | Up to 6 years |
| IP address and technical data about the request | Security, abuse prevention and error diagnostics | Art. 6.1.f — legitimate interest | Logs: 30 days |
Where this data comes from. You give us all of it when you place your order, except the billing details and the payment result, which Stripe passes to us from its own screen, and the technical data, which your own connection generates. We do not buy lists or obtain data about you from third parties. If the gift is for someone else and it is their data you enter, everything we explain here applies to them too: show them this page or tell us how to reach them.
None of this is mandatory in the abstract, but without the event data the product cannot be calculated, and without your email it cannot be delivered: no data, no order.
2. What we do NOT do
- We do not sell or share your data with anyone for commercial purposes.
- We do no profiling and make no automated decisions with legal effects on you.
- We do not use your data to train AI models — not ours, not anyone else's.
- We never touch your card. Payment details are collected and safeguarded by Stripe on its own payment screen: they never pass through our server at any point and we never get to see them. All we receive is the signed notice that payment is complete, the order reference, and the billing details needed to issue your invoice.
- We do not set advertising cookies without your permission. The entire site runs on the storage strictly necessary for your order, which requires no consent (Art. 22.2 of the Spanish LSSI). The only optional piece is Meta's ad measurement (the pixel), which is only activated if you expressly accept it in the cookie notice; if you decline, nothing is installed. Details, and how to change your mind, in the cookie policy.
3. An honest word about the birth date
For the birth product you give us a date, time and place of birth. These are ordinary personal data, not special categories, but you should know that in the wrong hands they can be used to verify someone's identity. That is why they travel encrypted, are stored on our own server with restricted access, are not shared with third parties beyond what is listed below, and are deleted 30 days after delivery. If you are giving the product to someone else, make sure you have their consent to use their data.
4. Who else touches your data
| Who | Why | Where |
|---|---|---|
| Stripe Payments Europe, Limited | Processes the payment: collects and safeguards your card details on its own screen, collects the billing details and issues the invoice on our behalf. Stripe is not the seller — we are. It acts as a data processor on our behalf and, for fraud prevention and its own legal and regulatory obligations, as an independent controller | Ireland (EU). Stripe may transfer data outside the European Economic Area, including to the US and India, relying on the European Commission's standard contractual clauses and/or the EU–US Data Privacy Framework, to which Stripe is certified |
| Hetzner Online GmbH | Hosting for the web server, the database and your files | Germany (EU) |
| Cloudflare, Inc. | Protection and delivery of web traffic | EU / US, with standard contractual clauses |
| Resend, Inc. | Sending the delivery emails | US, with standard contractual clauses |
| Meta Platforms Ireland Ltd | Measuring our advertising (pixel and Conversions API), only if you accepted advertising cookies; your email travels as an irreversible hash (Art. 6.1.a — consent, revocable in the cookie policy) | Ireland (EU) / US, EU–US Data Privacy Framework and standard clauses |
| Google Ireland Limited (Google Drive) | Archiving of invoices and, if a bank ever disputes a charge, of the file for that dispute (which includes your order and the proof that you received what you bought). It is an internal archive: no one else has access to that folder | Ireland (EU) / US, EU–US Data Privacy Framework and standard contractual clauses |
| Telegram (Telegram FZ-LLC) | Human review before your order is delivered: the print, the audio and the video are sent to the controller's private channel to be checked one by one. It is the controller's private channel, not a group or a public channel | United Arab Emirates, with standard contractual clauses. If you would rather your order skip that review, write to us before buying and we will check it another way |
| The controller's own equipment (Córdoba, Spain) | Generation of the prints, the voice and the video. Your texts never leave for any third-party AI service: the voice engine is ours and runs on our own hardware | Spain |
Beyond this list, your data is only disclosed to the tax authorities, the courts or law enforcement when a law or a court order requires it (Art. 6.1.c GDPR), and to our tax or legal advisors if we ever need to defend against or pursue a claim. Nothing else, and never for commercial purposes.
Transfers outside the European Economic Area rely on the standard contractual clauses approved by the European Commission and, where the recipient is certified, on the EU–US Data Privacy Framework. If you would like a copy of the safeguards that apply to a specific recipient, just ask and we will send it to you.
5. Your rights
You can exercise, free of charge and at any time, your rights of access, rectification, erasure, restriction, portability and objection, and withdraw any consent you have given without affecting the processing carried out before. Just email [email protected] with your order reference. We reply within one month at most.
Keep in mind that if you request erasure early you will lose access to your downloads, and that we are legally required to keep the billing data even if you ask us to delete everything else. The same goes for the proof of your consent: we keep it so we can defend ourselves against a claim or a chargeback, which is a recognized legitimate interest — though you can object and we will look at your case.
If you feel we have not treated you fairly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es, C/ Jorge Juan 6, 28001 Madrid, Spain) or with the supervisory authority in your own country.
6. Security
Traffic is encrypted end to end (TLS). The server only accepts connections on the essential ports, service keys live in environment variables with restricted permissions — never in the browser or in public code — and admin access requires its own credentials. No system is infallible: if a breach ever occurred that put your rights at risk, we would notify you and report it to the Agency within the 72 hours the law requires.
7. Minors
Purchases are intended for adults. You are welcome to give the product to a minor — a birth print, for example — as long as it is their mother, father or legal guardian who provides the data.
8. Changes
If this policy changes, the new version is published here with its date. If a change affects you in a meaningful way and we have your email, we will let you know.