Privacy policy

1. Data controller

Aullando Studio. Contact: lab@aullando.studio. Site: https://aullando.studio.

2. What we collect and why

Contact form. Name, email, optional company/website, message, GDPR checkbox, submission timestamp, browser user-agent, landing URL, referrer and UTM parameters (utm_source / utm_medium / utm_campaign) when present. Purpose: reply to your enquiry. Legal basis: consent (GDPR art. 6(1)(a)) and pre-contractual measures (art. 6(1)(b)).

Aullando Journal subscription. Email, language and source. Double opt-in: until you confirm via the email link you receive no further communications. Legal basis: consent (art. 6(1)(a)). You can unsubscribe at any time from the footer link.

Audio sharing. Email, WhatsApp number, GDPR checkbox, post being shared, channel (WhatsApp, Telegram or email), page URL, referrer, UTM, user-agent and an irreversible hash of your IP (truncated SHA-256) for abuse prevention. We never store your raw IP. Legal basis: consent (art. 6(1)(a)).

First-party analytics (opt-in only). If you click "Accept analytics" on the cookie banner, we record pageviews and aggregate interaction events (CTA clicks, calculator usage, audio playback in the Journal). Each visit uses an anonymous session identifier scoped to the browser tab and we derive browser, OS and device type from the User-Agent. Country is taken from the Cloudflare edge header; your IP is not stored. We do not profile, do not share with ad networks and do not use third-party cookies. Legal basis: consent (art. 6(1)(a) and the Spanish LSSI).

Anti-spam protection (Cloudflare Turnstile). The contact, newsletter and audio-share forms use Cloudflare Turnstile, a cookieless captcha that verifies you are not a bot. Cloudflare receives your IP and basic browser metadata strictly for that purpose. Legal basis: legitimate interest (art. 6(1)(f)) in protecting our forms.

AI-assisted lead diagnostics. When you contact us we may run the message body (not your contact details) through AI models accessed via Lovable AI Gateway to produce an internal summary and suggestions. The output is stored alongside the lead and used only to prepare our reply. Legal basis: legitimate interest (art. 6(1)(f)) in handling the commercial relationship.

3. What we do NOT collect

• No advertising or tracking cookies.
• No social pixels, no Google Analytics.
• We do not sell or share your data for commercial purposes.
• We never store your raw IP address in any table.

4. Retention

Contact enquiries and associated leads: for the duration of the relationship and afterwards up to 5 years. Newsletter: until you unsubscribe. Audio-share leads: up to 24 months. Analytics events: up to 24 months in aggregated form.

5. Recipients & transfers

• Supabase Inc. — database and file storage under EU Standard Contractual Clauses.
• Cloudflare, Inc. — CDN, edge runtime and Turnstile captcha.
• Resend — transactional and Journal email delivery. Receives your email and the message body.
• AI providers via Lovable AI Gateway (models from Google and OpenAI, as applicable). Receives the message body from the contact form to generate internal summaries.

No data is shared with third parties except where legally required.

6. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to lab@aullando.studio. You can also withdraw analytics consent by clearing site storage in your browser, and lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or your local supervisory authority.

7. Security

TLS in transit, role-based access control, salted hashing of IPs before storage, audit logs and encrypted backups.

8. Changes

We may update this policy. The latest revision date will always appear at the top.