Privacy policy

Last updated: 2026-05-15

Identity of the data controller

Legal name: Sergio Ramón Figuera Laiz (sole trader, trading as Ithildin Labs)

Spanish tax ID (NIF): 71438851T

Registered address: C/ Carretera de Castilla 765 3ºB

Sergio Ramón Figuera Laiz acts as the data controller for the personal data collected through this website, in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, hereinafter the "GDPR") and Spanish Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights ("LOPDGDD"). Because the controller is established in Spain, Spanish data-protection law applies to the processing described below, including for users located outside Spain (Article 3.1 of the GDPR).

Data we collect

Through the website's contact form we collect the following personal data provided by the user:

Full name.
Email address.
Project type (selection from a list).
Project description (free text, maximum 2000 characters).
Indicative budget (optional).
Submission timestamp (UTC).
Sender IP, retained only for the duration of processing (anti-spam).

In addition, the site uses web analytics through Umami Cloud (cloud.umami.is), without cookies, without browser fingerprinting, and respecting the browser's Do-Not-Track header. Umami Cloud records aggregate traffic metrics (page views, referrers, countries) without identifying the visitor.

Data processors

Personal data is processed by the following processors, with whom the controller maintains the corresponding processing agreements under Article 28 of the GDPR:

Resend (resend.com) — transactional email delivery. Location: United States. International transfers are covered by the Standard Contractual Clauses approved by the European Commission (Article 46 of the GDPR).
Hostinger (hostinger.es) — website hosting. Location: European Union (Lithuania).
Umami Cloud (operated by <entity-name-from-DPA>; cloud.umami.is) — cookie-free web analytics. Data is transmitted to Umami Cloud's infrastructure and processed under the Data Processing Agreement (DPA) signed with the controller. Location: European Union (per Umami Cloud's declared default; verify against the DPA).

Processing purposes

Personal data is collected for the following purposes, in accordance with Article 13.1.c of the GDPR:

To attend to the user's initial request and respond to the inquiry submitted.
To follow up during the engaged project's duration and the 24 months thereafter.
To improve the site through aggregate traffic analytics (Umami).

We do not use personal data to send unsolicited commercial communications (marketing) and we do not share it with third parties other than the processors listed in the previous section.

Data retention

Contact-form data is retained for the duration of the engaged project plus a follow-up window of 24 months thereafter, after which it is deleted from the controller's internal systems and from Airtable (once integrated in the v1.0 phase).

Umami Cloud's aggregate analytics records are retained for <X> (per the contracted plan's settings and Umami Cloud's DPA-documented retention policy) and deleted automatically.

User rights and procedure

Under the GDPR (Articles 15 to 22), users may exercise the following rights over their personal data: access, rectification, erasure, objection, restriction of processing, and portability.

To exercise any right, write to studio@ithildinlabs.tech stating clearly the request and the email address used in the original submission. We will respond within a maximum of 30 calendar days, in accordance with Article 12.3 of the GDPR.

Users may also lodge a complaint with the Spanish Data Protection Agency (aepd.es), the supervisory authority competent for data protection in Spain. Because the controller is established in Spain, the AEPD is a competent authority for users in any country, including users located outside Spain; under Article 77.1 of the GDPR, users may also lodge a complaint with the supervisory authority of their habitual residence, place of work, or place of the alleged infringement.

Cookies and similar technologies

The site does not set first-party or third-party cookies in its current version. Analytics is performed through Umami Cloud, which operates without cookies and without persistent browser storage. Your language is determined by the URL path (/ for Spanish, /en/ for English) and is not stored in the browser; we store your theme preference (ithildin-theme) and your cookie consent state (ithildin-consent) in localStorage, both of which are strictly necessary to remember your choices across visits.

From v2.0 onward the site shows a consent banner for any extended tracking; the full detail of cookie usage and of the localStorage entries is documented in the Cookie policy. The site relies on the strictly-necessary-cookies exemption of Article 22(2) of the Spanish LSSI-CE for the localStorage entries described above.