This is a translation for convenience. In case of discrepancy, the Spanish version prevails.
Privacy policy
Last updated: 17 October 2026
Summary
- We use your data to reply to your message and prepare a proposal. We do not send newsletters or advertising you have not asked for.
- This website does not use tracking cookies or analytics tools.
- Your email passes through email providers based in the USA (see section 5).
- You can exercise your rights by writing to hello@grawwww.xyz.
1. Data controller
- Controller: Óscar Bernárdez, NIF (Spanish tax ID) 47468048G, trading as Grawwww (Grawwww Studio)
- Address: C/ Parque Bujaruelo 18, Spain
- Contact: hello@grawwww.xyz
2. What data we process, why, and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Handling your enquiry and keeping up the conversation by email | Name, email address, company, the content of your messages and any files you send us | Art. 6.1.b (pre-contractual measures at your request) and, where the enquiry is not aimed at contracting, art. 6.1.f (legitimate interest in replying to those who write to us) |
| Preparing and sending you a proposal or quote | The above, plus the project information you provide | Art. 6.1.b |
| Providing the contracted service, invoicing and collecting payment | Billing details (name or company name, NIF/CIF (Spanish tax IDs), address, email), payment details (bank transfer) and details of the commission | Art. 6.1.b (performance of the contract) and art. 6.1.c (tax and accounting obligations) |
| Website security | IP address and technical data of the request (server logs) | Art. 6.1.f (legitimate interest in keeping the site secure) |
We do not take automated decisions with legal effects on you, nor do we carry out profiling. If you do not provide the data needed to reply to you or to contract, we will not be able to deal with your request. We do not collect data automatically on this website beyond the technical server logs.
To read, sort and prepare draft replies we use artificial intelligence tools. A person reviews and decides what is sent. The providers of these tools act as data processors.
3. How long we keep your data
- Enquiries that do not lead to a contract: up to 12 months from the last message, after which they are deleted.
- Clients: for as long as the relationship lasts and, afterwards, blocked for the legal limitation periods (art. 32 LOPDGDD, the Spanish Data Protection Act). Invoices and accounting books are kept for the applicable tax and commercial periods (generally between 4 and 6 years).
- Server logs: the minimum time necessary for security. Access logs are kept for 14 days.
4. Recipients
We do not sell or transfer your data. Only providers who supply services to us and who act on our behalf as data processors (art. 28 GDPR) have access to it:
- Cloudflare, Inc.: manages the domain and forwards the email that arrives at hello@grawwww.xyz. Normally the website is served from the owner's own server and reaches your browser through Cloudflare (Cloudflare Tunnel), which acts as a technical intermediary and may process your IP address and the technical data of the request.
- Google Cloud: during periods when access to the website through Cloudflare is not possible (for example, because of IP address blocks affecting shared infrastructure), the website is temporarily served from a Google Cloud virtual machine located in South Carolina (USA). During those periods your browser connects directly to that machine and its access logs (IP address, date and time, page requested and technical data of the browser) are stored on it. Google acts as a data processor (art. 28 GDPR).
- AgentMail, Inc. (San Francisco, USA): provider of the mailbox where we receive and read email.
- Providers of artificial intelligence tools (language models) that we use to read messages and prepare replies (see section 2).
- When you contract with us, the bank through which we collect payment and, where applicable, our tax adviser, to comply with tax obligations. We do not currently work with an external tax adviser.
We may disclose data to public authorities where required by law (for example, the Spanish Tax Agency).
5. International transfers
Some providers process data outside the European Economic Area. Cloudflare relies on the EU–US Data Privacy Framework and, in the alternative, on the European Commission's standard contractual clauses. AgentMail Inc. (United States), which hosts the hello@grawwww.xyz mailbox, acts as a processor: we are confirming with AgentMail which article 46 GDPR safeguards apply to that transfer (standard contractual clauses or Data Privacy Framework certification) and will update this section with the answer. The AI providers we use for an engagement, and their safeguards, are listed in that engagement's proposal. You can ask us for more information by writing to hello@grawwww.xyz.
When the website is served from Google Cloud (section 4), access logs are processed on servers located in the United States; the transfer is covered by the European Commission's standard contractual clauses incorporated into Google's data processing addendum or by another transfer solution recognised under European law.
6. Your rights
You may exercise at any time your rights of access, rectification, erasure, restriction of processing, objection and portability (arts. 15 to 22 GDPR), by writing to hello@grawwww.xyz and stating which right you wish to exercise. We will reply within one month. If we process your data on the basis of legitimate interest, you may object on grounds relating to your particular situation.
If you consider that we are not processing your data in accordance with the law, you may lodge a complaint with the AEPD (Spanish Data Protection Agency) (sedeagpd.gob.es).
7. Third-party data
If you send us personal data about other people (for example, your employees or clients), make sure you are entitled to do so and send us only what is essential. Before sharing personal data for a project, we will agree the terms of processing in writing (art. 28 GDPR).
8. Changes
If we change this policy, we will publish the new version on this page with its date.