Privacy
Last updated: 20 October 2026
This is an English translation for your information. The contract is made in Spanish and, if the two versions differ, the Spanish version applies.
In short
| Controller | Jesús Marín Almansa (Taraceista), tax ID (NIF) 26530658C, Calle Alondra, 13, 2.º E, 18014 Granada, Spain. hola@taraceista.com |
| Purpose | Providing the service, charging and invoicing for it, writing to you about your account and your plan and, if you agree, sending you news and offers. |
| Legal basis | The contract, our legal obligations, our legitimate interest and, for the optional parts, your consent. |
| Recipients | The providers that run the service, some of them in the United States. We do not sell or share data for advertising. |
| Your rights | Access, rectification, erasure, objection, restriction and portability, by writing to hola@taraceista.com. You can also complain to the AEPD, the Spanish data protection authority. |
Who is the controller
Jesús Marín Almansa, tax ID (NIF) 26530658C, with address at Calle Alondra, 13, 2.º E, 18014 Granada, Spain, who provides the service under the trade name Taraceista. Email: hola@taraceista.com. Phone: 614 03 39 84. There is no data protection officer because the law does not require one in our case.
What data we process, why and on what basis
If you have an account
| Data | Why | Legal basis |
|---|---|---|
| Email, name and, if you sign in with Google, the name and email Google gives us | Creating your account and letting you sign in. Your password is managed by Amazon Cognito and we do not see it. | Contract |
| What you tell us for your website: texts, photos, files, requests and changes | Building, publishing and maintaining your website. | Contract |
| Audio, if you dictate a change | Turning it into text. The audio is not stored. | Contract |
| Billing details: name or company name, tax ID, address and phone | Charging you, issuing invoices and registering your domain in your name. Card details are handled by Stripe and we do not see them. | Contract and legal obligation (invoicing) |
| Service notices: that your website is ready, the status of your plan, payments and changes to these terms. | Contract | |
| Email and how you use the service | Tips to get the most out of it in your first weeks, at most one a day. | Legitimate interest: that you get the most out of what you have just started using. You can object with the link in each email or in Account. |
| Taraceista news and offers. | Consent, only if you tick the box. You withdraw it in Account or in each email. | |
| Whether you open our emails and click their links | Knowing which emails are useful. | Consent. Anyone who has not given it is not measured. |
| An identifier of your phone | Sending you notifications from the app. | Consent, which you give or withdraw on the phone itself |
| What you write to support | Answering you and solving what you ask for. | Contract |
| Which ad or link brought you and, if it was an ad, what you did on the home page and on the sign-up screen | Knowing which ads bring us customers. We only tell Google Ads that a click of theirs ended in a new account, without your email or any other data of yours. | Legitimate interest: deciding what advertising to spend on |
| Technical and security logs | Keeping the service running, fixing faults and preventing abuse. | Legitimate interest |
| The date and the text of what you accepted | Being able to prove your consent and your acceptance of the terms. | Legal obligation |
To create the account we need your email, and to charge you, your billing details. Without them we cannot provide the service. Everything else is optional.
Your website is written by an artificial intelligence system from what you tell it. We do not make automated decisions about you that have legal effects on you.
If you ask for the call «Explain it to us by phone!»
When you create your website you can ask us to call you. You are called by an automated voice assistant, which is an artificial intelligence system and says so at the start. It asks you about your business to prepare your website. It lasts a few minutes, six at most.
| Data | Why | Legal basis |
|---|---|---|
| Your phone number | Making the call. If your account had no phone number, we save it in your details. | Consent and contract |
| Your voice during the call | Holding the conversation. It is processed on the spot and not recorded. | Consent and contract |
| The transcript of the conversation and what the assistant notes down: the name of the business, what it does, what you want to achieve and anything else you tell it | Preparing your website, because what is noted down is the request to create it, and improving the service. | Consent and contract |
You give your consent by ticking the box with which you ask for the call. With it you declare that the number is yours or that you have its holder's permission, and you agree to be called by an automated assistant and to have the conversation transcribed. Without that box there is no call. You can withdraw your consent at any time by writing to hola@taraceista.com.
The call is made by Twilio, and the assistant's voice and the transcript are provided by OpenAI, both in the United States. We do not use this data for advertising or share it with third parties. The transcript is deleted after 90 days. What ends up on your website stays there for as long as you keep it.
If you visit taraceista.com
We do not use cookies or third-party analytics tools. We count visits and what is touched on the page with a random number that is lost when you close it, without storing your IP address. In your browser we store which ad or link brought you, to pass it on to the panel if you sign up. You can delete it by clearing the site's data. The fonts of the website are loaded from Google Fonts: when you open it, your browser requests them from Google, which receives your IP address.
The panel (app.taraceista.com) uses a single cookie, the session cookie, which is necessary for you to sign in.
If you visit or fill in the website of one of our customers
For that data, the controller is the business that owns the website. We are its processor: we process the data on its behalf and following its instructions.
- Forms: what you write and the files you attach, so that they reach the business by email and, if it uses our app, with a notification on its phone that carries your name and the beginning of the message. Your IP address and your browser, only to stop mass sending.
- Visit statistics: without cookies. Each visitor is counted with a code that changes every day and cannot be linked to another day or another website. The IP address is not stored.
- Domain email, if the business has it: the messages that address receives and sends. An automatic filter reads the sender, the subject and the beginning of what comes in to set spam aside.
- Third-party content on the website, such as Google Fonts, an OpenStreetMap map or YouTube videos: it is served by those third parties, which receive your IP address and process it under their own policies.
To exercise your rights over that data, contact the business. If you write to us, we will pass it on to them.
How long
- Your account and your websites: while you have the account. When you close it they are deleted, except what the law requires us to keep.
- Invoices and their data: the period required by tax and commercial law, currently up to six years.
- Backups of your website: those your plan includes, one year at most.
- Form submissions: the time set by the business's plan, between 90 days and two years, or less if it deletes them.
- Data on visits to taraceista.com: six months.
- Technical logs: 90 days.
- Proof of your consent: while it lasts and, afterwards, until any liability that could arise from it has expired.
- Call transcripts: 90 days. What ends up on your website stays there for as long as you keep it.
- The audio of dictations and calls: not stored.
Who else sees it
The providers we need to provide the service, which process the data on our behalf and under contract:
| Provider | What for | Where |
|---|---|---|
| Amazon Web Services | Hosting, database, account access, the artificial intelligence model that writes the websites, image generation (Amazon Bedrock) and the DNS of the domains (Route 53) | Ireland. The model may run in other AWS regions, including outside the EU, and images are generated in the United States |
| OpenAI | Turning dictations into text, the voice of the call assistant and its transcripts, retouching the photos you upload, suggesting improvements, translating, setting spam aside and other supporting texts | United States |
| Twilio | Making the «Explain it to us by phone!» calls | United States |
| Stripe | Payments and card details | Ireland and United States |
| Resend | Sending and receiving email | United States |
| Sign in with Google, phone notifications, the fonts of the website (Google Fonts) and measuring the sign-ups that come from Google Ads | United States | |
| Openprovider | Registering, renewing and transferring domains in your name | Netherlands |
| Porkbun | Domains registered before 19 October 2026 and their DNS | United States |
| OpenStreetMap | Getting the city and province from a postcode | United Kingdom |
In addition, when a domain is registered or transferred, the holder's data reaches the registry of that domain under its rules: Red.es for .es, EURid for .eu and the registry of each extension for .com, .net and .org. And we will give data to the authorities when the law requires it.
Transfers outside the European Economic Area rely on the EU-US Data Privacy Framework for the providers certified under it, on the adequacy decision for the United Kingdom and, in the other cases, on the European Commission's standard contractual clauses. You can ask us about them at hola@taraceista.com.
Your rights
You can ask for access to your data, its rectification or erasure, object to its processing, ask for it to be restricted and take it with you (portability). If the processing is based on your consent, you can withdraw it at any time, without affecting what was done before. Write to hola@taraceista.com from your account email. We answer within one month, which the law allows us to extend by two more if the request is complex.
If you think we have not handled your rights properly, you can complain to the Spanish Data Protection Agency (AEPD).
Minors
Taraceista is for businesses and professionals of legal age. We do not create accounts in the name of minors.
Security
We apply technical and organisational measures appropriate to the risk: encryption in transit, restricted access and private files that only open with links that expire. If there were a breach affecting you, we would tell you as the law requires.
Changes
If we change this policy, the date at the top changes. If the change is significant, we will let you know beforehand.