What I collect, what I don't.

Data controller

Data controller

Daniel Picatto

Tax ID (NIE)

Z1103629W

Registered address

Ronda de Santa Maria, 68, 08204 Sabadell, Barcelona

Email

[email protected]

Analytics

This site uses Plausible Analytics, a cookieless, GDPR-friendly product that records aggregate page views and referrers. No personal identifiers, no cross-site tracking, no cookies. The data lives in the EU.

Email

If you write me directly, your email lives in a mailbox I read personally. It is not added to any marketing automation tool. I will only use it to reply to the thing you asked about.

D4S diagnostic

The D4S diagnostic (Spanish, English) sends the decision text you submit to Anthropic's Claude API to generate the verdict. Anthropic's data-handling terms apply for the duration of the API call; per their policy, prompts are not used to train models.

Running the diagnostic stores nothing. If — and only if — you then ask for the result by email, I store the address you gave me together with the decision, the context, the burn figure, the counterfactual and the resulting verdict, so that I can send it and follow up. That record lives in a Redis database hosted by Upstash in the United States, and the email is delivered through Resend. Neither is used for marketing lists.

Price currency

The Sparring price is shown in euros or dollars depending on where you browse from. To work that out, Vercel derives the country from your IP at the edge of its network, and the site asks it for that and nothing else: a country code. It is not stored, not logged and not tied to you. If the lookup fails, the price stays in dollars.

The four questions before booking

The booking form asks for your name and email, plus four questions: team size, your role, what happens if nothing changes in six months, and when you would start. All of it is stored in the same Upstash database and emailed to me, so that I can read it and write back. Resend sends you a confirmation that it arrived. If you then choose to book, the answers are pre-filled into the notes of the Cal.com booking so we don't spend the call repeating them. They are not shared with anyone else.

Both forms are protected by Cloudflare Turnstile (anti-bot) and a per-IP rate limit. For that, Cloudflare and Upstash both see your IP address.

Discovery calls

Bookings on cal.com are processed by Cal.com under their privacy policy. I see your name, email, and timezone. That data is not exported elsewhere.

Third-party services that process your data

The complete list. If a service isn't here, it touches nothing of yours.

Where your data is processed

If you hand me data through either form, it leaves the European Union. Worth knowing before you type it, not after:

• Storage — diagnostic and filter records live in an Upstash database hosted in the United States.
• Processing — the functions that receive the forms run on Vercel servers in the United States (region iad1, Virginia), and the diagnostic text is processed by Anthropic's API, also in the United States.
• Email delivery — Resend is configured in its Ireland (EU) region, so the mail goes out from European infrastructure. With one caveat worth stating: Resend is a US company, and its own processing agreement acknowledges that the bulk of its processing happens in the United States, so the data may end up being accessed from there.

What stays in the EU is the Plausible analytics, which collects nothing specific to you, and the email delivery, with the access caveat just described.

International transfers

These are the mechanisms each provider relies on for those transfers, per their own policies:

• Vercel — European Commission Standard Contractual Clauses, plus the UK Addendum. Their processing agreement states: “For data transfers from the EEA, the UK, and Switzerland that are subject to the Standard Contractual Clauses, the Standard Contractual Clauses will apply” (Data Processing Addendum).
• Anthropic — Standard Contractual Clauses. Their policy states: “We rely on standard contractual clauses to transfer information… to certain affiliates and third parties in countries without an adequacy decision” (Privacy Policy).
• Upstash — the EU-U.S. Data Privacy Framework as the primary mechanism, with Standard Contractual Clauses as the fallback. Their processing agreement acknowledges the transfer and states, in clause 3.2(B): “Upstash Inc. is a recipient of European Data in the United States… Upstash Inc. will use the Data Privacy Framework to lawfully receive European Data in the United States”, adding that if the Framework does not cover the transfer or is invalidated, “the Standard Contractual Clauses will be incorporated by reference” (Data Processing Addendum).
• Resend — Standard Contractual Clauses, plus certification under the EU-U.S. Data Privacy Framework. Even with the sending region set to Ireland, their processing agreement acknowledges that the bulk of their processing happens in the United States, and clause 6.2 states the mechanism covering that transfer: “ex-EEA Transfers are made pursuant to the EU SCCs, which are deemed entered into (and incorporated into this DPA by this reference)”. Clause 11.1 adds the certification: “The Company complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF” (Data Processing Agreement).

Standard Contractual Clauses are the Article 46 GDPR mechanism. The detail lives in the documents linked above, which are the ones that govern.

Legal basis

Consent for emailing you the diagnostic result and for the four questions before booking: in both cases you give it by submitting the form, and you can withdraw it any time by writing to me.

Legitimate interest for the cookieless analytics and the anti-bot protection on the forms: I need to know whether the site works and that the forms aren't being abused. Neither profiles nor identifies you.

Retention

Diagnostic and filter records are deleted automatically after 12 months. That isn't a promise in prose — the database expires them on its own, with nobody having to remember. If we end up working together in that time, the commercial records (contract, invoicing) are kept separately for as long as Spanish tax law requires.

Your rights

You have the right of access, rectification, erasure, objection and portability over your data. To exercise any of them, write to [email protected] — I handle it myself, no forms.

If you think I handled it badly, you can lodge a complaint with the Spanish data protection authority, the AEPD: aepd.es.

What isn't here

No third-party trackers, no ad pixels, no social embeds anywhere on the site. The typefaces are served from this domain, so there are no Google Fonts requests either. I don't sell or hand data to anyone. The blog is published from a CMS (Sanity), but its content is compiled before you arrive — that service receives nothing about your visit.

Deleting your data

Email me and it's gone. No form, no process: [email protected].

Contact

Questions, corrections, or a request to delete anything I have on you: [email protected].