Privacy policy
Who is responsible
AVAROPA, S.L.U. — CIF B-13709027 — Calle Punta Prima 3, 1-5-2, 17250 Castell-Platja d'Aro (Girona), Spain — hello@avakyan.ai. We are the data controller for everything described below.
What we collect, and when
When you send the contact form. Your name, your email, your message, and the best time to reach you if you fill that in. Two things are added to it by us, not by you: which channel first brought you to the site (a search engine, a link, a campaign — never a name or an address), and the one-line guess described under sorting the inbox. Nothing else is taken from that form.
When you book a consultation. Your name, your email, the time and length you chose, and the topic if you write one. As with the form, we add which channel first brought you here, and a scrambled version of your address used only to recognise the same booking being sent twice.
Simply by visiting. Our host receives what every web server receives to deliver a page and keep the site up: your IP address, your browser and device type, the page you asked for, and the time. This is used to serve the site and to block abuse, and is not used to build a profile of you.
Only if you accept measurement. Which channel brought you here (a search engine, a link, a campaign), the language of the page, and the fact that one visit happened. This carries no name, no email and no IP address, and it is stored as a running total rather than one record per person. Google Analytics, if you accept it, sets its own cookies and receives its own usage data. Nothing in this paragraph runs before you accept — see Cookies.
There is no chat on this site, so there are no conversations to store. We do not buy contact lists and we do not track you across other websites.
Why, and on what legal basis
- To answer you and to arrange the consultation — because you asked us to (GDPR Art. 6.1.b, steps taken at your request before a contract). The tick box at the form is a confirmation that you have read this page, not the legal basis: a box you must tick to use the form could not be freely given consent, and pretending otherwise would be worse than not asking.
- To keep the site running, secure and free of spam — our legitimate interest in a working site (Art. 6.1.f).
- To measure how the site is used — your consent, and only your consent (Art. 6.1.a). Nothing is read from or written to your device for this until you accept, and you can withdraw at any moment; see below.
- To sort the inbox — our legitimate interest in answering the right people first (Art. 6.1.f). Your message is compared against a fixed list of words to guess whether you are a business with a job, someone offering investment, a recruiter, or someone selling us a service, and how urgent it sounds. It is a word match, not artificial intelligence, and it is shown to us as a guess. This guess is profiling in the sense the law uses (Art. 4.4), so we say so plainly. It is kept with your message for 90 days and it travels with your message to the messenger and the email service listed below. Nobody is refused, priced or turned away by it — it only affects the order in which we open things — and you can object to it, or ask what it guessed, at hello@avakyan.ai.
- To count that an enquiry or a booking happened — our legitimate interest in knowing whether the site works at all (Art. 6.1.f). This count records only the fact, the channel and the language. It carries no name, no email, no message and no IP address; it is not fully anonymous, because it is stamped with the same moment as your enquiry, but nothing in it identifies you on its own. It happens whatever you chose about cookies.
- To count that a link in one of our posts was followed — the same legitimate interest, and the same shape of count (Art. 6.1.f). When you arrive through a link we published somewhere — a post, a listing — the address you followed adds one to a running total that says which network, which language and which article. It is a number going up, not a record of a visit: nothing about you is stored, nothing is read from or written to your device, and no cookie is set. Then you are sent straight to the article you clicked.
Nothing about you is decided by a machine alone. There is no automated decision that produces legal effects for you or affects you in any similar way (Art. 22): no program prices you differently or judges you as a person. Two automatic steps do exist and we would rather name them than let this paragraph sound broader than it is. One is the word match above, which sorts the order we read things in. The other is spam defence: a hidden field no real visitor can fill, and a limit of twelve submissions an hour from one internet address — if either triggers, that submission is stopped without a person seeing it. Neither looks at who you are. If you ever send something and hear nothing back, WhatsApp or email always reaches us. We do not track you across other websites and we do not build an advertising profile of you.
Who else sees it
Only the providers we need to run this, each acting on our instructions:
- Cloudflare — hosting, security, the store that holds the anonymous visit counts, and a copy of your enquiry or booking, written down the moment it arrives so that it cannot be lost if the delivery below fails.
- Telegram — how a new enquiry or booking reaches Sergey's phone.
- Web3Forms — sends the email copy of a contact-form enquiry.
- Google — our email is hosted with Google Workspace, so the copy of your enquiry that sits in the inbox sits with them; Calendar and Meet create your consultation and send you the invitation; Google Analytics, only if you accepted measurement.
- Meta (WhatsApp) — only if you choose to write to us there instead of using the forms. We do not start that conversation, and nothing from the forms is sent into it.
We never sell your data and we never pass it on for someone else's marketing. We disclose it otherwise only when the law obliges us to.
Data leaving the EU
None of these providers is in the European Union. Cloudflare and Google are United States companies. Telegram is established outside the EU. Web3Forms, which sends the email copy of a contact-form enquiry, is run from India on servers in the United States. Meta, if you choose to write on WhatsApp, is a United States company. Where your data reaches them, the transfer relies on the safeguards EU law provides for it — the European Commission's standard contractual clauses, or an adequacy decision such as the EU–US Data Privacy Framework where that provider is certified under it. If you would rather your details did not pass through any of them, write to hello@avakyan.ai instead of using the forms.
How long we keep it
- Your enquiry or booking — for as long as we are dealing with it and any work that follows, and after that only for the periods Spanish commercial and tax law requires (up to six years). Then it is deleted.
- The safety copy at Cloudflare — 90 days, then it deletes itself. It exists only so that a message cannot vanish if delivery fails; the enquiry we actually work from is the one in our email inbox. If you ask us to delete your data we erase this copy straight away rather than waiting for it to expire.
- A count of recent submissions from your internet address — one hour from the first of them, then it deletes itself; sending more does not extend it. It holds a number, but it is filed under your address, so we describe it as personal data rather than pretend otherwise. It exists only to stop one address flooding the forms, and it is never joined to anything you sent.
- Anonymous visit and enquiry counts — 400 days, then they delete themselves.
- Cookies — the periods listed below.
- Google Analytics — held by Google under our account settings, up to 14 months.
Cookies and measurement
Nothing that measures you runs before you accept it. Until then the only things stored on your device are the ones listed here, which the site cannot work without:
- lang — remembers the language you chose, so we do not ask again. 12 months.
- your answer to the cookie banner — kept in your browser only, never sent to us. Until you clear your browser data.
- our host's own protection — if Cloudflare decides a request looks automated, it may set a short-lived cookie of its own so it does not challenge you again on every page. We do not read it and it measures nothing about you. It is not set on an ordinary visit.
If you accept, these are added:
- av_src — which channel you arrived from, so we can tell what actually brings people here. 90 days.
- av_hit — not a cookie: a note kept in the browser tab itself, marking that this visit has already been counted so it is not counted twice. It disappears when you close the tab.
- Google Analytics (_ga and similar) — aggregate usage statistics. Its advertising features are switched off in our code, so it is not used to build an advertising profile of you. Up to 2 years.
- Cloudflare Web Analytics — sets no cookie; it reports that a page was viewed.
Changing your mind is one click: use , or the same link at the foot of any page. Choosing "Reject" there deletes the measurement cookie and reloads the page without any measurement running.
Your rights
You can ask us for access to your data, or to correct it, delete it, restrict it, port it elsewhere, or object to its use — and to withdraw your consent at any time, without that affecting what was done before. Write to hello@avakyan.ai and we will answer within one month.
On deletion, so you know what actually happens: we erase the safety copy ourselves, in one action, as soon as we read your request — it is not automatic, and we would rather say so than imply a machine is handling it. The email in our inbox, the message on the phone, and any consultation already in the calendar are deleted by hand as well, because they are ordinary correspondence rather than a database. That is why we ask for a month rather than promising an instant, though in practice it takes minutes.
If you think we have handled your data badly, you can complain to the Spanish Data Protection Agency, the AEPD (www.aepd.es).