Privacy Policy

1. Who we are

The data controller is [legal entity name], NIF/CIF [number], with address at [registered address] (“Viraluna”, “we”). Contact for privacy matters: [privacy email].

2. What data we collect and why

Website enquiries (contact and quote forms)

Name, business name, email, optional phone number, business type, plan interest, an optional social profile link and your message. We use this to reply to your enquiry and prepare a quote. Legal basis: steps taken at your request before entering into a contract (GDPR art. 6(1)(b)), and our legitimate interest in answering enquiries.

Client portal

Account details (name, email), your business profile and brand information, files you upload, offers and events, requests, messages, approval decisions and activity records needed to deliver the service and keep an audit trail. Legal basis: performance of our contract with you (art. 6(1)(b)) and legal obligations such as invoicing (art. 6(1)(c)).

Security records

We keep limited security logs (for example sign-in events and actions taken by our staff). For rate limiting we use a one-way hash of your IP address and do not store the IP itself. Legal basis: legitimate interest in keeping the service secure (art. 6(1)(f)).

Invoicing

Invoice references, amounts, dates, payment method and status. We never collect or store card numbers on this website. Legal basis: legal obligation and contract.

3. Service providers (processors)

• Supabase — database, authentication and private file storage. [Confirm project region and DPA.]
• Vercel — website hosting. [Confirm region and DPA.]
• Resend — transactional email, if enabled. [Confirm DPA.]
• Anthropic — AI-assisted caption drafting, if enabled. Only the minimum business facts needed for a draft are sent; no passwords or payment data. [Confirm DPA and data-retention settings.]

Where providers process data outside the EEA, we rely on appropriate safeguards such as Standard Contractual Clauses. [Confirm.]

4. How long we keep data

• Enquiries that don’t become clients: [e.g. 12 months].
• Client portal content: for the duration of the service and [e.g. 90 days] after it ends, unless you ask us to delete it sooner.
• Invoices and accounting records: as required by Spanish tax law.

5. Your rights

You can request access, rectification, erasure, restriction, portability or object to processing by writing to [privacy email]. You may also complain to the Agencia Española de Protección de Datos (aepd.es).

6. Cookies

We only use cookies that are strictly necessary for the website and client portal to work. See our Cookie Policy.

7. Security

Each client’s data is isolated at the database level, files are kept in private storage and shared only via short-lived links, connections are encrypted, and our team uses two-factor authentication.