PRIVACY
POLICY

Smart-AI ("Smart-AI", "we", "us") is the data controller for the personal data described in this policy.

The studio operates from Mérida, Badajoz, Spain.

We have not appointed a Data Protection Officer. Privacy questions go to hello@smart-ai.es.

We collect only what we need to answer you and to keep the site running.

• Contact form: your name, email address, the service you selected and your message - plus company name and budget range if you choose to give them.
• Direct messages: anything you send us at hello@smart-ai.es or over WhatsApp or Telegram.
• Server logs: IP address, browser user agent, requested URL and timestamp, recorded automatically by our hosting provider.
• Analytics: page views, referring site and approximate country. Vercel Web Analytics measures this without cookies. If you accept cookies, Google Tag Manager also loads Google Analytics, which sets cookies and measures the same behaviour in more detail.

We do not knowingly collect special categories of data - health, beliefs, biometrics and similar. Please do not send them to us.

• To reply to your enquiry and prepare a proposal or audit - Article 6(1)(b) GDPR: steps taken at your request before entering into a contract.
• To run and secure the website, including rate limiting and spam filtering - Article 6(1)(f): our legitimate interest in keeping the service available and free of abuse.
• To meet accounting and tax obligations once you become a client - Article 6(1)(c): compliance with a legal obligation.
• To send you information about our services where you asked for it - Article 6(1)(a): your consent, which you can withdraw at any time.

This site sets one strictly necessary cookie: NEXT_LOCALE, which remembers whether you are reading the English or the Spanish version. It holds no identifier and needs no consent.

Everything else is optional and asks first. Until you accept, no Google script is requested and no analytics cookie exists. Our baseline audience measurement is cookieless, so declining costs you nothing and changes nothing about the site. You can withdraw consent at any time from the link in the footer.

We do not sell personal data. We share it only with providers who process it on our instructions under Article 28 GDPR:

• Vercel Inc. - website hosting and server logs.
• Resend - delivery of contact-form messages to our inbox.
• Vercel Web Analytics - cookieless audience measurement.
• Google Ireland Limited - Google Tag Manager and Google Analytics, loaded only with your consent.

We may also disclose data where the law requires it, for example to a court or a public authority.

Some of these providers process data outside the European Economic Area, in particular in the United States. Where that happens we rely on the European Commission’s standard contractual clauses or on an adequacy decision such as the EU–US Data Privacy Framework, together with the technical safeguards the provider offers. You can ask us for a copy of the relevant terms.

• Enquiries that do not become projects: 12 months from our last exchange.
• Client records: for the life of the contract, then for the period Spanish commercial and tax law requires - currently six years.
• Server logs: up to 30 days.

Under the GDPR you can ask us to give you a copy of your data (access), correct it (rectification), delete it (erasure), limit how we use it (restriction), send it to you or another provider in a portable format (portability), or stop processing it where we rely on legitimate interests (objection). Where we rely on consent, you can withdraw it at any time - that does not affect processing carried out beforehand.

Write to hello@smart-ai.es. We reply within one month; if a request is complex we may extend that by two further months and will tell you why.

If you think we have handled your data badly, you can complain to the Spanish supervisory authority - Agencia Española de Protección de Datos, www.aepd.es - or to the authority in the EU country where you live or work.

The site is served over HTTPS, form submissions are rate-limited and screened for spam, and access to enquiries is limited to the people who need it. No system is perfectly secure; if a breach affects your data we will notify you and the supervisory authority as the GDPR requires.

This site is aimed at businesses. We do not knowingly collect data from anyone under 14, the age of digital consent in Spain. If you believe a child has sent us personal data, write to us and we will delete it.

We update this policy whenever our processing changes. The date at the top of the page always shows the current version, and material changes are announced here.

Questions, requests or complaints: hello@smart-ai.es. We will provide our full registered details on request.