Who the controller is
The controller of the personal data we collect on this website and in our relationship with clients is:
- Owner: Eric Herreros
- Address: Calle Pisa, 07011 Palma
- Privacy email: hola@solvosoftwares.com
When you write to us using the form
Purpose: to answer your request and, if you ask us to, prepare a proposal for you.
Data: name and email; company and phone number if you provide them (they are optional); the service you are interested in and the project description; and, if you indicate them, your approximate budget and timeline.
Legal basis: your consent, which you give by ticking the privacy box (Art. 6(1)(a) GDPR), and taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR).
Retention: until your request has been dealt with and, if we do not end up working together, for a maximum of 12 months from the request. If you become a client, it is processed as client data (next section).
Fields without the “optional” label are needed to reply to you. If you are writing on behalf of your company, we only need your business contact details.
We also keep the date of submission and the version of this policy you accepted, so that we can demonstrate your consent (Arts. 6(1)(c) and 7(1) GDPR), for the same period as the rest of the form data.
Email confirmation: when we receive your request, we send you an automatic email to confirm it, in the language of the page. It only contains your first name in the greeting (if you write it with letters only) and the service, budget and timeline you chose (never what you write in the description), and we send it to manage your request (Art. 6(1)(b) GDPR).
So that nobody can use the form to write to other people’s addresses, we send at most one confirmation every 24 hours to each address and three to the addresses of the same domain (except large email providers such as Gmail or Outlook). To keep count, our submission-limit service stores pseudonymised codes derived from your email address and its domain, never the address itself, which are deleted automatically after 24 hours. The legal basis is our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).
AI-drafted reply (if enabled): to reply to you sooner, when we receive your request an artificial intelligence model (Claude, by Anthropic) writes an internal draft reply and some notes for our team (a summary, what we still need to know and whether it looks like spam or something we do not do). We only send it your first name, your company if you give it, the service, the project description, the budget and timeline you choose and the language of the page; never your email address or phone number, and before sending it we automatically remove any email addresses and phone numbers we detect in the description and the company name, and the surnames you write in the name field. The draft and the notes are not sent to you: they only go to our team, a member of which reviews them and decides what to reply, so you never receive a reply written by the AI alone, and no decision about you is made by automated means. We do this to manage your request (Art. 6(1)(b) GDPR).
Where we store your request: as well as reaching us by email, it is stored in the database of the internal dashboard we use to handle it (Supabase, with servers in Ireland, in the EU), together with the date of submission, the version of this policy you accepted, the language and the page of the website you sent it from (and, if the address of that page shows it, the advertising campaign you came from), and the internal draft reply and its notes for our team if they have been written. Only the members of our team who handle requests can access that dashboard, with their own user account and a second authentication factor, and it is kept for the same period stated in the retention paragraph.
Attachments (if you add any): you can attach up to 3 files (PDF, JPG, PNG or WebP, 10 MB each at most) to explain your project. They are stored in the private storage of our internal dashboard (Supabase, with servers in Ireland, in the EU) and only our team can open them, each member with their own user account and a second authentication factor. They also reach us with the internal notification of your request, either attached or through a link that expires after 24 hours. We keep them for as long as your request (at most 12 months if we do not end up working together) and delete them with it. To prevent abuse, uploads have their own limits per IP address, counted with the same pseudonymised code as the rest of the form. Please do not attach other people’s data that we do not need. We process them to manage your request (Art. 6(1)(b) GDPR).
“We’ll call you” form
If you ask us to call you, we process your name, your phone number, the service you are interested in and, if you choose one, your preferred time slot.
We only use them to call you and talk about what you need. The legal basis is your consent, which you give by ticking the box and can withdraw at any time by writing to us.
We keep them for 12 months from the request, unless you contract a service. If you do not provide them, we cannot call you, but you can call us on +34 676 88 15 74.
We also store your request in the database of our internal dashboard (Supabase, with servers in Ireland, in the EU), with the date, the version of this policy you accepted, the language and the page of the website you sent it from (and, if the address of that page shows it, the advertising campaign you came from), for the same period, and only the members of our team who handle requests can access it.
When you write to us on WhatsApp or by email, or call us
We process the data you give us (your name, your phone number or email address and what you tell us) to reply to you and, if you ask us to, to prepare a proposal. The legal basis is taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR) and, if you are only asking a question, your consent when you write to us (Art. 6(1)(a) GDPR).
We keep them until your enquiry is resolved and, if we do not end up working together, for a maximum of 12 months. If you hire us, they are processed as client data (next section).
WhatsApp is a service of WhatsApp Ireland Limited (Meta group), which processes your messages under its own terms and privacy policy. If you prefer not to use it, email or call us.
If you write to SOLVO’s WhatsApp, we keep the conversation (your number, your WhatsApp profile name, the text of the messages and, for a photo, an audio or a document, only the fact that you sent it) in our internal panel, together with your request or your client record if there is one, so that we can reply and follow up. We keep it for up to 12 months from the last message in the conversation, and then it is deleted. Legal basis: steps taken at your request prior to entering into a contract and, if you only ask a question, our legitimate interest in replying (Art. 6(1)(b) and 6(1)(f) GDPR).
If nobody on the team can reply within about 15 minutes, our automatic assistant may reply once: it is an artificial intelligence and says so when it introduces itself. It only asks what you need and tells you the team will reply; it does not give prices, deadlines or terms. To write that reply, and to suggest replies that a team member reviews before sending, the text of the latest messages is sent to Anthropic (Claude), without your number or your name and with the emails and phone numbers we detect hidden. This is an automatic detection, not a guarantee.
If you tick the “Also confirm it by WhatsApp” box in a form on the website (the quote form or “We’ll call you”), which is optional and unticked, we send you a single WhatsApp message to the phone number you gave to confirm that we have received your request. If you do not tick it, we do not write to you by WhatsApp because you filled in the form. Legal basis: your consent (Art. 6(1)(a) GDPR); we keep your number, the date, the version of this policy and the language so that we can prove it (Art. 7(1) GDPR). If you reply “STOP”, we will not send you automatic messages again.
Offers by WhatsApp: only if you tick the box in the quote form, which is optional and unticked. Legal basis: your consent (Art. 6(1)(a) GDPR). We keep your number, the date, the version of this policy and the language so that we can prove it (Art. 7(1) GDPR), for as long as you do not withdraw it and, afterwards, for as long as needed to deal with any claim. You can withdraw it at any time by replying “STOP” to any of our messages or by asking us in writing.
When you are a client
Purpose: to prepare and manage the contract, communicate with you during the project, invoice and comply with our accounting and tax obligations.
Data: contact details, details of your company’s contact person, billing and payment details, and project communications.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR).
Retention: for as long as the relationship lasts and afterwards for the statutory periods: 6 years for accounting records (Art. 30 of the Spanish Commercial Code) and 4 years for tax purposes (Art. 66 of the Spanish General Tax Act).
Invoices
Purpose: to keep a copy of the invoices for our services in order to keep our accounts, email them to you and, once we have one, hand them over to our accounting firm.
Data: the details on each invoice (your name or company name and your other tax details, the items and the amounts) and whether it has been paid.
Legal basis: compliance with our accounting and tax obligations (Art. 6(1)(c) GDPR) and performance of the contract (Art. 6(1)(b) GDPR).
Who receives them: the person or company that issues the invoices on behalf of SOLVO, who needs your billing details to do so, and our accounting firm, as data processor. They are stored in the private storage of our internal dashboard (Supabase, with servers in Ireland, in the EU) and reach you by email through our email delivery provider (Resend).
Retention: 6 years (Art. 30 of the Spanish Commercial Code), without prejudice to the tax periods in the previous section.
Notices about your fee and your appointments
Purpose: if you are a client, to let you know your fee’s billing day and about any payment that is still outstanding; and, whether you are a client or have asked us for a quote, to confirm the calls and video calls we arrange with you, with an invitation for your calendar, and to let you know if their time changes or they are cancelled.
Data: your name, your email address, the language we write to you in and, if you are a client and have agreed to it, your WhatsApp mobile number; the month, the item and the amount of the fee and, if it has already been issued, its invoice; and the day, time, type and link of the appointment.
Legal basis: performance of the contract or, if you are not yet a client, taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR). For WhatsApp, also your consent (Art. 6(1)(a) GDPR).
WhatsApp is optional: if you do not agree to it, the notices reach you by email. You can withdraw your consent at any time by replying “STOP” to one of our messages or by asking us in writing, and from then on they reach you by email. We keep the date on which you agreed and, if you withdraw, the date you opted out, so that we can prove it (Art. 7(1) GDPR). If you change your number, you need to agree again.
If the appointment is a video call, the Google Meet meeting is created in SOLVO’s calendar: Google receives the day, the time and a title with your name, never your email address or phone number.
Record: we keep a line for each notice (its type, date and channel, whether it was delivered and, for WhatsApp, whether you have read it, when WhatsApp tells us, with your email address or number partly hidden) so that we know what we have sent you and can prove it in the event of a claim, on the basis of our legitimate interest (Art. 6(1)(f) GDPR). We keep it for as long as the contract lasts and 5 years afterwards or, if you do not become a client, for as long as your request.
When you sign a contract with us
Purpose: to let you read and electronically sign the contract we send you, and to be able to prove afterwards who signed it, when, and exactly which text was signed.
Data: the name and the ID document (or tax identification) number you enter when signing; a one-time code we send you by email or, if you have agreed to it for notices, by WhatsApp (we keep where we sent it, with your email address or number partly hidden, and of the code only an encrypted fingerprint, which expires after 10 minutes); the IP address and the browser you sign from; the date and time; a fingerprint of the document and of the signed PDF; and the contract log (when it was sent, opened, the code requested and the contract signed).
Legal basis: entering into and performing the contract (Art. 6(1)(b) GDPR) and our legitimate interest in being able to prove the signature in the event of a claim (Art. 6(1)(f) GDPR).
Where and who: the signed contract and its evidence are stored in the private storage of our internal dashboard (Supabase, with servers in Ireland, in the EU); the code reaches you by email through Resend or by WhatsApp through Meta Platforms Ireland Limited. If we have your email address, we send you a copy of the signed contract there.
Retention: for as long as the contract lasts and 5 years afterwards (the general limitation period for personal actions, Art. 1964(2) of the Spanish Civil Code), without prejudice to the accounting and tax periods in “When you are a client”. The evidence is not changed once stored.
Whether our emails reach you
When we write to you from our internal dashboard (a reply to your request, an invoice or a notice), our email provider (Resend) tells us whether that email has been sent, delivered or delayed, whether your mail server has rejected it or whether you have marked it as spam. We store this with the email, so that we know whether it reached you, and it is deleted with it.
We do not track whether you open our emails or click their links. Legal basis: our legitimate interest in making sure our replies reach you (Art. 6(1)(f) GDPR).
Form protection and technical logs
To stop mass and automated submissions, each form accepts at most 5 submissions every 10 minutes and 10 every 24 hours from the same IP address, plus a maximum number of requests per day from everyone combined. To keep count, our submission-limit service (Upstash Redis, with servers in Ireland) does not store your IP address but a pseudonymised code derived from it, which is deleted automatically 24 hours after the last submission at the latest. If that service fails, the count is kept with the IP address in the server’s temporary memory, for the same time and, at most, until the server restarts. We do not store the IP address itself in any database or write it to the website’s logs.
Separately, the hosting provider (Vercel) keeps its own technical logs of each visit (IP address, date and time, page requested and browser) so that the website works and is secure, for 1 day.
Legal basis for both: our legitimate interest in keeping the website available and secure (Art. 6(1)(f) GDPR).
Website usage statistics
Only if you accept analytics cookies, we use Google Analytics to measure which pages are visited and whether the contact buttons are used (sending a form, tapping “Call” or WhatsApp), with your IP address anonymised. What you write in the forms is never sent to Google.
Data: pages visited, taps on those buttons, the page language, device and browser, analytics cookie identifiers and the anonymised IP address.
Every week we review those statistics, already aggregated (how many visits there are, where they come from and which pages are viewed; never data about a specific person), together with the Google searches in which the website appears (Google Search Console) and the speed of its pages (PageSpeed Insights), to improve the website. We keep that weekly summary in our internal panel and an artificial intelligence (Claude, by Anthropic) helps us interpret it: neither the panel nor the AI receives any personal data about you.
Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 22(2) LSSI-CE). You can withdraw it at any time from “Cookie preferences”, in the website footer.
Retention: the analytics cookies, as stated in the cookie policy; in Google Analytics, the data from each visit is deleted after 2 months.
Data of our clients’ customers
When, to build or maintain a project, we access data for which our client is the controller (for example, the contacts in their CRM), we are not the controller of that data but a data processor (Art. 28 GDPR). We only process it on their instructions and under a signed data processing agreement. If your data falls into this category, exercise your rights with the company that is the controller.
What we do not do with your data
To be clear:
- We do not use it to send you advertising. If we ever wanted to, we would ask for your separate consent.
- We do not sell it or pass it on to third parties, except where required by law.
- We do not make automated decisions or create profiles with it.
Who else has access to your data
We do not pass your data on to third parties except where required by law (for example, to the Spanish Tax Agency or to banks to collect payments). To provide the service, we use providers acting as data processors, under contract and only on our instructions:
- Website hosting and its technical logs: Vercel Inc. (USA). The website’s functions run in Dublin (Ireland) and static files are served from its worldwide server network. Its data processing agreement (DPA) includes the European Commission’s standard contractual clauses, and Vercel Inc. also participates in the EU-U.S. Data Privacy Framework.
- Sending form notifications, the confirmation of your request and internal draft replies by email (the last two, if enabled), and the emails we send you from our internal dashboard (replies, invoices and notices about your fee and your appointments), with their delivery status: Resend (Plus Five Five, Inc., USA), sending from servers in Ireland (EU). Its data processing agreement (DPA) includes the European Commission’s standard contractual clauses, and the company participates in the EU-U.S. Data Privacy Framework.
- Form submission limit (the pseudonymised codes of the IP address and of the email address and its domain for the confirmation, for 24 hours at most): Upstash Redis, by Upstash, Inc. (USA), with servers in Ireland (EU). Its data processing agreement (DPA) is part of its terms of service, which we accept by using it. Any transfers to the USA are covered by the EU-U.S. Data Privacy Framework, in which Upstash, Inc. participates, and, should that not suffice, by the European Commission’s standard contractual clauses.
- Writing internal draft replies with artificial intelligence (if enabled; only the data listed in “When you write to us using the form”, never your email address or phone number): Anthropic Ireland, Limited (Ireland), the Anthropic company that contracts with customers in the European Economic Area, under its data processing agreement (DPA), which is part of its commercial terms and includes the European Commission’s standard contractual clauses for any transfers outside the EEA. Anthropic does not appear on the official EU-U.S. Data Privacy Framework list (checked on 3 November 2026). Under its commercial terms, it may not use this data to train its models and, under its policy, it deletes what we send it and what it returns within 30 days at most, unless it has to keep it longer by law or because of use that breaches its rules. According to its list of sub-processors, the data is processed in the Google Cloud Platform, Amazon Web Services and Microsoft Azure clouds, on servers worldwide, including the USA; those transfers rely on the standard contractual clauses in its data processing agreement.
- Database and file storage of the internal dashboard we use to manage form requests (with their attachments), their internal draft replies and client data (with their invoices and the record of notices): Supabase Pte. Ltd. (Singapore), with servers in Ireland (EU). Its data processing agreement (DPA) forms part of its terms of service and includes the European Commission’s standard contractual clauses for any access to the data from outside the European Economic Area.
- Email we use to reply to you and, if we meet by video call, Google Calendar, where we create the meeting (only with the day, the time and a title with your name), and Google Meet, which we use to hold it: Google Workspace, by Google (Google Ireland Limited and Google LLC), with its data processing addendum, which forms part of its terms. Any transfers outside the European Economic Area rely on the safeguard Google specifies or, failing that, on the European Commission’s standard contractual clauses.
- WhatsApp notices, only if you have agreed to receive them: Meta Platforms Ireland Limited (Ireland), which provides the WhatsApp business platform (Cloud API) as data processor under its terms for that platform. It receives your number, the text of the notice and, if there is one, the invoice as a PDF, in order to deliver it, and according to Meta it keeps messages for 30 days at most. It may also process the data in the USA with Meta Platforms, Inc., its sub-processor, which participates in the EU-U.S. Data Privacy Framework; Meta’s data processing terms also include the European Commission’s standard contractual clauses.
- Web analytics, only if you accept it: Google Ireland Limited and Google LLC (Google Analytics).
Transfers outside the European Economic Area
Some providers may process data outside the European Economic Area. When this happens, the transfer is based on an adequacy decision of the European Commission (such as the EU-U.S. Data Privacy Framework, if the provider participates in it) or on the standard contractual clauses approved by the Commission.
Specifically: Vercel and Resend, with the standard contractual clauses and the EU-U.S. Data Privacy Framework; Upstash, with the Framework and, if that were not enough, the clauses; Supabase and Anthropic, with the standard contractual clauses; and Google, with the safeguard specified in its data processing addendum or, failing that, the clauses.
If you receive the notices by WhatsApp, Meta may pass the data to Meta Platforms, Inc., in the USA, with the standard contractual clauses in its data processing terms; in addition, Meta Platforms, Inc. participates in the EU-U.S. Data Privacy Framework.
Your rights
At any time and free of charge, you can exercise your rights of:
- Access: knowing what data of yours we process.
- Rectification: correcting any data that is inaccurate.
- Erasure: asking us to delete it.
- Objection and restriction of processing.
- Portability: receiving it in a structured format.
- Not being subject to automated decisions.
How to exercise your rights
Write to us at hola@solvosoftwares.com stating which right you wish to exercise. We will reply within one month. You can withdraw your consent at any time, without affecting the processing carried out before.
If you believe we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.
Minors
This website is aimed at businesses, professionals and adults. We do not process data of children under 14 without the consent of their parents or guardians (Art. 7 of the Spanish Data Protection Act, LOPDGDD).
Security
We apply technical and organisational measures appropriate to the risk: communications with the website are encrypted (HTTPS), the form is protected against automated submissions, and only the people who need to deal with the messages can access them.
Changes to this policy
If we change how we process your data, we will update this page and its date. If the change is significant, we will point it out clearly on the website.