Privacy Policy
Last updated: 15 May 2026
This Privacy Policy explains how personal data is processed on cgaravito.dev under Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).
Controller
The data controller is Carlos Garavito Quispe, NIF 46184597E, with professional address in Benaguasil, Valencia, Spain. Contact email: carlos@cgaravito.dev.
Personal data collected
When you browse cgaravito.dev, server logs may record IP address, user agent, timestamp and requested URL for security and operational purposes. When you initiate a Stripe Checkout session, Stripe collects billing name, email, postal address, tax identifier and payment details directly — those fields are processed by Stripe Payments Europe Ltd. and are accessible to the controller as a customer record. When you open the billing portal, the email you enter is used to look up your customer record in Stripe.
Purposes of processing
Personal data is processed to: (a) operate and secure the website; (b) provide the subscription services offered through Stripe Checkout; (c) issue invoices and meet Spanish accounting and tax obligations; (d) reply to email enquiries; (e) provide customer support and manage subscriptions through the Stripe Customer Portal.
Legal basis
Processing is based on the performance of the contract you enter into when subscribing (GDPR Art. 6.1.b), the controller's legitimate interest in keeping the site operational and secure (Art. 6.1.f), and the legal obligations the controller is bound by under Spanish tax and consumer law (Art. 6.1.c).
Retention
Server logs are retained for up to 30 days. Billing and subscription data is retained for the duration of the contractual relationship and for the periods required by Spanish accounting and tax law (currently six years under the Spanish Commercial Code and four years under General Tax Law 58/2003). After those periods data is deleted or anonymised.
Recipients and processors
Personal data may be shared with the following processors strictly for the purposes above: Stripe Payments Europe Ltd. (payments, subscriptions, invoices, customer portal); Vercel Inc. (hosting and request logs); and the email provider used by the controller to reply to enquiries. Each processor is bound by a data-processing agreement and EU Standard Contractual Clauses where applicable.
International transfers
Some processors (notably Stripe and Vercel) may transfer personal data to the United States. Such transfers are protected by the EU-US Data Privacy Framework and, where required, by Standard Contractual Clauses adopted by the European Commission.
Your rights
You can exercise the rights of access, rectification, erasure, restriction, portability and objection by emailing carlos@cgaravito.dev with proof of identity. You may also withdraw any consent at any time and lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) if you believe your rights have been infringed.
Contact
For privacy questions or rights requests, email carlos@cgaravito.dev. The controller will reply within the deadlines set by GDPR (one month, extendable by two additional months when justified).