What we collect, and why.

Who we are.

Almost A Lab SL is a company registered in Barcelona, Spain, and is the data controller for this website. For anything in this notice, including access and deletion requests, write to letsbuild@almostalab.io and we will reply within 30 days.

What we collect.

The following categories:

• ·The brief form. Your name, email, company, the project type and scope band you pick, and whatever you write in the message field. If you prepare a brief elsewhere on the site, your answers are carried into the contact form for you to review before sending. Unsent contact details are saved in this browser tab’s session storage for up to 24 hours so you can recover after a refresh. Clear draft removes them; confirmed submission removes the saved draft. Browser storage is not a backup. Nothing is inferred about you.
• ·Booking a call. Your name, email and chosen slot, handled by our own Cal.com instance at cal.almostalab.io rather than a third-party scheduler.
• ·The free audit. The domain you enter and the public pages we fetch from it. Beacon reads a website, and we do not ask who you are to run a scan.
• ·Operational logs. Our hosting and edge services may record request information, including IP addresses, timestamps and response status, to operate the site and diagnose problems. The site no longer loads Vercel Analytics or Speed Insights.

We set no advertising or tracking cookies. The only cookies this site sets are the session cookies in our staff-only admin area, which visitors never reach.

Why we are allowed to.

When you send a brief or book a call you are asking us to do something, so we process that data to take steps at your request before entering a contract (GDPR Article 6(1)(b)). Operational logging and the audit tool run on our legitimate interest in understanding whether the site works and in demonstrating what we build (Article 6(1)(f)). We do not rely on consent for any of it, because we do not do the kind of tracking that would require it.

Where it lives.

The site runs on our own infrastructure hosted by Hetzner and managed through Coolify. These are the providers involved in operating the website and its features:

• ·Hetzner: hosting the website and its server-side services. Coolify is the deployment software we operate on that infrastructure.
• ·Airtable: where we keep briefs and audit records so we can act on them.
• ·Anthropic and OpenRouter: the models that read a scanned site and write the audit summary. They receive the public page content of the domain you submit.
• ·Ora: the public domain you submit for an agent-readiness scan. Submitted domains and scan results may appear in Ora’s public scan dataset; Ora results may be cached or subject to provider limits.
• ·Supabase: authentication for our staff-only admin area.
• ·Cloudflare: DNS and CDN, including for our product subdomains.

Some of these are US companies. Where data reaches them, the transfer relies on the safeguards in that provider's own data processing terms, such as standard contractual clauses. We update this list when it changes. Ask us for current hosting and data-flow details; our security page explains the decisions we agree before a client build.

How long we keep it.

A brief stays on file while the conversation is live, and for as long as the relationship it might become stays plausible. If it goes nowhere, ask us and we delete it. Operational backups roll on a 30-day window and audit logs on 90 days, matching the retention published on our security page.

What you can ask for.

Under GDPR you can ask for a copy of what we hold, have it corrected, have it deleted, have processing restricted, take it elsewhere in a portable format, or object to it entirely. One email to letsbuild@almostalab.io covers all of them, and we do not require you to explain why.

If we handle that badly, you can complain to the Agencia Española de Protección de Datos, Spain's supervisory authority, at aepd.es. You do not need to come to us first.

Client project data.

This notice covers this website. Inside a client engagement, the contract and data processing agreement we sign govern the data instead. Our standard DPA template is available within 24 hours of asking.

Changes.

If what we collect changes, this page changes with it and the date at the top moves to the day we changed it.