سياسة الخصوصية

لم تخضع هذه الوثيقة القانونية بعد لترجمة عربية احترافية — نشر ترجمة آلية غير مراجعة لنص قانوني أخطر من عرض النسخة الإنجليزية الموثّقة. يرجى قراءة النسخة الإنجليزية أدناه، أو التواصل معنا بالعربية وسنساعدك مباشرة.

The controller for personal data collected through eht-labs.com is EHT Labs.

Legal company name: [Legal company name pending — to be provided by EHT Labs]

Tax ID: [Tax ID (CIF/NIF) pending — to be provided by EHT Labs]

Registered address: [Registered address pending — to be provided by EHT Labs]

Contact email: general@eht-labs.com

These three fields (legal name, tax ID and registered address) are pending — see the notice at the end of this page.

We only collect data you provide yourself, through these channels:

• Project proposal form (available on Contact and Custom Solutions): name, company, email, phone, type of need, description of the problem or project, goal, indicative budget, optionally an attached file of up to 10 MB (PDF, image, Word/Excel document, or plain text), and any additional information you choose to include in the form's free-text field. This form creates a real request in our system — it is not a simple email send.
• Project request flow (Agency start flow): contact name, company, email, phone, sector, project goal and project description, and optionally your current website URL, your social media profile, and any additional information you choose to include in the notes field — the same system as the form above, without an attachment.
• Onboarding after hiring a project: business name, contact person, email, phone, sector, description of the business, current website, social media, address, logo/brand colour notes, materials and references you provide.
• Billing details when accepting a proposal: legal name, tax ID, country, address and chosen payment method.
• Client Panel access: your email, used as an identifier together with a one-time numeric code sent to that same address. The code is stored only as an encrypted hash, never in plain text, expires after 10 minutes, and locks out after 5 wrong attempts. No password is requested or stored.
• Payment data: when you pay for a project or subscription, Stripe itself collects and processes your card details directly — this site never sees or stores your card number. We only receive payment confirmation (amount, date, status).
• Support requests (Client Panel, for clients with an active project): the description of the issue you report to us, and any personal data you choose to include in it.

In these forms, some fields are required (for example, your name, your email, or the description of your project or issue) and others are optional. Required fields are required because they are necessary to process your request: if you do not provide them, we may not be able to handle it.

We use your data exclusively to:

• Respond to your enquiries and requests for information or a quote.
• Prepare and manage commercial proposals.
• Manage the contracting, payment and billing of a project or subscription.
• Carry out onboarding, development, delivery and maintenance of the contracted project — including, where applicable, AI-assisted generation of a creative direction and technical brief from the information you give us about your business, always reviewed and approved by a person before use.
• Manage your access to the Client Panel and your account information.
• Provide technical support, including an initial automated AI analysis (see section 6) to classify an issue before human review, and, where it is safe and enabled, an automated code-fix proposal that a person reviews before it ships.
• Send you communications strictly related to the contracted service (payment confirmations, renewal notices, project status). We do not send marketing or advertising emails unless we explicitly state so in the future and request your specific consent for it.
• Comply with our legal, accounting and tax obligations.

Processing your data relies, depending on the case, on:

• Pre-contractual measures taken at your request (e.g. asking for a quote) — GDPR art. 6(1)(b).
• Performance of the services contract once you accept a proposal and hire a project or subscription — GDPR art. 6(1)(b).
• Compliance with legal obligations, in particular accounting, commercial and tax obligations arising from billing — GDPR art. 6(1)(c).
• Our legitimate interest in maintaining and improving the quality of technical support for active clients — GDPR art. 6(1)(f).
• If we ever send marketing or commercial communications, that specific activity would rely on your express, specific consent — GDPR art. 6(1)(a), revocable at any time — never on the mere fact of having used a contact or proposal form.

Data from requests or proposals that do not become a hired project is kept only for as long as needed to handle your request, and for a maximum of 12 months from the last contact, unless you request earlier deletion.

Data linked to a hired project or subscription is kept for the duration of the contractual relationship and, once it ends, for the legally applicable limitation periods (generally up to 6 years for commercial/accounting purposes under Spanish Commercial Code, without prejudice to different periods required by applicable tax law).

Billing data is kept for the period legally required for tax purposes.

Support requests (the issue description, its follow-up, and any technical analysis or diagnosis attached to it, including AI-assisted analysis) are only available to clients with an active project or subscription, so they are kept under the same criterion as that project's or subscription's own data: for the duration of the contractual relationship and, once it ends, for the same legal limitation periods described in the paragraph above.

The Client Panel's one-time access code stops being valid 10 minutes after it's issued in every case; there is not yet an automated process that periodically deletes already-expired or already-used codes from our database, even though they can never be reused. We flag this here transparently as a pending technical improvement, not as something already solved.

These periods are the limits we commit to respecting. Except where we expressly state otherwise in this section, they are enforced today through manual review and deletion by our team (including when you request deletion of your data), not through an automated process that removes data by itself once the period is reached.

We do not sell or share your data with third parties for commercial purposes. We only share data with the technology providers strictly necessary to deliver the service. According to their own public terms of service, they act as data processors under our instructions for the purposes described below; for Stripe and GitHub, their own terms also acknowledge they act as independent controllers for certain purposes of their own (such as their legal, billing, or fraud-prevention obligations), unrelated to our instructions:

• Supabase — database, authentication and attachment storage. Data is hosted in the European Union (UE (Irlanda)). Attached files are stored privately, never with a public URL: only the EHT Labs team can access them, via a temporary link generated on demand.
• Stripe — payment and subscription processing. Stripe receives and processes payment data directly; we never receive or store it. For that function, and under its own terms of service, Stripe acts in part as an independent controller (for example, for its own legal and fraud-prevention obligations), not solely as a processor under our instructions.
• Hostinger — hosting provider for this site (hosted, as we've verified, on a server located in the European Union) and for sending transactional emails (confirmations, payment notices, support replies).
• OpenAI — automated AI analysis of support ticket content, AI-assisted generation of creative direction and technical brief drafts from the information you give us about your business, and an additional automated technical review of the result (without your contact data) when a code fix is automatically generated for a ticket. In every case, this is internal working analysis or drafts that an EHT Labs person reviews before acting on them — never an automated decision about your rights, obligations, or the service you receive.
• Anthropic — via the Claude Code tool installed on our infrastructure; when enabled on your project, used to generate and verify automated code fixes from a support ticket's description, always reviewed by a person before shipping.
• GitHub — hosting of your project's code repository, where applicable; the repository holds the project's code, not your contact or billing data. Under its own terms of service, GitHub also acts as an independent controller for certain purposes of its own (account and billing management, legal compliance, abuse prevention), never for profiling or advertising purposes.

Our primary database (Supabase) and this site's own hosting (Hostinger) are both hosted in the European Union, so no international transfer applies to that data or to any attachment you send us.

Stripe, OpenAI, Anthropic and GitHub are US-based providers. According to their own, officially published terms of service, these providers offer safeguards for international transfers under the GDPR — in particular, European Commission standard contractual clauses (all four), and, specifically for Stripe and GitHub, also their own certification to the EU-US Data Privacy Framework. We are reviewing each provider's specific contractual documentation so we can confirm and detail here, precisely, the specific safeguard that applies to our relationship with each of them.

You may exercise the following rights over your personal data at any time:

• Access: know what data of yours we process.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion of your data once no longer necessary.
• Objection: object to a specific processing activity.
• Restriction: request that we temporarily restrict processing.
• Portability: receive your data in a structured, commonly-used format.

To exercise any of these rights, write to general@eht-labs.com stating which right you wish to exercise. We may ask for reasonable identification to verify the request genuinely comes from you.

If you believe our processing of your data does not comply with applicable law, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

We apply reasonable technical and organisational measures to protect your data: encrypted communications over HTTPS, strong authentication (including two-factor verification) for administrative access, one-time access codes always stored encrypted (never in plain text), attachments stored privately with no public URL, and data access restricted to what each function strictly needs — all verified directly against our own infrastructure, not just stated.

Payment data is handled directly by Stripe under its own security standards (PCI-DSS); this site never stores your full card number at any point.

We may update this policy to reflect legal, technical or organisational changes. The last-updated date is shown at the top of this page. We recommend reviewing it periodically.

This policy was built from a real, thorough audit of this site's code and configuration, without inventing any data. The controller's legal name, tax ID and registered address (section 1) are pending EHT Labs providing them, and will be added once available.