Privacy policy

Last updated: 26 October 2026

*This is a translation of the Spanish version. If there is any difference between them, the Spanish version prevails.*

This page explains, in plain words, what personal data is handled when you use this website, why, for how long and what you can do about it. It complies with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), Spanish Organic Law 3/2018 on Data Protection and Digital Rights (LOPDGDD) and Spanish Law 34/2002 (LSSI-CE).

1. Quick summary

• I only handle the data you give me (form, email, WhatsApp or chat) and a little technical data the website needs to work.
• I use it to reply to you and, if you want, to prepare a proposal. I don't sell it or use it to send you advertising.
• The website does not use cookies and counts visits without identifying you.
• The chat is answered by a Google AI. Please don't type personal data into the chat.
• Some providers are in the United States. I explain the safeguards below.
• You can ask to see, correct or delete your data at any time at hola@msgsixcreations.com.

2. Data controller

• Controller: Marco Sánchez García (MSG Six Creations)
• Address: Santa Cruz de Tenerife (Spain)
• Privacy contact: hola@msgsixcreations.com
• Phone and WhatsApp: +34 671 198 410

I have not appointed a Data Protection Officer because, given the size and nature of the activity, the law does not require one. For any question about your data, email me at the address above.

3. What data I handle, why and on what basis

3.1 Contact form and email

• What data: what you select or write: type of business, services you're interested in, approximate budget (if given), your name, your WhatsApp number or email, and your message. If you email hola@msgsixcreations.com directly, your email address and whatever you tell me.
• Purpose: to reply to you, answer your questions and, if you ask, prepare and send you a proposal. I get an email alert every time someone submits the form.
• Legal basis: steps taken at your request before entering into a contract, when you ask for information or a proposal (art. 6(1)(b) GDPR), and your consent for any other enquiry (art. 6(1)(a) GDPR). You can withdraw consent at any time, without affecting what was done before.
• Is it required? Only your name and one way to reply (WhatsApp or email). Without them I can't answer you. Everything else is optional.
• How long: while we discuss your enquiry and, if we don't end up working together, for a maximum of 12 months after the last contact; then it is deleted. If we do work together, it is kept for the duration of the project and afterwards for the periods required by law (for example, tax rules) or while claims may arise.
• Who else sees it (providers):
  • Netlify, Inc. (USA), as processor: hosts the website and receives and stores form submissions.
  • Cloudflare, Inc. (USA), as processor: forwards email sent to hola@msgsixcreations.com.
  • Google LLC / Google Ireland Ltd. (Gmail): provider of the inbox where I receive emails and form alerts. It is a personal Gmail account, so Google applies its own terms (see sections 4 and 5).
• International transfers: yes, to the United States (see section 5).

3.2 WhatsApp

• What data: if you choose to message me on WhatsApp (+34 671 198 410), your phone number, profile name, profile photo if public, and the messages you send. If you come from the website chat, the pre-written message includes a summary of the conversation, which you can edit or delete before sending.
• Purpose: to reply to you, answer your questions and, if you want, arrange a meeting or prepare a proposal.
• Legal basis: pre-contractual steps at your request (art. 6(1)(b) GDPR) and your consent when you message me (art. 6(1)(a) GDPR).
• How long: as with the form: a maximum of 12 months after the last message if we don't work together; if we do, for the duration of the project and the legal periods afterwards.
• Who else sees it: WhatsApp is provided by WhatsApp Ireland Limited (Meta group). When you use it, Meta handles your data as an independent controller under its own terms and privacy policy, available at whatsapp.com/legal. I don't control what Meta does with that data.
• International transfers: Meta may transfer data to Meta Platforms, Inc. (USA) (see section 5).

If you'd rather not use WhatsApp, you can write to me through the form or by email.

3.3 AI assistant (website chat)

• What data: the messages you type in the chat and the replies generated. For the chat to work, the server also receives technical connection data (such as your IP address), used only to deliver replies and prevent abuse. The chat doesn't ask for personal data and I ask you not to type any (name, phone, email, address, customer data, health information, etc.).
• Purpose: to answer your questions about the services and suggest ideas for your business. If you want to continue, the chat offers to move to WhatsApp or the form.
• Legal basis: answering your request for information about the services, as a pre-contractual step (art. 6(1)(b) GDPR), and the legitimate interest in keeping the chat secure and limiting abuse (art. 6(1)(f) GDPR).
• How long:
  • I do not store chat conversations: the function that sends them to the AI neither stores nor logs them.
  • Netlify keeps the technical connection data (such as your IP address) in its logs for the period stated in section 3.5.
  • In your browser, the conversation is kept only while the tab is open (using a technology called sessionStorage), so it isn't lost when you change page. It is deleted automatically when you close the tab.
  • Google keeps messages for the time set out in its terms (see below).
• Who else sees it:
  • Netlify, Inc. (USA): runs the function that sends your messages to the AI.
  • Google LLC (USA): generates the replies with its Gemini model, through the Google AI Studio API on its free plan.
• Important about Google and the free plan: on the free plan of the Gemini API, Google's general terms allow it to use what is submitted and generated to improve its products, and allow human reviewers to read it (Google says it first disconnects it from the account). Under the terms in force on the date of this policy, for use from the European Economic Area, Switzerland or the United Kingdom Google applies the paid-plan data rules, which do not include that use for product improvement. Even so, because this is a free service whose terms Google may change, I cannot guarantee that Google will not use your messages to improve its products. So: do not share personal data or confidential information in the chat. See how Google handles data at policies.google.com/privacy and ai.google.dev/gemini-api/terms.
• International transfers: yes, to the United States (see section 5).
• No automated decisions: the chat only informs and suggests ideas. It makes no decisions about you (see section 7).

3.4 Visit statistics (Umami)

• What data: I use Umami Cloud to know how many people visit the website, which pages they view, from which country, on what kind of device and browser, which site they came from and which main buttons they tap (WhatsApp, form, chat and concepts). Umami does not use cookies, stores nothing on your device and does not identify you. Your IP address is only used in passing, to work out the country and a changing anonymous identifier, and is not stored in the statistics.
• Purpose: to understand, in aggregate, how the website is used and improve it.
• Legal basis: legitimate interest in understanding and improving the website with a privacy-friendly tool (art. 6(1)(f) GDPR). Since you are not identified and no cookies are used, the impact on you is minimal. You can still object by emailing me; you can also enable "Do Not Track" in your browser or use a blocker; Umami is configured to respect it.
• How long: aggregate statistics are kept for 6 months.
• Who else sees it: Umami Software, Inc. (USA), as processor, under a data processing agreement (DPA).
• International transfers: the statistics are stored on servers in the European Union. Umami Software, Inc. is based in the USA and may use support or network providers outside the EU; in that case the safeguards in section 5 apply.

3.5 Technical data when browsing (hosting)

• What data: like any website, when you visit, your browser sends technical data to the server (IP address, browser type, page requested, date and time), which is kept in server logs.
• Purpose: to display the website, keep it secure and detect attacks or errors.
• Legal basis: legitimate interest in providing a website that works and is secure (art. 6(1)(f) GDPR).
• How long: the period set by the hosting provider for its logs, usually between about 24 hours and a few days.
• Who else sees it: Netlify, Inc. (USA), as processor.

4. Disclosure of data

I don't sell or disclose your data to anyone, unless required by law (for example, a court or the tax authorities). The providers named above are not disclosures: they work on my behalf, under a contract that requires them to protect your data and use it only to provide their service to me. There is one caveat: the email inbox is a personal Gmail account, with no processor agreement as such; Google applies its own terms and its certification under the EU-U.S. Data Privacy Framework. The other exceptions are Meta (WhatsApp) and, to the extent its terms say so, Google for the free Gemini plan, which may also act under their own responsibility, as explained above.

5. International transfers

Some providers are in the United States, outside the European Economic Area. In each case, the transfer relies on one of the safeguards allowed by the GDPR:

You can ask me for more information about these safeguards at hola@msgsixcreations.com.

6. Your rights and how to exercise them

At any time and free of charge, you can:

• Access your data: find out whether I hold data about you and what it is.
• Rectify it if it is wrong or incomplete.
• Erase it ("right to be forgotten") when it is no longer needed or you withdraw consent.
• Object to its processing, for example for visit statistics.
• Restrict processing in certain cases (for example, while a correction is checked).
• Portability: receive the data you gave me in a commonly used format.
• Withdraw consent where processing is based on it, without affecting what was done before.

How: email hola@msgsixcreations.com saying which right you want to exercise. If I have reasonable doubts about your identity, I may ask for information to confirm it, no more than necessary. I will reply within one month (extendable by two further months in complex cases, letting you know).

For data that Meta (WhatsApp) or Google handle on their own account, you can also exercise your rights directly with them.

Right to complain: if you think your data has not been handled properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) at www.aepd.es (e-office: sedeagpd.gob.es) or C/ Jorge Juan, 6, 28001 Madrid, Spain. If you live in another EU country, you can also complain to the authority in your country. I'd appreciate it if you wrote to me first, in case I can fix it.

7. Automated decisions

I do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. The AI assistant only answers questions and suggests ideas; any proposal or decision is made by me, in person, after talking to you.

8. Minors

This website is intended for business owners and managers. It is not aimed at minors, and people under 18 must not use it, including the form and the chat (Google's AI service also requires users to be 18 or over). If I learn that I have received data from a minor, I will delete it.

9. Security

I apply reasonable measures to protect your data: the website is encrypted (HTTPS), the AI service key is not in the website code, access to form submissions and email is protected by password and two-step verification, and I delete data when it is no longer needed. If a security breach put your data at risk, I would act as the law requires, notifying the AEPD and, where necessary, you.

10. Changes to this policy

I may update this policy if the website, providers or the law change. The valid version is always the one published here, with its date. If the change is significant, I will flag it visibly on the website.