Data protection
Privacy policy
Last updated: 27 August 2026
The summary, in four lines
The pages on this website collect no personal data. There is no database, there are no user accounts and no page sends anything behind your back while you read it.
With one exception, explained in full in section 5: there are two chats —the «Any questions?» button on the services pages and the assistant on novantrek.com/secret—, and if you write to them, what you write does leave your browser. Only what you write: you are not asked for a name or an email, and there is no need to register. The games on that page send nothing.
The contact form does not send: it takes what you write, turns it into a message and opens WhatsApp with it already written. You decide whether to hit send. If you do not send it, that text never leaves your phone.
There is no analytics, no advertising pixels, no third-party fonts or scripts. Nobody is tracking you here.
The full detail is below, because a summary does not replace the information the regulation requires.
1. Who the data controller is
- Controller
- [ company name or full name ]
- NIF / CIF
- [ NIF ]
- Address
- [ address, postcode, town and province ]
- info@novantrek.com
- Phone
- +34 643 173 977
- Trading name
- Novantrek
No data protection officer has been appointed, because the activity is not among the cases that require one (Article 37 GDPR and Article 34 LOPDGDD). For any question about your data, write to the address above.
2a. What is measured about your visit
This website counts its visits with a tool of its own. It is not Google Analytics or any third-party service: the program sits on the same server as the website and the data never leaves it and is not shared with anyone.
What is stored
The pages you open, which website you came from (for example, whether you arrived from a Google search or from Instagram), the size of your screen and your window, your browser and operating system, the language you have set, and which links or buttons you click —the link text, not what you type—. Plus the country and approximate city the hosting provider infers from the connection.
Since 27 August 2026 the following are also stored, in this order of usefulness:
- How far down the page you go, as a percentage. It is useful for knowing whether the copy gets read or whether people leave at the top.
- If you click a contact button —WhatsApp, email, phone or sending a form—. It is stored that you clicked it and which one, never what you wrote afterwards: that already happens outside this website.
- How long the page took to load for you, in milliseconds.
- The connection type that your browser declares (4G, wifi…), if it declares it.
- Whether your phone or computer is in light or dark mode, to know which theme to look after more.
- Your time zone, whichever one the device is set to.
- If you get an error on the page: only that it happened and on which page, never the error message, because an error message can carry form data inside it.
- The last page of your visit, to know where people are dropping off.
None of that identifies you, and there are still no cookies and no IP stored.
What is NOT stored, and this is the important part
- No cookies at all. Zero. Neither this website's nor anyone else's. You can check in your browser's tools.
- Your IP address is not stored. It is used for an instant to work out a code and then discarded: in the database there is not a single IP.
- Nothing you type into a form. The software is built to ignore text fields.
- Not your name, not your email, not your phone number. You are not asked and you are not recognised.
How a visit is identified without cookies
With a code calculated from your IP, your browser, a secret key and today's date. It is there to know that the five pages you opened are one visit and not five, and nothing more.
The date being part of the calculation is deliberate: tomorrow that code is different, so there is no way to know you have come back or to follow you from one day to the next. That is the difference between measuring and chasing, and this website stops at measuring.
On what legal basis
The controller's legitimate interest in knowing whether the website works and which pages are any use to it (Article 6(1)(f) GDPR). The least invasive version that can answer that question has been chosen on purpose: no cookies, no IP stored, no profiles and no tracking from one day to the next. That is why you are not asked for consent: there is nothing to consent to beyond that.
If your browser sends the «do not track me» signal (Do Not Track), nothing about your visit is measured. Almost no website respects it; this one does.
How long it is kept
30 days. After that period it deletes itself, without anyone having to remember.
Who sees it
Only the website's controller, in a private password-protected dashboard on a subdomain that is not linked from anywhere. It is not sold, not passed on and not cross-referenced with anything.
Where nothing is measured
On the legal pages —this one, the legal notice and the cookie policy— and in the games room at novantrek.com/secret nothing at all is measured.
3. What happens when you use the contact form
It deserves its own section because it does not work the way people expect, and it works in your favour.
The forms on this site have no server behind them. When you press the send button, a small program running in your own browser takes what you have written, arranges it into a text message and opens WhatsApp with that message already drafted, addressed to the controller's number.
In practical terms:
- The data you type are not stored in any database, because there is none.
- They are not sent by email and do not pass through any intermediary form service.
- If you close the WhatsApp tab without sending, that content goes nowhere and disappears.
- Sending it is your decision, in your own app, after reading the message.
The forms inside the example websites in the gallery are purely for show: they send nothing, not to WhatsApp and not anywhere else.
4. What happens when you message me on WhatsApp
From the moment you decide to send the message, there is processing of personal data and the controller is the one named in section 1.
What data
Your phone number, the name you have set in the app and whatever you tell me in the conversation: usually your name, your business's name, the sector and what you need. I would be grateful if you did not include sensitive data there (health, political views, other people's details) that is not needed for a quote.
What for
To deal with your enquiry, prepare a quote for you and keep up the commercial relationship if we do end up working together.
On what legal basis
The taking of pre-contractual steps at your request (Article 6(1)(b) GDPR). If we end up signing something, the basis becomes performance of the contract and, for invoices, compliance with legal obligations (Article 6(1)(c)).
A note about WhatsApp
WhatsApp is a service of WhatsApp Ireland Limited (Meta group), with its own terms and its own privacy policy, which are not under the control of the controller of this website. Messages travel end-to-end encrypted, but the metadata of the communication is processed by Meta under its own rules. You can read them at whatsapp.com/legal.
If you would rather not use WhatsApp, you can get in touch by phone on the same number or by email at the address in section 1.
5. What happens if you use one of the chats
On this website there are two places where you can write to a machine. Both work the same way inside, so this section covers both:
- The questions chat, the «Any questions?» button that appears bottom right on the service pages. It is there for asking about what the studio does.
- The assistant on novantrek.com/secret, a games page that is not linked from the rest of the site: you only get there if someone gives you the address. There you can also attach images or PDFs.
The games on that page run entirely inside your browser and send nothing anywhere. The chats do send, and that is why they have a section of their own.
On the legal pages —this one, the legal notice and the cookie policy— there is no chat at all: they are read, not talked to.
What data
What you write and the last few turns of the conversation, so it understands the context of what you are asking. In the assistant on /secret, plus any files you decide to attach: images or PDFs, up to three at a time. The questions chat does not accept files.
That is all: you are not asked for your name or your email, and you do not have to register. And if you type a phone number or an email there, it is not stored anywhere — if you want a reply, use the WhatsApp or the email in section 1.
Where it goes
It leaves your browser for my own program hosted on Cloudflare, which forwards it to the language model Gemini, by Google, which is what writes the answer. There is no redirect: you never leave novantrek.com at any point, but the content of your message does reach Google. This applies equally to both chats.
Google Ireland Limited is the group's European entity, whose parent company is in the United States, so there may be international data transfers; according to the provider's own statement, these are covered by the safeguards in Chapter V of the GDPR.
What is NOT stored
Neither the conversations nor the files are stored on this website. There is no database. What you write goes, gets answered, and that is the end of it: if you close the tab, the conversation disappears and no copy stays here. What Google does with the data in its own systems is governed by their terms, not by this website's.
On what legal basis
Your consent (Article 6(1)(a) GDPR), which you give by writing and sending. If you write nothing, nothing is sent. You can withdraw it simply by stopping using the chat.
Your IP address
If the spending cap is active, your IP is used only as the key for an hourly request counter, so nobody can abuse the service at the owner's expense. That counter expires by itself after an hour and is not linked to anything you have written.
That you are talking to a machine
The page itself says so before you type anything: there is no person at the other end, there is an automated system. Its answers may be wrong. They are not professional advice of any kind —not medical, not legal, not financial— and they commit the owner of the website to nothing.
Status as of today
What you should not upload
The page itself warns about it and it is repeated here because it matters: do not type or upload personal, medical or banking data, neither yours nor other people's. A chat is not the place for that, and if the data belongs to someone else, it is not yours to share anyway.
6. Summary of processing activities
| What | Data | Legal basis | Retention |
|---|---|---|---|
| Visit the website | IP and technical connection data, in the hosting provider's logs | Legitimate interest (6(1)(f)): security and operation | Whatever the provider sets in its technical logs |
| Use the form | None of it is processed by the website: the text stays in your browser | Not applicable | Not applicable |
| Writing in one of the chats | What you write (and the files, only on /secret); the IP only as an anti-abuse counter | Consent (6(1)(a)) | Nothing is kept here; the conversation dies when you close the tab |
| Message on WhatsApp or call | Phone number, name and whatever you say in the conversation | Pre-contractual steps (6(1)(b)) | One year from the last contact if there is no engagement |
| Being a client | Contact and billing details | Contract (6(1)(b)) and legal obligation (6(1)(c)) | The tax and commercial limitation periods: up to 6 years |
| Remembering the light or dark theme | A preference stored in your own browser, without identifying you | There is no processing by the controller | Until you clear your browsing data |
7. Who else sees your data
Data is not sold, not rented and not passed to third parties for advertising. Three providers are involved, each in their own part:
- Cloudflare, which hosts and serves these pages. It processes the technical connection data described in section 2. It is a company with a parent in the United States, so there may be international transfers of data; according to the provider itself, these are covered by the safeguards in Chapter V of the GDPR (standard contractual clauses and its adherence to the EU-US Data Privacy Framework).
- WhatsApp Ireland Limited, if you choose that channel to write to me, on the terms of section 4.
- Google Ireland Limited, only if you write in one of the two chats, and only with what you write there, on the terms of section 5. Like Cloudflare, its parent company is in the United States and there may be international transfers covered by the safeguards in Chapter V of the GDPR. Today this provider receives nothing, because the chats are not active. And if the advertising on the games pages is ever switched on, it would be added as an advertising provider too, with its own prior consent.
In addition, the data may be disclosed to the tax authorities, the courts or law enforcement where there is a legal obligation to do so. And, if we end up working together, to the accountancy firm that keeps the books, acting as processor and only for what is relevant.
8. How long data is kept
- Enquiries that do not turn into a job: the conversation is kept for a year from the last message, in case you pick the subject up again, and then it is deleted.
- Clients: for as long as the relationship lasts and, afterwards, for the tax and commercial limitation periods, which reach six years for accounting records.
- The hosting provider's technical logs: whatever Cloudflare applies in its service; the controller of this website does not decide on them.
9. Your rights
You can exercise the rights the GDPR gives you at any time:
- Access: know what data of yours is processed.
- Rectification: correct any that are wrong.
- Erasure: ask for them to be erased when they are no longer necessary.
- Objection: object to processing based on legitimate interest.
- Restriction: ask for them to be kept but not used while a complaint is resolved.
- Portability: receive your data in a commonly used format.
To exercise them, write to info@novantrek.com or to the address in section 1, stating which right you wish to exercise and enclosing a copy of your ID document or equivalent to prove that you are who you say you are. You will get a reply within a maximum of one month.
If you believe your data has not been handled as it should have been, you can complain to the Spanish Data Protection Agency (calle Jorge Juan 6, 28001 Madrid — www.aepd.es). You do not have to complain to the controller first, though the chance to put it right beforehand is appreciated.
10. Minors
The services offered here are aimed at professionals and businesses, and the website is neither intended for nor directed at anyone under fourteen. No data on minors is knowingly collected. If you find that it has happened, write to the address in section 1 and it will be deleted.
11. Security
The site is served entirely over HTTPS, with the hosting provider's certificate, so the traffic between your browser and the server is encrypted. As there is no database, no user accounts and no admin panel, the attack surface is minimal: there are no user records to leak. The key the assistant needs in order to talk to its provider lives as a hosting secret and is never sent to the browser: it is not in the code of any page.
Conversations and working documents are kept on devices with protected access, and reasonable measures are applied to prevent unauthorised access, loss or alteration.
12. Changes to this policy
This policy may be updated if the services, the providers or the law change. The version in force is the one published on this page, with the date shown at the top. Relevant changes will be announced on the website itself.
About the translations of this text
This document is available in several languages for convenience. The Spanish version is the only legally binding one. If a translation says something different from the Spanish version —through an error, a nuance or a word with no exact equivalent— the Spanish version is the one that counts.
This is not a way of dodging responsibility: the translations were produced by software and reviewed by the site owner, not by a sworn translator. Claiming otherwise would be promising a guarantee that does not exist. If something in the translation does not add up, email me and I will clear it up: info@novantrek.com