Legal notice, privacy and cookies

Short version: we use the data you send us to reply and to run the work you asked for, we do not sell it, and you can ask us to delete it at any time. Analytics and advertising cookies only run if you accept them.

Data controller

The controller of your personal data is Antonio Gomez Garcia (Sourcelift), NIF 48727208Y, reachable at info@sourcelift.ai for any privacy question or request.

What we collect and why

We process the following data:

• Contact and diagnosis requests. When you write to us or use the diagnosis form, we process the name, email address and message you provide, plus the domain or brand you ask us to look at. Purpose: to answer you and prepare the free diagnosis. Legal basis: your consent and the steps taken at your request before any contract.
• Client and prospect correspondence. Emails and documents exchanged while scoping or delivering work. Purpose: to run the engagement. Legal basis: performance of a contract, and our legitimate interest in keeping business records.
• Purchases and call bookings. If you buy a service or book a call, we process your name, email address, company, website and the brief you send us; the payment itself is handled by Stripe. Purpose: to deliver what you bought or booked. Legal basis: performance of a contract.
• Security and delivery data. Standard server and email logs generated automatically. Purpose: to keep the site and mailbox working and secure. Legal basis: our legitimate interest.
• Cookieless audience statistics. Umami counts visits in aggregate: the pages viewed, the site or campaign you came from, device type, browser, language, approximate location (country and region), page speed, and actions on the site such as clicking a button, opening a question or sending the diagnosis form. It sets no cookies, stores nothing on your device and uses no advertising identifiers. Umami does not keep your full IP address in our statistics (the one exception, the shortened IP of visits that come from an ad, is explained in the next point): it only uses it at the moment of the visit to estimate that approximate location and to generate a pseudonymous visitor code that changes every month. Purpose: to see which pages, sources and campaigns work, so we can improve the site. Legal basis: our legitimate interest in measuring our own website in aggregate. You can object at any time, as explained in the cookie section.
• Shortened IP of visits that come from an ad. If you reach the site from a Google ad, we send Umami your IP address without its last block (for example, 81.32.10.*) together with the ad's search term and campaign. We never store the full IP or combine it with other data. Purpose: to detect repeated clicks on our ads and exclude that network in Google Ads so we don't pay for them. Legal basis: our legitimate interest in preventing invalid clicks. It is kept like the rest of the Umami statistics, and you can object as explained in the cookie section.
• Analytics and ad measurement, only if you accept cookies. Google Analytics, the Meta Pixel and the OpenAI pixel for ChatGPT Ads record the pages you view, your device and browser, your approximate location, whether you arrived from one of our ads, and actions such as sending the diagnosis form or booking a call. Purpose: to measure how the site and our advertising perform, and to show our ads to people who visited us. Legal basis: your consent, which you can withdraw at any time in the cookie section below. For visitors in the United States, these tools run by default and you can turn them off in that same section.

We do not load advertising pixels unless you accept them, we do not sell your data, and we do not make automated decisions with legal effects about you.

Who processes it with us

We share data only with the providers that make the site, our email, bookings and payments work, each bound by a data processing agreement:

• Vercel Inc. for hosting and content delivery.
• Google Ireland Ltd. (Google Workspace) for our business email.
• Umami Software, Inc. (Umami Cloud, with its data hosted in the European Union) for the cookieless audience statistics described above.
• A form delivery service (such as Formspree), only if you submit the diagnosis form, and only to route your message to us.
• Cal.com, Inc. for booking calls, only if you book one through the site.
• Stripe for card payments, only if you buy a service. Stripe also acts as an independent controller for payment and fraud-prevention purposes, under its own privacy policy.

Only if you accept cookies, data is also shared with Google Ireland Ltd. (Google Analytics, acting on our behalf), Meta Platforms Ireland Ltd. (Meta Pixel) and OpenAI (ChatGPT Ads pixel). For the Meta Pixel, Sourcelift and Meta are joint controllers of collecting and sending that data. Meta and OpenAI then process it under their own terms and privacy policies, including to measure and deliver ads.

Some of these providers may process data outside the European Economic Area. Where that happens, the transfer relies on an adequacy decision or on the European Commission's Standard Contractual Clauses. We do not transfer your data to anyone else, and we never sell it.

How long we keep it

We keep contact and diagnosis data only as long as needed to answer you and, if we start working together, for the life of the engagement. After that we keep what the law requires us to keep, for example for tax and accounting, and delete the rest. You can ask us to delete your data sooner at any time.

Your rights

Under the GDPR you can ask us, at any time and free of charge, to give you access to your data, to rectify it, to erase it, to restrict or object to its processing, and to receive it in a portable format. You can also withdraw a consent you gave, without affecting what we did before you withdrew it. Write to info@sourcelift.ai and we will reply within the legal deadline. If you believe we have mishandled your data, you can complain to the Spanish Data Protection Agency (AEPD, aepd.es).