Privacy policy
Last updated: 22 October 2026
In two lines: if you write to me through the form, I keep your details only to reply to you and discuss your project. I don't sell them to anyone, I don't send you advertising and you can ask me to delete them whenever you like.
1. Who processes your data
| Controller | Silvia Espadas Nieves (Shyn Design) |
|---|---|
| Tax ID and address | At the bottom of this page |
| hola@shyndesign.com |
2. What data I collect and why
If you fill in the contact form
| What I collect | Name, business name, your website address, email, phone, the service you're interested in, the guide budget and whatever you tell me in the message. If you arrived from an ad, which ad is also stored, to know which one works. It's a short word that says nothing about you (for example fb-mallorca). |
|---|---|
| Why | To reply to you, carry out the free review of your website if you asked for it, answer your questions and, where appropriate, prepare a quote. |
| Legal basis | Your consent, given by ticking the box (Art. 6(1)(a) GDPR), and the performance of pre-contractual measures at your request (Art. 6(1)(b) GDPR). |
| How long | For as long as the conversation lasts and one more year afterwards in case we get back in touch. If we end up working together, the legal retention periods for invoicing apply (6 years, Art. 30 of the Spanish Commercial Code). |
Fields marked with an asterisk are required: without them I can't reply to you. The rest are optional.
If I wrote to you first
Sometimes I write to businesses that don't know me, when I see something on their website that is costing them customers. In that case you didn't give me your details: I took them from your own website or from your public listing in the official tourism register, only the business email or phone that you yourself published. I write to you on the basis of legitimate interest, to offer a professional service related to your business, and at most three times. If you reply "no thanks" or ask me not to write again, your email and phone go onto an exclusion list and I won't write to you again even if your business appears on another list. If you don't reply, your details are deleted after a year.
If you request a call
On the appointment page I ask for your business, your name, a phone number or email, and what is causing you trouble, to prepare those twenty minutes. With that I create your record, put the appointment in my calendar and receive a notification on my phone (see section 3). If you cancel, the cancellation is recorded.
If you enter the demo room
| What I collect | To enter shyndesign.com/demos: your name, your email and your type of business. If you click "I'm interested", also your phone number, only if you choose to give it. I also record which demos you open, how many questions you ask and, if you arrived from an ad, which one. What you write to the demo assistants is not stored. |
|---|---|
| Why | To give you access to the demos, reply to you if you click "I'm interested" and, only if you tick the box, send you ideas for your business. |
| Legal basis | Your consent, given by ticking the box (Art. 6(1)(a) GDPR). Commercial communications are sent only if you tick the second box (Art. 21 of the Spanish LSSI); you can withdraw your consent at any time. |
| How long | One year from registration, after which it is deleted. If we end up working together, the legal retention periods for invoicing apply. |
So that you don't have to register every time, your browser stores a technical cookie (sd_demo) containing a signed random code. It only works inside the demo room, lasts 90 days and cannot be used to track you. See the cookie policy.
If you email me
I process the data you provide in the message, for the same purpose and for the same periods.
If you pay me by card
| What I collect | You enter your card details directly on the secure payment page of an external payment processor: I never see or store them. The processor tells me that the payment has been made, the amount, the date and the details you gave for the payment, such as your name, your email and, if you entered them, your billing details. |
|---|---|
| Why | To charge for the service you hired, issue the invoice and keep my accounts. |
| Legal basis | Performance of the contract (Art. 6(1)(b) GDPR) and compliance with my legal invoicing and accounting obligations (Art. 6(1)(c) GDPR). |
| How long | The legal invoicing periods (6 years, Art. 30 of the Spanish Commercial Code). |
The payment processor may also process some of your data to prevent fraud and meet its own legal obligations, under its own privacy policy, linked from its payment page. If you prefer not to pay by card, you can also pay by bank transfer.
Technical visit data
The server hosting this website keeps technical logs (IP address, date and time, browser) for security and to diagnose incidents. This is a standard technical obligation of any hosting and is based on the legitimate interest of keeping the service secure (Art. 6(1)(f) GDPR).
When you submit the form, your IP is also stored with the message, as an anti-fraud measure and to prevent automated submissions.
How I count visits
To know whether this website is useful to anyone, I count visits with my own system, hosted on this same server. I don't use Google Analytics or any third-party tool, and no cookie is set.
For each visit, only the following is stored:
- The date and time
- Which page was viewed
- The domain the visitor came from (for example google.com), never the full address
- Whether the visit was from a phone, tablet or computer
- The browser language, just two letters (for example de)
Your IP address is not stored. To avoid counting the same person ten times on the same day, an irreversible code is calculated combining the date with connection data. That code changes every day and does not allow you to be identified, your visits on one day to be linked with the next, or anyone to know who you are.
That is why this count does not require your prior consent: it is based on the legitimate interest of knowing how the site is used (Art. 6(1)(f) GDPR) and does not involve tracking people. Even so, if your browser sends the "Do Not Track" or "Global Privacy Control" signal, absolutely nothing is recorded.
If you accept advertising cookies (Meta pixel)
| What I collect | Only if you accept advertising cookies in the cookie notice, the Meta pixel is loaded. It sends Meta the pages you visit, whether you tap a contact or WhatsApp button, whether you send a contact or sign-up form, technical data about your browser and device, your IP address and the identifiers of the _fbp and fr cookies. If you reject, it does not load and nothing is sent. |
|---|---|
| Why | To measure how effective my ads on Facebook and Instagram are (for example, how many contacts or requests come from them) and to show Shyn Design ads to people who have already visited the website (remarketing). |
| Legal basis | Your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time from the "Cookie settings" link in the footer, which reopens the notice. |
| How long | The cookies last 3 months. What Meta receives is kept according to its own policy. |
| Who else | Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland, joint controller with me for this collection. It may transfer data to Meta Platforms Inc. (USA) under the EU-U.S. Data Privacy Framework and standard contractual clauses. Meta's privacy policy. |
This is also explained in the cookie policy.
3. Who it is shared with
Notifications to my phone. When you write, request an appointment or the assistant handles an enquiry, I receive a notification via an instant messaging service with the business name and the subject. It never includes your phone, your email or what you wrote: I look at that in my dashboard, which is on my server in Spain. That service is based outside the European Union; that is why the notification contains the bare minimum.
I do not sell, rent or pass on your data to anyone for commercial purposes.
Only the providers needed for this to work have access to it, acting as data processors and bound by contract to confidentiality:
| Provider | Why | Where |
|---|---|---|
| Web hosting and email provider | Hosting this website, its database and email | Spain (European Union) |
| Card payment processor | Processing card payments | European Union. Some data may also be processed in the USA and other countries, with safeguards such as the European Commission's standard contractual clauses and the EU-U.S. Data Privacy Framework. |
If you use the chat assistant, the WhatsApp assistant or the voice answering service, the providers described in section 4 are also involved (some of them in the USA).
The detailed list of providers (name and company of each one) is available to anyone who requests it by writing to hola@shyndesign.com. You can also ask for a copy of the safeguards for international transfers at that same address.
To display itself, this website uses no external services. Fonts, styles and icons are hosted on our own server, so your browser does not connect to Google or any other company when you visit it.
The only exception is if you choose to pay by card: the payment link takes you to the payment processor's page, and only then does your browser connect to it.
And if you accept advertising cookies, your browser also connects to Meta Platforms Ireland Ltd. to load its pixel (see section 2, "If you accept advertising cookies"). If you don't accept them, it doesn't.
Tax advisers or accountants could also have access if we invoice, as could the competent authorities where there is a legal obligation.
4. Artificial intelligence
Shyn Design uses artificial intelligence tools to support its work (layout, code review, text drafts). Since this raises reasonable questions, here is a clear explanation:
- Your personal data is not used to train AI models.
- I do not deliberately enter your contact details (name, email, phone) into third-party AI tools. The only exceptions are the automatic assistants (the chat on this website, the WhatsApp one and the voice answering service): whatever you write or say to them, including a phone number or email if you choose to give it, is sent to the AI model provider so it can reply to you, as explained just below. If you don't want it to leave here, don't write it there: use the form or email.
- This website has an automatic assistant (the chat window). It is identified as such before you write, and is explained just below.
- The texts and design of this site are produced by Shyn Design, with the support of AI tools in production tasks, and reviewed and approved by a person.
- Some illustrative images on this website (for example, the photos on the sector pages: clinic, hair salon, estate agency) are generated with artificial intelligence. They do not show real people, businesses or places. The photos of client work and of Silvia are real. The people who appear in the videos on the home page are also generated with artificial intelligence, and the video itself indicates this with an asterisk.
This website's assistant
This is a separate processing operation, independent of everything above. It only affects people who choose to write in the chat window. If you don't write anything, none of your data is processed.
The assistant answers questions about Shyn Design's services and prices and collects the basics of an enquiry (what business you have, what you need and, only if you provide it, a phone or email so that Silvia can write to you). It is not a person: it is an automatic AI assistant, and this is stated in the window itself, as required by Regulation (EU) 2024/1689.
From each conversation, only what you write and what the assistant replies are stored, together with the enquiry details you have given and a random session code so the thread isn't lost. The conversation expires after 6 hours without writing and the chat starts from scratch. Your own browser also stores a random code with no personal data, which only serves to know that a new enquiry comes from the same browser as a previous one; you can delete it by clearing the site data. It is kept for 90 days on this website's server and then deleted.
If the notification doesn't arrive. When you leave a phone number or email, a notification is sent to Silvia so she can reply. If that notification fails to go out because of an email error, the content is saved on this website's server so that your enquiry isn't lost and Silvia can still reply. It is kept for the same time as the rest (90 days) and then deleted automatically.
Who sees it. Only Silvia, from a private password-protected dashboard that cannot be accessed from outside. Nobody else has access.
Who processes it. To understand what you write and draft the reply, the text of the conversation is sent to a conversational artificial intelligence service provider (USA), which provides the language model, under its commercial terms for businesses: it does not use those conversations to train its models. This is an international data transfer, covered by the European Commission's standard contractual clauses included in its data processing agreement. Your IP address and no other data from your visit are sent to it.
What it does not do. It does not close quotes, sign anything, handle payments or ask for bank details or identity documents. Never type card details, passwords or your ID number in the chat. You can close the window at any time and write by email or through the form, without going through the assistant.
The WhatsApp assistant
Shyn Design's WhatsApp number (+34 722 13 18 68) is answered by the same automatic AI assistant as the chat on this website. It is not a person, and it introduces itself as such in its first message. If you don't write to that number, none of your data is processed for this purpose.
What data is processed. Your phone number, your WhatsApp profile name if it is shown, what you write, what the assistant replies and whatever you choose to tell it (name, business, email). The assistant only reads text messages.
Who processes it. The messaging app itself (WhatsApp, based in the European Union, which relies on the EU-U.S. Data Privacy Framework for transfers to the USA within its group) carries the messages and also processes them under its own privacy policy. The text of the conversation is sent to the same conversational artificial intelligence service provider (USA) as the website chat, under the same conditions: it does not use those conversations to train its models. The number you write from is not sent to that provider, only the text (unless you type it in a message).
How long it is kept and who sees it. The thread the assistant uses to keep the context is kept for 7 days, and the conversation log for 30 days. In addition, the full conversation (your phone number, stored encrypted, what you write and what you are told) is kept for 90 days in a private inbox on this website's server, so that Silvia can read it and reply; after that it is deleted automatically. When you want to talk to Silvia, she is sent an email notification with your phone number and the conversation, and she keeps it for as long as needed to help you. Only Silvia sees it, from a private dashboard and her email. If you want it deleted sooner, ask at hola@shyndesign.com or through the same WhatsApp.
When a person replies. Silvia may reply to you herself through the same WhatsApp. When she does, her first message tells you that a person is writing, not the assistant, and the assistant stops replying in your conversation while she handles it (it starts again if 24 hours pass without her writing, or when she tells it to; when it returns, it tells you that the automatic assistant is helping you again). If the assistant takes over again, it has what you discussed with Silvia in the last 7 days in front of it so you don't have to repeat yourself; that text is sent to the AI provider like the rest of the conversation.
Legal basis. Pre-contractual steps at your request when you ask about a service or a quote (Art. 6(1)(b) GDPR) and Shyn Design's legitimate interest in answering and following up the enquiries it receives (Art. 6(1)(f) GDPR). You can object at any time by writing to hola@shyndesign.com.
What it does not do. Same as the chat: it does not close quotes, handle payments or ask for bank details or identity documents. Never type card details, passwords or your ID number. If you prefer not to talk to the assistant, write to hola@shyndesign.com or use the form.
The demo room assistants
At shyndesign.com/demos there are AI assistants for made-up businesses, so you can try out how they work. Each page states that it is a demonstration and that nothing you ask for is real. What you write is sent to the same conversational AI service provider (USA) to draft the reply, under the same conditions as this website's assistant (it does not use it to train its models), but it is not stored on this website's server: only the number of questions you ask is counted, to limit use. Do not type anyone's real data.
The voice answering service
This is a separate processing operation, independent of the above. It affects anyone who calls Shyn Design's phone number (+34 887 82 42 50), or another of our numbers that we cannot answer at that moment and is diverted to it.
Those calls are answered by an automatic artificial intelligence assistant, which says so when it picks up, as required by Regulation (EU) 2024/1689. It gives information about the services, takes your enquiry and how you want to receive the quote (WhatsApp or email) and, if you ask, puts you through to Silvia. It is not a person and does not close anything on its own.
What data is processed. The number you call from, the audio of the call, its transcript and whatever you choose to say (name, business, what you need). It does not ask for, and you should not give it, bank details, passwords or identity documents: do not say them on the call.
Who processes it. The call is carried by an internet telephony provider based in Spain, with the data in the European Union. Speech is converted to text and text to speech, and the assistant runs, at an AI voice service provider (USA); the language model that understands and drafts the replies is provided by another conversational artificial intelligence service provider (USA), through the former. All three act as data processors under their business terms. For the international transfer, the voice provider relies on the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses, and it is the voice provider that engages the language model provider as a sub-processor. The voice provider has agreements with its language model providers that prohibit them from training their models on its customers' content, and at the voice provider we have switched off the use of these conversations to improve its models.
How long it is kept and who sees it. The audio and the transcript are kept at the voice provider for a maximum of 30 days and then deleted. When the call ends we receive an email notification with your number, the details you gave, a summary and the transcript, which we keep for as long as the conversation with you lasts and one more year after that; if we end up working together, whatever is needed for invoicing. In addition, the call (your number, encrypted, the details, the summary and the transcript) is kept for 90 days in a private dashboard on this website's server, for Silvia to consult; after that it is deleted automatically. Only Silvia sees it.
Legal basis. Your consent, which you give by continuing the call after the notice, when it picks up, that you are talking to an AI assistant and that the call is recorded (Art. 6(1)(a) GDPR), and pre-contractual steps at your request when the enquiry is about a quote (Art. 6(1)(b) GDPR). If you prefer not to talk to an automatic assistant, ask to be put through to Silvia, or hang up and write to us at hola@shyndesign.com or through the form on this website (WhatsApp is also answered first by an AI assistant).
The detailed list of the providers in this section is available to anyone who requests it by writing to hola@shyndesign.com.
5. Your rights
You can exercise these rights at any time, free of charge:
- Access — find out what data of yours I hold.
- Rectification — correct any that is wrong.
- Erasure — have it deleted (the famous "right to be forgotten").
- Objection — have me stop processing it.
- Restriction — have me keep it but not use it.
- Portability — receive it in a readable format.
- Withdraw consent at any time, without affecting earlier processing.
To exercise them, write to me at hola@shyndesign.com stating which right you wish to exercise. I will reply within one month at the latest.
If you believe I have not handled your request properly, you can complain to the Spanish Data Protection Agency (AEPD): www.aepd.es.
6. Security
This website runs over an encrypted connection (HTTPS) and I apply reasonable technical and organisational measures to protect your data. Even so, no system is infallible; if a security breach affecting your rights occurred, it would be notified as required by Article 33 GDPR.
7. Minors
The services on this website are aimed at people over 18. Data from minors is not knowingly collected.
8. Changes
This policy may be updated if the services or the law change. The date at the top always tells you which version is in force.
Owner identification details
| Owner | Silvia Espadas Nieves |
|---|---|
| Tax ID (NIF) | 43113208F |
| Address | Carretera Gradefes, 15 · 24162 Villafañe (León), Spain |