Let’s talk

Legal

Privacy policy

Last updated: 13 October 2026

This English version is a translation provided for convenience. In the event of any discrepancy, the Spanish version prevails.

Data controller

  • Julio José Simón Gil
  • Tax ID (NIF): 77458269L
  • Postal address: Calle Real, 107, Ático B — 29680 Estepona (Málaga), Spain
  • Email: info@julio.works

Given the type and volume of the processing I carry out, I am not required to appoint a data protection officer; for any question about your data, write to me directly at the email address above.

This policy complies with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD), and follows the information guidelines of the Spanish Data Protection Agency (AEPD).

What data I process and where it comes from

The only personal data I collect on this website is the data you send me through one of these four channels:

  • Contact form: name, email, phone number (optional), project type and your message.
  • AI agent on the contact page: whatever you write in the conversation, which usually includes your name, your email, your phone number if you give it and the description of your project.
  • An AI assistant acting on your behalf: if you ask an AI assistant (ChatGPT, Claude or another) to request a quote from me through the website’s public API, I receive your name, your email, your phone number if you gave it to the assistant, the summary of your project and the name of the assistant that sends it.
  • Labs newsletter: your email address.

This is identification and contact data, together with whatever you tell me about your project. I do not process special categories of data, so please do not include sensitive information in your message or in the conversation.

All data comes from you, directly or through the assistant you gave it to; I do not obtain your data from any other source. By providing it, you guarantee that it is accurate and that it is your own and, if you write on behalf of your company, that you are authorised to do so.

When you submit the form, start a conversation with the agent or subscribe to the newsletter, Cloudflare’s Turnstile service processes your IP address and some technical signals from your browser for a single purpose: to check that the submission is made by a person and not by a bot.

With each enquiry I also receive how you arrived at the website: the page you entered through, the site you came from and, if there was one, the campaign in the link. It tells me what brings me clients and does not let me follow your browsing.

The AI agent is a language model that handles your enquiry with the information on the services and rates published on the website. Each message you write is sent, via OpenRouter, to an inference provider to generate the reply.

The website’s analytics works with aggregated data, without cookies and without identifying visitors: Umami, running on my own servers, counts visits and page views, which site or campaign you came from and which actions are completed (requesting a quote, writing to the agent, subscribing to the newsletter), and measures page loading and performance. It does not allow me to know who you are or to follow your browsing, and you can opt out by storing the key umami.disabled with the value 1 in your browser’s local storage.

I process your data for the following purposes, each with its own legal basis:

  • To reply to your enquiry and prepare the proposal or quote you ask me for. Legal bases: your consent (Article 6(1)(a) GDPR, which you give by ticking the box on the form or by asking the assistant to send me your details) and taking steps at your request prior to entering into a contract (Article 6(1)(b)).
  • To handle your enquiry through the AI agent and, when you ask me to, to have a summary of your project with your contact details sent to me. Legal bases: taking steps at your request prior to entering into a contract (Article 6(1)(b)) and my legitimate interest in reviewing the answers the agent gives on my behalf (Article 6(1)(f)).
  • To send you an email notice each time I publish an article or a piece of research in Labs, if you subscribe to the newsletter. Legal basis: your consent (Article 6(1)(a)), which you give by confirming your subscription from the link I send you and which you may withdraw at any time using the unsubscribe link in every email.
  • To manage the professional relationship if we end up working together, including invoicing and the associated accounting and tax obligations. Legal bases: the performance of the contract (Article 6(1)(b)) and compliance with legal obligations (Article 6(1)(c)).

I do not use your data to send you advertising, I do not disclose it to third parties for commercial purposes, and I do not make automated decisions or carry out profiling concerning you. The agent summarises your enquiry, but how to handle it is always my decision.

Who else is involved in the processing

For the form, the agent, the newsletter and the API for assistants to work, the following providers are involved and process your data on my behalf as data processors:

  • Cloudflare, Inc. (USA): website hosting, content delivery network, anti-spam verification (Turnstile), storage of the conversations with the agent and the record of the enquiries I receive through the form, the agent and the API.
  • Resend, Inc. (USA): sending the emails that deliver your message or the summary of your conversation with the agent to me, and managing the newsletter subscriber list and its mailings. These emails are processed in its European Union region (Ireland).
  • OpenRouter, Inc. (USA): routes your messages to the inference provider that runs the agent’s language model. Those providers act as sub-processors and may be located in the United States or in other countries, and only those that undertake not to retain the content of the conversation or to use it to train models are used.
  • Hetzner Online GmbH (Germany): servers, in data centres in the European Union, that run the website’s analytics and my internal management system, where I keep the projects and the invoicing if we end up working together.

If we enter into a contract, your billing data may also be disclosed to my accounting and tax advisers and to public authorities where a legal obligation so requires (for example, to the Spanish Tax Agency). There are no other disclosures.

International transfers

Cloudflare, Resend and OpenRouter are US companies, and the agent’s inference providers may be located in the United States or in other countries without an adequacy decision from the European Commission. Transfers to Cloudflare and Resend are covered by the EU-US Data Privacy Framework, under which both are certified, and failing that by the standard contractual clauses approved by the European Commission. Transfers for the agent rely on those clauses where the provider offers them and, in any event, on their being necessary to handle the enquiry you initiate before a possible contract (Article 49(1)(b) GDPR). Those countries may not offer a level of protection equivalent to that of the European Union. If you prefer your data not to leave the European Economic Area, you can write to me through the form or by email instead of using the agent.

The enquiries I receive and the conversations with the agent are stored on Cloudflare’s network, and the newsletter list with Resend, with the safeguards described above. The analytics data stays on my own servers, within the European Union, and none of it identifies you. If we end up working together, the project and invoicing data move to my management system, in data centres in the European Union.

How long I keep your data

If your enquiry does not lead to a project, I will keep your data for a maximum of 12 months from our last contact and will then delete it. If we end up working together, I will keep it for as long as the professional relationship lasts and, once it ends, blocked for the limitation periods required by law: as a general rule, up to 4 years for tax obligations and up to 6 years for commercial records, including invoicing.

Conversations with the agent are deleted automatically after 90 days. If during the conversation you ask me to contact you, or if an assistant requests a quote on your behalf, the enquiry I receive is subject to the same periods as any other.

Newsletter data is kept for as long as you remain subscribed. If you do not confirm your subscription, your address is never added to the list. If you unsubscribe, your address is marked as unsubscribed so that I do not write to you again, and you can ask me to delete it altogether at info@julio.works.

Your rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and also withdraw any consent you have given (without affecting the lawfulness of the processing carried out before its withdrawal), by writing to info@julio.works. I may ask you for some additional information to verify your identity, and I will reply within one month at the latest.

To stop receiving the newsletter, simply use the unsubscribe link included in every email.

If you believe that I have not processed your data correctly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es, C/ Jorge Juan 6, 28001 Madrid).

Minors

This website is not aimed at children under 14. If you are under 14, do not use the contact form, the AI agent or the newsletter, and do not ask an assistant to write to me on your behalf.

Security

I apply technical and organisational measures appropriate to the risk of the processing. Communications with the website are encrypted with TLS, access to the systems where your data is stored is restricted, and conversations with the agent are deleted automatically when their retention period ends.

Changes to this policy

The version of this policy in force is the one published on this page, with its date of last update. If any change were to affect how I process your data, I will point it out clearly before applying it.