Privacy Policy

Last updated: August 2026

This policy explains how personal data is handled on saastro.io. It describes what this site actually does today. saastro.io is a small informational site about the Saastro tooling — it has no user accounts, no login, and no e-commerce.

Who is responsible for your data

The controller of the data described in this policy is:

  • Name: Juan Carlos de la Encina López
  • Tax ID (NIF): 70354405G
  • Address: Calle San Blas 1, 45510 Fuensalida (Toledo), Spain
  • Contact for data protection matters: info@saastro.io

No Data Protection Officer has been appointed: the controller is a self-employed individual and this site’s processing meets none of the conditions that make the appointment mandatory under Article 37 GDPR — it involves no large-scale monitoring and no special categories of data.

What data we process

If you use the contact form. This site has a contact form — a slide-out panel that can be opened from any page. If you send it, we receive what you enter in its fields — typically your name, your email address and the content of your enquiry. The form’s fields are defined in our own CMS (Saastro Hub), and your submission travels through our own form-ingestion service at submit.saastro.io, hosted on Cloudflare Workers on our behalf — no third-party form provider is involved. From there it is delivered to us through the delivery integrations configured for the form in our CMS, and we use it solely to read and answer your enquiry.

If you email us. The contact section also links to our plain email address, which you can use instead of the form. If you write to us, we receive whatever you put in that message — typically your name, your email address and the content of your enquiry.

Mail sent to info@saastro.io is received by Cloudflare Email Routing, which forwards it to a mailbox hosted on Google Workspace. Both act on our behalf in handling that correspondence.

Your cookie choice. If you answer the cookie banner, your choice is stored in your browser and sent back to this site on subsequent requests. It contains only your preferences and a timestamp — no identifier. See the Cookie Policy for the detail.

Server logs. This site runs on Cloudflare Workers with request observability enabled, so requests to saastro.io generate technical logs at our hosting provider. Logs of this kind normally include data such as the IP address, timestamp, requested URL and user agent, which can constitute personal data. They are used to keep the site running and secure, not to profile visitors.

We do not store these logs ourselves and we do not set a retention period for them: they are held by Cloudflare and kept for whatever period Cloudflare’s own policy applies to them.

Web fonts. This site loads its typefaces from Google Fonts (fonts.googleapis.com and fonts.gstatic.com) rather than serving them itself. This is a deliberate decision by the site owner: the site does not self-host its typefaces and will keep loading them from Google. As a result, when any page loads, your browser requests those files from Google’s servers and thereby discloses your IP address to Google, together with the technical data inherent to the request (user agent and the page making it). This happens automatically on every visit and before you interact with the cookie banner, because the typeface is needed to render the page. Its only purpose is to download and render the site’s typeface — it sets no cookies and is not used to measure you or profile you. See the Cookie Policy.

Analytics. None. No analytics or tracking scripts are active on this site today — Google Analytics, Google Tag Manager and Cloudflare Web Analytics are all present in the codebase but unconfigured, so nothing loads and no visitor measurement takes place.

What we do not do. We do not sell your data, we do not use it for advertising, we do not build visitor profiles, and we do not make automated decisions about you.

The Saastro platform and WhatsApp Business

Beyond this informational site, the same controller operates the Saastro platform — the tooling (Hub and Gen) that Saastro’s business customers use to run their own websites and capture leads. One channel of that platform is a WhatsApp Business integration built on Meta’s WhatsApp Business Platform (Cloud API). This section describes that processing, because Meta requires the operator of a WhatsApp application to publish it.

Our role here is different from the rest of this policy. For the WhatsApp integration, Saastro’s customers (for example, an insurance broker) are the controllers: they decide to run the channel and who they communicate with. Saastro acts as a processor on their behalf, under a written data-processing agreement (Art. 28 GDPR). The data belongs to the customer and, ultimately, to the person sending the message — not to Saastro.

What is processed. When a person messages a customer’s WhatsApp business number, the platform processes their phone number, the content of the messages they send, and the delivery and status metadata Meta returns (sent / delivered / read timestamps and message IDs). A bot may ask the first qualifying questions; the answers become a structured lead for the customer.

Meta as sub-processor. Messages travel through Meta Platforms Ireland Ltd. / Meta Platforms, Inc. via the WhatsApp Business Platform, which processes them to deliver the service under its own terms. Saastro never messages a person on its own account: every conversation is opened by the person, and replies happen inside Meta’s customer-service window.

Email delivery. When the platform sends transactional or campaign email on a customer’s behalf, it uses Resend (Resend, Inc.) as the email delivery sub-processor.

Legal basis. The customer, as controller, sets the legal basis toward the person — typically the steps taken at the person’s request (Art. 6(1)(b) GDPR), since the person starts the conversation, and/or the customer’s legitimate interest (Art. 6(1)(f) GDPR). Saastro processes solely on the customer’s documented instructions (Art. 28 GDPR).

Retention. Conversations and leads are kept for as long as the customer’s configuration specifies and no longer than needed; the platform default is 730 days and the customer can shorten it. Full platform backups are held for 90 days (see “International transfers”). When a customer leaves, their data is deleted or returned as set out in the processing agreement.

Your rights over this data. Because the customer is the controller, rights over WhatsApp data are exercised through them, and Saastro assists the customer in responding. You can also write to info@saastro.io or use the Data Deletion page, and we will route your request to the right controller.

Each of the processing activities described above rests on its own legal basis:

  • Answering your enquiry (contact form or email). Our legitimate interest in reading and replying to the enquiry you chose to send us (Art. 6(1)(f) GDPR). If your enquiry turns into an engagement, what follows is based on the steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
  • Your cookie choice. The cookie that remembers your choice is strictly necessary to provide a service you explicitly asked for, so it falls under the exemption in art. 22.2 LSSI and requires no consent.
  • Server logs. Our legitimate interest in keeping the site running, available and secure (Art. 6(1)(f) GDPR).
  • Web fonts. Our legitimate interest in serving the site’s typefaces from Google’s network (Art. 6(1)(f) GDPR). The disclosure is limited to the technical data inherent to the request, sets no cookies, and is not used to measure or profile you.

Who we share it with

Cloudflare does three things for us. It hosts and serves this site (Cloudflare Workers), and therefore processes requests to it on our behalf. It hosts the form-ingestion service (submit.saastro.io, also on Cloudflare Workers) that receives what you send through the contact form. And it runs the routing for info@saastro.io: mail sent there is received by Cloudflare Email Routing and forwarded on.

Google appears in two different roles, and the difference matters:

  • Our mailbox. The address above is forwarded to a mailbox hosted on Google Workspace, so Google processes the correspondence you send us on our behalf.
  • Web fonts. Google also receives your IP address whenever a page loads, because this site’s typefaces are served from Google Fonts rather than self-hosted (see “Web fonts” above). Here Google is not acting on our behalf: your browser talks to it directly, and Google processes what it receives under its own Privacy Policy.

Meta and Resend process data only through the Saastro platform’s WhatsApp and email channels — as sub-processors described in “The Saastro platform and WhatsApp Business” above — not through this website.

Beyond our providers, we do not share your data with third parties, except where we are legally required to.

International transfers

Cloudflare and Google are both established in the United States, so the processing described above involves transferring personal data outside the European Economic Area.

Both are certified under the EU-U.S. Data Privacy Framework, the arrangement the European Commission recognised as providing an adequate level of protection in its adequacy decision of July 2023. Transfers to them are covered by that decision, which means no additional safeguard is required for them.

For the Saastro platform described above, Meta Platforms, Inc. and Resend, Inc. are likewise established in the United States, so the WhatsApp and email processing involves transfers there, relying on the EU-U.S. Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses. Full platform backups are stored for 90 days in GitHub Actions artifacts (GitHub, Inc. / Microsoft, United States).

How long we keep it

Enquiries (contact form or email). One year from our last contact with you. If your enquiry leads to a commercial relationship, we keep it for six years, the period we are required to keep records of commercial dealings.

Server logs. We do not hold them ourselves — they stay with Cloudflare, for whatever period its own policy applies.

Your cookie choice expires on your own device one year after you make it, or as soon as you clear it from your browser.

Your rights

Under the GDPR you have the right to request access to your personal data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format. Where processing is based on consent, you can withdraw that consent at any time, without affecting what was done beforehand.

To exercise any of these rights, just write to info@saastro.io. There is no special procedure and no form to fill in: a plain email is enough, and we will not ask you for a copy of your ID. We may ask you for further detail only if we cannot work out which data is yours.

You also have the right to lodge a complaint with a data protection supervisory authority. In Spain that is the Agencia Española de Protección de Datos (AEPD), www.aepd.es.

Changes to this policy

If how we handle personal data changes, we will update this policy and the date at the top of this page.