Privacy Policy

Last updated: July 2026

This policy explains how personal data is handled on saastro.io. It describes what this site actually does today. saastro.io is a small informational site about the Saastro tooling — it has no user accounts, no login, and no e-commerce.

Who is responsible for your data

The controller of the data described in this policy is:

  • Name: Juan Carlos de la Encina López
  • Tax ID (NIF): 70354405G
  • Address: Calle San Blas 1, 45510 Fuensalida (Toledo), Spain
  • Contact for data protection matters: info@saastro.io

No Data Protection Officer has been appointed: the controller is a self-employed individual and this site’s processing meets none of the conditions that make the appointment mandatory under Article 37 GDPR — it involves no large-scale monitoring and no special categories of data.

What data we process

If you email us. The contact section of this site links to a plain email address; there is no contact form. If you write to us, we receive whatever you put in that message — typically your name, your email address and the content of your enquiry. This data reaches us through our email provider, not through this website.

Mail sent to info@saastro.io is received by Cloudflare Email Routing, which forwards it to a mailbox hosted on Google Workspace. Both act on our behalf in handling that correspondence.

Your cookie choice. If you answer the cookie banner, your choice is stored in your browser and sent back to this site on subsequent requests. It contains only your preferences and a timestamp — no identifier. See the Cookie Policy for the detail.

Server logs. This site runs on Cloudflare Workers with request observability enabled, so requests to saastro.io generate technical logs at our hosting provider. Logs of this kind normally include data such as the IP address, timestamp, requested URL and user agent, which can constitute personal data. They are used to keep the site running and secure, not to profile visitors.

We do not store these logs ourselves and we do not set a retention period for them: they are held by Cloudflare and kept for whatever period Cloudflare’s own policy applies to them.

Web fonts. This site loads its typefaces from Google Fonts (fonts.googleapis.com and fonts.gstatic.com) rather than serving them itself. This is a deliberate decision by the site owner: the site does not self-host its typefaces and will keep loading them from Google. As a result, when any page loads, your browser requests those files from Google’s servers and thereby discloses your IP address to Google, together with the technical data inherent to the request (user agent and the page making it). This happens automatically on every visit and before you interact with the cookie banner, because the typeface is needed to render the page. Its only purpose is to download and render the site’s typeface — it sets no cookies and is not used to measure you or profile you. See the Cookie Policy.

Analytics. None. No analytics or tracking scripts are active on this site today — Google Analytics, Google Tag Manager and Cloudflare Web Analytics are all present in the codebase but unconfigured, so nothing loads and no visitor measurement takes place.

What we do not do. We do not sell your data, we do not use it for advertising, we do not build visitor profiles, and we do not make automated decisions about you.

Each of the processing activities described above rests on its own legal basis:

  • Answering your email. Our legitimate interest in reading and replying to the enquiry you chose to send us (Art. 6(1)(f) GDPR). If your enquiry turns into an engagement, what follows is based on the steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
  • Your cookie choice. The cookie that remembers your choice is strictly necessary to provide a service you explicitly asked for, so it falls under the exemption in art. 22.2 LSSI and requires no consent.
  • Server logs. Our legitimate interest in keeping the site running, available and secure (Art. 6(1)(f) GDPR).
  • Web fonts. Our legitimate interest in serving the site’s typefaces from Google’s network (Art. 6(1)(f) GDPR). The disclosure is limited to the technical data inherent to the request, sets no cookies, and is not used to measure or profile you.

Who we share it with

Cloudflare does two things for us. It hosts and serves this site (Cloudflare Workers), and therefore processes requests to it on our behalf. It also runs the routing for info@saastro.io: mail sent there is received by Cloudflare Email Routing and forwarded on.

Google appears in two different roles, and the difference matters:

  • Our mailbox. The address above is forwarded to a mailbox hosted on Google Workspace, so Google processes the correspondence you send us on our behalf.
  • Web fonts. Google also receives your IP address whenever a page loads, because this site’s typefaces are served from Google Fonts rather than self-hosted (see “Web fonts” above). Here Google is not acting on our behalf: your browser talks to it directly, and Google processes what it receives under its own Privacy Policy.

Beyond our providers, we do not share your data with third parties, except where we are legally required to.

International transfers

Cloudflare and Google are both established in the United States, so the processing described above involves transferring personal data outside the European Economic Area.

Both are certified under the EU-U.S. Data Privacy Framework, the arrangement the European Commission recognised as providing an adequate level of protection in its adequacy decision of July 2023. Transfers to them are covered by that decision, which means no additional safeguard is required for them.

How long we keep it

Email correspondence. One year from our last contact with you. If your enquiry leads to a commercial relationship, we keep it for six years, the period we are required to keep records of commercial dealings.

Server logs. We do not hold them ourselves — they stay with Cloudflare, for whatever period its own policy applies.

Your cookie choice expires on your own device one year after you make it, or as soon as you clear it from your browser.

Your rights

Under the GDPR you have the right to request access to your personal data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format. Where processing is based on consent, you can withdraw that consent at any time, without affecting what was done beforehand.

To exercise any of these rights, just write to info@saastro.io. There is no special procedure and no form to fill in: a plain email is enough, and we will not ask you for a copy of your ID. We may ask you for further detail only if we cannot work out which data is yours.

You also have the right to lodge a complaint with a data protection supervisory authority. In Spain that is the Agencia Española de Protección de Datos (AEPD), www.aepd.es.

Changes to this policy

If how we handle personal data changes, we will update this policy and the date at the top of this page.