Privacy policy

Who we are

Cabriola is a service operated by Marc Llort Maulion, a self-employed professional, Spanish tax ID 23842063X, with a contact address at Carrer de Nàpols, 261, Barcelona, Spain. He is the controller for account data and operation of the service. Contact for privacy requests and data protection rights: [email protected].

What data we process

• Account: email address, name and language, and the provider you sign in with (email, Google or Apple).
• Content: the text, images and forms of your projects.
• Guest answers: whatever your guests submit to your forms (name, attendance, menu, allergies or whatever you ask).
• Basic usage: view and share counts per page, and technical security logs (such as IP address) for a limited time.
• Payments: handled by the payment provider; we keep the order status, not card details.

Google and Apple sign-in

If you choose Google, we request only openid, email and profile. We receive and use the provider identifier, available name and verified email to create your account, authenticate you and connect sign-in to the same user, projects and plan. We do not access Gmail, Drive, contacts or calendars; we do not store Google or Apple passwords or request ongoing access to other Google APIs. Apple may provide a private relay address instead of your real email; we use it in the same way for sign-in and service messages. This data is not sold or used for advertising or training AI models. It is stored with your account on the server and is not sent to AI providers. You can revoke authorisation in your Google or Apple settings; revocation does not automatically delete your Cabriola account. Request deletion at [email protected] or delete it in account settings.

Your role and ours

For your account data we are the controller. For guest answers you are the controller and we are your processor: we process them only to provide the service and on your instructions. You are responsible for informing your guests and for asking only what you need, especially if you collect sensitive data such as allergies or diets that can reveal beliefs or health.

Why and on what basis

• To provide the service you signed up for (contract).
• Security and abuse prevention (legitimate interest).
• Tax and accounting obligations (legal obligation).
• We use no third-party analytics or advertising, and we do not sell data. Optional usage analytics and newsletter emails have separate permissions.

Who we share it with

The service and database run on a server managed by the controller. Cloudflare, Inc. provides DNS, traffic protection and delivery, and email delivery: it may process connection data such as IP addresses and the recipient and content of service messages. Google and Apple are involved only if you choose their sign-in services; Apple also forwards private relay email. Polar Software, Inc. provides the customer portal and, when purchases are enabled, handles payments as merchant of record under its own policy. Fonts are hosted on our server; we do not load Google Fonts. If you publish external images, visitors’ browsers will contact the servers hosting those images.

Providers and international transfers

Cloudflare, Google, Apple and Polar may process data outside the European Economic Area. Cloudflare publishes its data processing terms and transfer safeguards, including standard contractual clauses, at https://www.cloudflare.com/cloudflare-customer-dpa/. The independent services’ policies are https://policies.google.com/privacy, https://www.apple.com/legal/privacy/ and https://polar.sh/legal/privacy-policy. Ask [email protected] for information about recipients and safeguards applicable to your processing. We do not claim that all data is processed exclusively within the EU.

Automated assistance and generation

The AI assistant and AI generation are disabled in the current service. We do not send project content to an AI provider. Before enabling these features we will disclose the provider, the data sent and the processing conditions.

How long we keep it

Account data, sign-in identities and projects are kept while the relevant account or shared workspace exists, until you delete them. Sessions last at most 30 days and expire after 14 days of inactivity; sign-in links expire after 15 minutes. Optional usage events are deleted after 90 days, voluntary feedback after 365 days and staff access audit records after 400 days. Automatic housekeeping runs hourly. Backups are refreshed every six hours and rotate on an ordinary 14-day window; erased data disappears from backups as they rotate. Order references needed for accounting, claims and legal obligations are kept for the applicable statutory limitation periods; account deletion removes the email and direct user association, but a payment reference alone does not amount to irreversible anonymisation.

Delete and export

Export your data or delete your account in settings. Deletion removes the account, connected sign-ins and workspaces where you are the only member, including their projects, answers and files. In shared workspaces your membership is removed; content still managed by other members is not automatically erased. You can delete individual answers. Retention exceptions and backups are described above.

Your rights

Request access, rectification, erasure, restriction, objection or portability at [email protected]. Withdraw consent for usage analytics or newsletters in account settings without affecting earlier processing. We will request only the information needed to verify your identity. You may complain to the Spanish Data Protection Agency: https://www.aepd.es/. We do not make automated decisions with legal or similarly significant effects on you.

Security

We use encrypted connections and restrict access to data. No system is infallible; if an incident affects you we will tell you as the law requires.

Changes

If we change this policy we will say so here, with the date.

Usage data, newsletter and feedback

With permission we count pages, templates and actions (creating, publishing or starting checkout), language and general acquisition channel. Signed-in actions are linked to the account; anonymous visits have no visitor identifier. Analytics does not store IP addresses, full URLs, invitation content or guest details. Events are deleted after 90 days. Turning analytics off in your account also deletes its usage history.

The newsletter is optional, separate from analytics and in your account language. Withdraw permission from your account. We keep the consent date, source, language and copy version while the account exists. Voluntary feedback is visible to staff and deleted after one year. Account export and deletion include this data.