VISUALO / PRIVACY
Your information.
Handled with care.
This notice covers the information Visualo collects through visualo.online and through the private client area. It is written to meet articles 13 and 14 of the GDPR.
Data controller
- Legal name
- Iuliia Golovanova
- Tax ID (NIF/CIF)
- Z1066244S
- hello@visualo.online
- Website
- visualo.online
For any question about your data, write to the privacy contact below.
What is collected
| Data | When |
|---|---|
| Email address, project brief, selected services, displayed estimate, language and your acceptance of the terms | When you request a quote |
| Offers, payment status records, uploaded and delivered files, feedback and project activity history | While your project runs |
| IP address and technical request details | On every request, to rate-limit abuse |
| Aggregate page views and service categories viewed, with no form contents, email addresses, URL query strings or private project links | Only if analytics is enabled; it is off by default and disabled entirely for Do Not Track and Global Privacy Control |
Never put passwords, identity documents or other sensitive personal documents in a project brief.
Why, and on what legal basis
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Answering your enquiry and preparing a quote | Steps taken at your request before entering a contract — art. 6(1)(b) |
| Producing, reviewing and delivering your project, and taking payment | Performance of the contract — art. 6(1)(b) |
| Keeping invoices and transaction records | Legal obligation under Spanish tax and commercial law — art. 6(1)(c) |
| Protecting the service against abuse and fraud | Legitimate interest in keeping the service available — art. 6(1)(f) |
| Optional analytics on public pages | Legitimate interest, limited to aggregate measurement, and off by default — art. 6(1)(f) |
How long it is kept
| Record | Retention |
|---|---|
| Quote requests that do not become projects | 12 months from the last contact, then deleted |
| Project records, briefs, feedback and delivered files | For the duration of the project and 24 months afterwards, so that delivered work can be re-supplied on request |
| Invoices and transaction records | Six years, as required by Spanish commercial law |
| Session and rate-limit records | Sessions expire after 8 hours; rate-limit counters after 10 minutes |
Who processes it
Visualo uses a small number of processors, each under a data processing agreement: Vercel for hosting and request delivery, Supabase for the database and private file storage, Stripe for payment processing, and an email provider for transactional messages. Project access is restricted to the relevant client and the studio.
Some of these providers are established in the United States. Where personal data reaches them, transfers rely on the European Commission's standard contractual clauses and, where the provider is certified, the EU–US Data Privacy Framework.
Your data is never sold, and it is never used to build advertising profiles.
Cookies and browser storage
One cookie is set: a session cookie that keeps you signed in to your private project area. It is strictly necessary for that feature, so it does not require consent, and it is not set until you sign in.
Browser session storage — which stays in your tab and is never sent to the studio — remembers your language, display currency, selected services and any unfinished request draft. Submitted drafts are cleared once the request goes through.
No advertising or tracking cookies are used.
Your rights
You have the right to access your data, to have it corrected, to have it erased, to restrict or object to its processing, and to receive it in a portable format. Where processing rests on legitimate interest you may object at any time. Write to the privacy contact below; you will get an answer within one month.
Some project, transaction and security records must be retained even after a deletion request, because Spanish tax and commercial law requires it. The studio will tell you exactly what can be removed and what must remain.
If you are not satisfied with the response, you can lodge a complaint with the Spanish data protection authority, the Agencia Española de Protección de Datos (aepd.es), or with the supervisory authority of your country of residence.
Automated decisions
There is no automated decision-making or profiling that produces legal effects for you. Quotes are prepared by a person.
Contact
For any question about your data, or to exercise a right, write to hello@visualo.online
Last updated: 2026-09-13