Privacy policy
Last updated: 1 November 2026
This policy explains which personal data we process, why, on what legal basis, for how long and what rights you have, under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). This is a translation; in case of discrepancy, the Spanish version prevails.
1. Data controller
InnoAIConsulting LLC (trading as InnoAIConsulting), a limited liability company registered in the State of New Mexico (USA) under number 0008011292, with its registered address at 500 4th St NW, Ste 102 #2840, Albuquerque, NM 87102, USA. Contact for any privacy matter: info@innoaiconsulting.com.
2. What data we process, why and on what basis
| When | Data | Purpose | Legal basis |
|---|---|---|---|
| Contact form | Name, email, company (optional), industry and message | Answering your enquiry and, if you ask, preparing a proposal | Steps taken at your request before a contract (art. 6.1.b GDPR) |
| Contact form (technical data) | IP address, browser (user agent), date and time, and the visit's campaign parameters (UTM) | Securing the form, preventing abuse and knowing which channel brought you | Legitimate interest in protecting the service and measuring channel performance (art. 6.1.f GDPR) |
| Call booking (Calendly) | Name, email, chosen slot and any answers you give | Organising and holding the call | Steps taken at your request before a contract (art. 6.1.b GDPR) |
| Clients | Contact, billing and project data | Providing the contracted service and meeting accounting and tax obligations | Performance of a contract and legal obligation (art. 6.1.b and 6.1.c GDPR) |
| Web analytics (only if you accept) | Pages viewed, traffic source, device type and cookie identifiers | Understanding how the website is used in order to improve it, in aggregate | Consent (art. 6.1.a GDPR), which you can withdraw in "Cookie settings" |
We do not make automated decisions or build profiles with legal effects on you. We do not use your data for advertising. If we ever wanted to send you marketing communications, we would first ask for your specific consent.
3. How long we keep it
- Enquiries and bookings that do not lead to a contract: up to 12 months after the last contact, unless you ask us to delete them earlier.
- Clients: for the duration of the relationship and then for the statutory limitation and accounting/tax retention periods (generally 6 years).
- Technical form data: up to 12 months.
- Analytics: Google Analytics data is kept for 14 months; Vercel Web Analytics uses no cookies and does not keep visitor identifiers for more than 24 hours.
After these periods, the data is deleted or anonymised.
4. Who else has access to the data
We do not sell or share your data. Only the providers that serve us have access, acting as processors under contracts that require them to use the data solely on our instructions:
| Provider | Service | Location and safeguards |
|---|---|---|
| Vercel Inc. | Website and form hosting | USA · EU-US Data Privacy Framework |
| n8n (instance managed by InnoAIConsulting) | Automation that receives the form and delivers it by email | Hosting provider contracted by InnoAIConsulting · processing agreement |
| Email provider | Receiving and answering enquiries | Processing agreement and, if outside the EEA, standard contractual clauses or the EU-US framework |
| Calendly LLC | Call booking | USA · EU-US Data Privacy Framework |
| Google Ireland Ltd. / Google LLC | Google Analytics 4 (only with consent) | EU and USA · EU-US Data Privacy Framework |
We may also disclose data to public authorities when required by law.
5. International transfers
Some providers are located in the United States. Transfers rely on adequacy decision (EU) 2023/1795 on the EU-US Data Privacy Framework for certified companies and, otherwise, on the standard contractual clauses approved by the European Commission. You can ask us for a copy of the applicable safeguards at info@innoaiconsulting.com.
6. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you have given at any time (without affecting prior processing), by writing to info@innoaiconsulting.com. We will reply within one month. If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or the supervisory authority of your country.
7. Security
We apply technical and organisational measures appropriate to the risk: encrypted connections (HTTPS), signed transmission of form data between the website and the automation, restricted access to data and providers with security guarantees.
8. Children
Our services are aimed at businesses and professionals. We do not knowingly process data of children under 14.
9. Changes to this policy
If we change this policy, we will update the date at the top. If the change is significant, we will say so visibly on the website.