Privacy policy
Who is responsible?
Controller: Andrés Eduardo Gómez Ruggiero, an individual operating under the CaliaWaves brand. Address: Calle Constelación de Perseo 41, 28983 Parla, Madrid, España. Email for contact, privacy and data rights:
[email protected]Enquiries and submitted material
Contact asks for name, email, service and message. Country/region and ordinary attachments are optional. Sending an idea from Lab includes its WAV and MIDI files and musical metadata such as key, progression, tempo and summary. This information is used only to respond and handle the submitted material.
Requested quotes and project enquiries are processed to take pre-contractual steps at your request (GDPR Article 6(1)(b)). General enquiries and proportionate abuse prevention rely on the legitimate interests of responding to messages and protecting the service (Article 6(1)(f)); you may object. No marketing consent or newsletter is requested.
Attachments and retention
Ordinary uploads allow up to three files, 10 MiB each and 20 MiB total. The server supports MP3, WAV, MIDI, PDF, JPEG and PNG; the ordinary form offers all except MIDI. Lab sends two generated files, up to 10 MiB each and 15 MiB total. Files are validated and scanned before email delivery. Upload buffers are held in memory, not published or written to a temporary upload directory; request references are released after handling. This is not a guarantee of immediate secure memory erasure.
Ordinary enquiries are retained for no more than 30 days after they conclude. Attachments are kept only while needed to assess or respond to the enquiry and, if it does not lead to a project, for no more than 30 days. If an enquiry becomes a client/project relationship, only what is necessary for that relationship and legal obligations is retained. This policy covers the operator’s mailbox copies; the website does not implement automatic mailbox deletion. Provider-managed copies and security logs are subject to their applicable retention policies. Avoid unnecessary sensitive data and ensure you can share other people’s material.
Security and external services
Cloudflare Turnstile checks bots when Contact is opened. Its browser checks can process IP address, browser/user-agent, TLS fingerprint and site origin; our server sends the verification token to Cloudflare. Cloudflare describes processor and independent-controller roles for different Turnstile purposes. Resend receives the enquiry, reply address and attachments for email delivery to the operator’s mailbox. ClamAV scans attachment bytes through the configured service.
The receiving mailbox uses Google/Gmail. The operator applies the enquiry and attachment retention policy to mailbox copies. Railway is the selected production host for the website and its private ClamAV service; uploads are not stored in a persistent user-file volume.
External providers may process data outside the European Economic Area. Applicable safeguards depend on the provider, service and account terms, including adequacy decisions or standard contractual clauses where applicable. You can request information about the arrangements applicable to your data at the controller’s email address. Provider privacy and processing terms are linked below.
The application uses transient IP-based Contact rate limiting and logs redacted error events/statuses, not enquiry contents or Turnstile tokens. Hosting access logs are managed separately by the hosting provider under its retention policies. No active AI endpoint processes your project.
Browser storage and cookies
First-party localStorage remembers language, Lab panel preferences, custom chords/rhythms, Melody tracks and saved Smart Mix preferences, although Smart Mix is disabled. Saving these choices does not send them to us; an explicit Lab submission sends the selected musical material. You can remove them using your browser’s site-data settings; doing so removes saved work. No site analytics, advertising tracker, remote font or third-party media embed is integrated. Outbound links contact their destination only when followed. Turnstile processes security signals as described above; no consent-required tracker may be added without an appropriate consent mechanism.
Your rights
You can request access, rectification, erasure, restriction, objection and portability where applicable by emailing [email protected]. Requests are answered within one month; where legally permitted, a two-month extension is communicated within that first month with reasons. Identity checks are limited to what is necessary. You can complain to the Spanish Data Protection Authority (AEPD).