Template pending legal review. The gaps highlighted in yellow must be completed before publishing.
Privacy policy
Last updated: October 14, 2026
This English version is provided for convenience. If it differs from the Spanish version (Política de privacidad), the Spanish version prevails.
1. Data controller
- Controller
- [PENDING: name or company name]
- Tax ID (NIF/CIF)
- [PENDING: NIF or CIF]
- Address
- [PENDING: address]
- [PENDING: privacy contact email]
This policy covers the data of people who visit this website or sign up for Corelia Cloud (studio owners and their teams). Each studio’s clients’ data is handled by the studio itself as controller; we act as processor under the data processing agreement.
2. What data we process
- Signing up: studio name, chosen web address, your name, email, city, country, time zone and site language, phone (optional) and approximate number of clients. Your password is stored encrypted and we never see it.
- Using the service: your account details, your plan and your billing.
- Technical data: the IP address you send the form from, used only to prevent abuse (mass submissions) and not kept beyond the server’s technical logs.
- Suggested country: to show prices in your currency we infer your country from your browser’s language and time zone (and, if available, from our network provider’s country header). We don’t store it or use it for anything else; only if you pick a country in the selector is it saved in your browser (see the cookie policy).
3. Purposes and legal basis
- Creating your account and providing the service: performance of a contract (GDPR Art. 6.1.b).
- Telling you about activation, the end of the trial and changes to the service: performance of a contract.
- Invoicing: legal obligation (GDPR Art. 6.1.c).
- Protecting the website from spam and abuse: legitimate interest (GDPR Art. 6.1.f).
We don’t send third-party advertising and we don’t sell your data.
4. Who we share it with
Only with providers that help us deliver the service, under a data processing agreement:
- Server hosting: [PENDING: hosting provider and region (EU)].
- Email delivery: [PENDING: email provider].
- Subscription payments: [PENDING: payment gateway (e.g. Stripe)].
If any provider is located outside the European Economic Area, the transfer relies on the European Commission’s standard contractual clauses or the EU-U.S. Data Privacy Framework. [PENDING: verify providers and safeguards]
5. How long we keep it
For as long as you have an account. If you don’t choose a plan when the trial ends, or you cancel, your studio becomes read-only and we delete the data after 150 days, except what the law requires us to keep (for example, invoices). Sign-up requests that are never activated are deleted after 12 months.
6. Your rights
You can request access, rectification, erasure, objection, restriction and portability of your data by writing to [PENDING: privacy contact email]. If you think we haven’t handled your request properly, you can complain to the Spanish Data Protection Agency (aepd.es).