Privacy Policy
This policy explains what personal data this site processes, for what purpose, on what legal basis and for how long, in accordance with the General Data Protection Regulation (GDPR) and the EU AI Regulation.
1. Data Controller
2. Data Collected
2.1 In the chat with Elsa, the AI assistant
- Conversation messages to provide personalized responses
- IP address for security and technical analysis purposes
- Date and time of interactions
- Session identifier to maintain service continuity
2.2 On the rest of the site
- Contact information (name and email) when you write through the form
- Browsing data through analytics cookies (Google Analytics 4, only with consent)
- Commercial inquiries made through forms
- Prospect data that Migue Studio's field representatives record after talking to a business (name, company, email, phone, city, industry, interest level, and notes). It comes from the representative, not from the person themselves
3. Cookies and Analytics
This site uses Google Analytics 4 (GA4), a web analytics service from Google LLC, to understand how visitors use it and improve its content.
What Google Analytics collects:
- IP address: GA4 uses it to work out your country or region and does not store it
- Pages visited and time spent on each
- Device type, operating system and browser
- Geographic location (country / region level only)
- Traffic source (how you arrived at the site)
Consent and control: Google Analytics only loads after you explicitly accept cookies via the banner displayed on your first visit. Your choice is saved and respected on all subsequent visits.
Withdraw consent: You can change or withdraw your consent at any time from the "Cookies" link in the footer.
Legal basis: Art. 6.1.a GDPR, explicit consent.
4. Purpose and Legal Basis
4.1 Processing purposes
- Provide the services you hire
- Improve Elsa, the AI assistant, by analyzing conversations
- Manage inquiries and commercial communications
- Following up with the prospects that representatives record
- Security and fraud prevention
4.2 Legal basis
- Explicit consent (Art. 6.1.a GDPR) for chat conversations and analytics
- Legitimate interest (Art. 6.1.f GDPR) for security, service improvement, and following up with the prospects that representatives record
- Contract execution (Art. 6.1.b GDPR) for contracted services
4.3 Minors
The services are not intended for anyone under 16. If you are a minor, you need your parents' or guardians' consent. Data from a minor found without that consent is deleted straight away.
5. AI Transparency (EU AI Regulation)
Elsa, the chat assistant, is an artificial intelligence: her replies are written by an Anthropic language model, not by a person.
Conversations may be stored to:
- Improve response accuracy and quality
- Comply with legal obligations
Important: AI is not used to make automated decisions that significantly affect you. You can always ask to deal with a person.
6. Recipients
To provide the service, these providers receive and process personal data:
- Netlify (website hosting, United States)
- Hetzner (servers in Germany where the automations run and where contacts and conversations are stored)
- Anthropic (AI model behind the chat, United States)
- OpenAI (voice note transcription, drafting some emails and the personalized demos, United States)
- Resend (email delivery, United States)
- Cloudflare (bot check on the forms, United States)
- Google (Gmail, to receive and answer contact form messages, and Analytics, only if you accept cookies; United States)
- Cal.com (only if you book a call, United States)
- Telegram (internal notices of answered inquiries: name, company, service, and message, without the email address; Telegram FZ-LLC, United Arab Emirates, with the data stored in the Netherlands)
Transfers to the United States rely on the EU-U.S. Data Privacy Framework or on the European Commission's standard contractual clauses. Anthropic and OpenAI do not use the data they receive through their API to train their models.
7. Retention Period
8. Your Rights (GDPR)
About your data
- Access: obtain a copy of your data
- Rectification: correct inaccurate data
- Erasure: delete your data
- Restriction: restrict processing
- Portability: receive your data in a format you can take to another service
- Objection: ask for your data to stop being processed
About the AI
- Talk to a person: if you'd rather not deal with Elsa, write to the contact email and a person will reply
9. Security Measures
- Encrypted connection (HTTPS) across the whole site
- Servers in Germany behind a firewall
- Secure data backup
- If a security breach affects your data, the CNIL is notified within 72 hours, and so are you if it puts you at high risk
10. Supervisory Authorities
Supervisory authority: Commission Nationale de l'Informatique et des Libertés (CNIL)
If you believe your data rights have not been respected, you can file a complaint with the CNIL.
Contact and Exercise Rights
If you have any questions about this policy, write to info.miguestudio@gmail.com.