Privacy & Cookies

Who is responsible?

Webin48 is operated by Vicente Gómez Posada, based in Amsterdam, the Netherlands. Vicente Gómez Posada is the controller responsible for the processing described here. Contact hello@webin48.com for privacy questions or requests.

Business registration details, including the KVK and VAT number where applicable, will be added once registration is completed.

Your information and why we use it

Website enquiries

We collect your name, email, business description, preferred visitor action and start time. We store the enquiry type, submission ID, time and a hashed security key. We use these to assess your request, reply and prepare a possible project: steps at your request before a contract (GDPR Article 6(1)(b)).

Client project briefs

The brief collects your contact email, optional name, business name, profession, services, ideal clients, website goals, public contact details, language, style, content readiness and domain status. Optional answers cover your approach, visibility, booking/contact method, colours, references, portfolio, material links and other notes. We store answers, a submission ID, timestamp, status and notification status. We use them to prepare and deliver your agreed project and send project messages (Article 6(1)(b)).

Free guide and review

Direct PDF downloads require no email. For email delivery and the free review, we collect your name, email and optional website/profile URL, plus a submission ID and time. We use them to fulfil your optional request, based on consent (Article 6(1)(a)). Withdraw by replying to our email or writing to the privacy contact. Withdrawal does not affect earlier lawful processing. There is no automatic marketing subscription.

Technical information and security

Requests and email delivery involve IP addresses, URLs, browser/request information, timestamps, delivery results and errors. The application logs download-click and guide-request events without adding an advertising identifier. These events and connection data are not assumed anonymous.

Anti-spam checks use hidden fields, submission IDs and hashed or keyed rate-limit values derived from IP addresses and, for guide/brief requests, email addresses. Our basis is legitimate interests in preventing abuse, keeping the service working and diagnosing requests/downloads (Article 6(1)(f)). Hashing does not make these values anonymous. The exact infrastructure log fields and account-level settings have not been verified.

Required and optional information

The forms enforce required fields. Without the required contact/project details, we cannot accept or handle that request. Optional fields can stay empty; if you omit a review URL, we ask for it later. Do not send passwords, patient information, health records or confidential client details. Share only materials you have permission to provide.

Concept-demo forms do not save or send entries; they remain in the page. Hosting security processing still applies to visits.

How long we keep information

• Guide requests: database records older than 90 days are deleted during the next guide email request, not by a scheduled daily job.
• Guide/brief rate limits: expire at the relevant hour boundary; expired records are deleted during the next request to that form.
• Enquiries and briefs: no automatic expiry is configured. Retention depends on active discussions, agreed work/support, unresolved claims and applicable legal duties. Deletion must be manual. An enquiry's security key remains with that record. A fixed manual deletion schedule has not been verified.
• Emails, logs and backups: copies are separate from live database records. Their actual retention settings have not been verified; database deletion does not necessarily remove those copies immediately.

Contact us to ask what is held or request deletion. We may need to retain relevant records for an ongoing obligation or legal claim.

Providers and recipients

People handling your request and the services supporting it receive the information needed for that work:

• ChatGPT Sites / OpenAI and Cloudflare: hosting, request handling, security and protected administration. Submissions use the existing Cloudflare D1 database.
• Resend: server-side transactional email delivery. It processes recipient addresses, message content and delivery metadata. Internal notifications include submitted answers; requested confirmations and guide messages go to your email.
• Business mailbox services: handle correspondence and notification copies. The mailbox provider and any forwarding arrangements have not been verified from the available configuration.

These are the services identifiable from the implementation. Their complete subprocessor chains, contractual roles and account-specific arrangements have not been verified. The code sends plain-text emails without adding tracking pixels or tracking-link rewrites; Resend's domain-level tracking settings have not been verified. Email credentials remain server-side.

International transfers

These providers operate internationally, so processing outside the EEA, including in the US, may occur. Cloudflare documents US processing by default unless regional services are configured. Actual hosting/database/email regions, subprocessors and applicable contractual transfer safeguards have not been verified for these accounts. We do not claim Europe-only storage or that a particular transfer agreement is in place. Ask hello@webin48.com for information about your data and the applicable arrangements.

Cookies and similar technologies

The review identified the security cookie and functional session storage below. No optional analytics, advertising pixels, tracking scripts or third-party embeds were found in the application or sampled public responses. We have not added a consent banner for these necessary security and confirmation functions.

The application does not use localStorage, IndexedDB or service workers. Fonts, images and the PDF are served locally; there are no Google Fonts requests. Normal browser caching may occur. External links are not embedded and lead to services with their own notices.

You can clear browser site data. Blocking security cookies may affect access; confirmation pages have a fallback when session storage is unavailable. Owner administration uses separate ChatGPT sign-in, which ordinary form users do not need. Authenticated-service cookies and all possible conditional hosting cookies have not been verified.

Your rights

Where applicable, you can request access, correction, deletion, restriction or portability of your information; object to processing based on legitimate interests; and withdraw consent without affecting earlier lawful processing.

Email hello@webin48.com. We may ask for proportionate information to verify your identity. We normally respond within one month and explain any lawful extension or exception. You can complain to the Dutch Autoriteit Persoonsgegevens or the relevant EEA supervisory authority.

Automated decisions

Webin48 does not use submissions for solely automated decisions with legal or similarly significant effects, or advertising profiles. Security checks may automatically block suspected abuse. Project requests and reviews are handled by a person.