Privacy Policy

The protection of your privacy and your personal data is very important to Abalun. In this policy we tell you what data we process when you visit abalun.com, for what purpose, on what legal basis, with whom we share it, how long we keep it and how you can exercise your rights, in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

The home page of abalun.com is a conversation with an artificial intelligence assistant that replies on behalf of Abalun. Its replies are generated automatically, except for the messages labelled ‘Someone from our team · live’, which are written by a member of the team.

This text was updated on 7 November 2026 to reflect how the new website works.

The controller is Yoinet Proyectos en la Red SL, which operates under the Abalun brand, with its address at Serrano 93, 28006 Madrid and tax identification number (CIF) B86286705. You can write to us at hola@abalun.com or call us on +34 919 588 470.

Your approximate city. Like any website, we receive your IP address with each visit. Our hosting provider, Vercel, uses it to estimate your approximate city, your country, your time zone and approximate coordinates, and passes them to us with each request. We use them to greet you with your city, your local time and the current weather. Your IP address is never stored in clear text or used to identify you; your approximate city and country, however, are stored with the history, as we explain below.

The weather. To find out what the weather is like where you are, our server queries Open-Meteo with those approximate coordinates. Open-Meteo only receives the coordinates, and it receives them from our server: never your IP address or any other data of yours.

When you arrive. The greeting is written by the artificial intelligence assistant. For this, even if you do not write anything, we send our artificial intelligence provider, Anthropic, your approximate city and country, your local time, the weather, your browser’s language, the website you come from (for example, a Google search) and, if you come from the TL;DR, the page you were reading. Never your IP address.

The conversation. What you write, together with that same context data, is sent to Anthropic so that the assistant can reply to you. Depending on the configuration, the request may first pass through Vercel AI Gateway, a Vercel service that forwards it to the provider. If you write personal data in the conversation, such as your name or your email address, Anthropic receives it as part of the conversation. We ask you not to share particularly sensitive data, such as health data.

The conversation history. We keep a copy of each conversation in order to review it and improve the service. Before storing it, we automatically replace names, email addresses, telephone numbers and company names with markers such as [nombre] (name) or [empresa] (company); to detect them we also use the artificial intelligence model. If the replacement fails, the text of that message is not stored. We do keep what helps us improve, such as the sector, the type of need, the timescales or the budget range you mention. With each conversation we also store the date, the language, the approximate city and country and the website you came from.

Artificial intelligence agents. Other artificial intelligence assistants can query us through our MCP server (abalun.com/mcp). What they ask is treated like the conversation: it is sent to Anthropic so that the assistant can reply, and we keep a copy with the personal data replaced, together with the date and the approximate country from which the query comes. No calls are booked and no contact details are collected through this channel.

Your copy of the conversation. The full conversation, without replacements, is also stored in your own browser, in its local storage, for 7 days from the last message, so that you can continue it if you reload the page or come back. That copy stays on your device; when you write a new message, your browser sends us the conversation so that the assistant can reply in context. We explain this in detail in the Cookie Policy.

Your contact details. If you want to book a call with us or have us write to you, a form in the conversation will ask you for your name and your email address and, if you wish, your company. Those details are collected by the form, not by the assistant: the artificial intelligence assistant does not see what you type in the form, only what you write in the conversation. We use them only to arrange the call or reply to you and, only if you tick the news checkbox, also to send you news; they are stored separately from the conversation history. Separate from these are the project details you tell us in the conversation: what you need, the sector, the timescales, the approximate budget and, if you mention it, your company. We use them to prepare the pre-briefing for the call. From that pre-briefing, the need, the sector, the timescales and the budget range are also stored in the conversation history; your name and your email address are not, and the company is replaced by a marker.

Abalun news (optional). Next to those forms there is a checkbox, unticked, for you to give us permission to write to you from time to time with Abalun news. It is optional and nothing depends on it: you can book the call or ask us to write to you without ticking it. Only if you tick it do we use your name and your email address for that news.

If you book a call. We create an event in our calendar with your name, your email address, your company and the pre-briefing, and Google sends you the invitation, with the Meet link, to the email address you give us. If you ask us to write to you, we send you a confirmation email. In both cases we receive a notification by email and by Google Chat with those details. The invitation and the notification are kept in our calendar and in our email, like any professional meeting or email; the website’s copy is deleted after 90 days. If you tick the news checkbox, after the 90 days we keep only your name, your email address, your language and your consent until you unsubscribe; if you ask us to write to you and tick it, the confirmation email includes the unsubscribe link.

Talking to a member of the team. If you ask to talk to a person, or if the conversation fits with what we do, we notify the team by Google Chat (or by email, if the Chat notification does not arrive) with a summary, the contact details you have given us and the latest messages. If the notification arrives by Google Chat, from that moment the team sees the full conversation live and can reply to you here: their messages carry the label ‘Someone from our team · live’. If you are no longer on the website and you left us your email address, their reply reaches you by email.

Security and reasonable use. To protect the conversation from abuse, we limit how many messages can arrive per minute from the same connection, including the greeting it starts with, and also how many times you can book a call or ask us to write to you (5 per hour of each type). To count them, instead of your IP address, we store a pseudonymised fingerprint of it, calculated with a secret key, which does not make it possible to know your IP address without that key. In addition, our hosting provider runs an invisible check in your browser to distinguish people from automated programs (bots); we only receive its result.

Visit statistics. To understand, in aggregate, how the website is used, we use Plausible Analytics, a cookieless statistics tool, in an instance hosted in the European Union (Google Cloud, Madrid) that we manage ourselves. With each page you open, your browser sends it the address of the page and that of the website you come from. From that, your IP address and your browser’s technical data, we obtain aggregate statistics: pages visited, websites of origin, countries, device types, browsers and operating systems, time spent on each page and how far down it is scrolled, links to other websites and files that are opened and, without any data of yours, how many calls are booked and how many email addresses are left with us. Your IP address is only used to determine the country and to calculate, together with your browser’s data, an identifier that changes every day, with which visitors are counted without knowing who they are or recognising them from one day to the next; the IP address is not stored. Plausible does not use cookies or store anything in your browser, and nothing we see identifies you.

We do not make automated decisions that produce legal effects concerning you, and we do not create profiles for advertising purposes.

Legitimate interest (Article 6(1)(f) of the GDPR) to handle the conversation you start, greet you with your city, your time and the weather, protect the website against abuse and bots, keep the history, with the personal data replaced, to improve the service, and understand, in aggregate and without identifying you, how the website is used (the visit statistics). You can object to this processing at any time, as we explain in ‘What are your rights?’.

Handling your request (Article 6(1)(b) of the GDPR) for the contact details you give us when you book a call or ask us to write to you: they are necessary to handle what you ask of us, that is, to arrange the call or reply to you. That is why we do not ask you to accept anything to send the form; we only inform you.

Consent (Article 6(1)(a) of the GDPR and Article 21 of Spanish Law 34/2002 on Information Society Services and Electronic Commerce, LSSI) to send you Abalun news, only if you tick the optional checkbox, which is unticked by default. You can withdraw it whenever you wish, without this affecting what we have done with it before.

You are not obliged to give us any personal data in order to use the website. If you do not give us your email address, we will not be able to book the call or write to you. Ticking the news checkbox is optional.

We do not sell your data or disclose it to third parties, except where there is a legal obligation. To run the website, we rely on the following providers, which act as processors, on our behalf and following our instructions:

Vercel Inc. (United States): hosting of the website, estimation of the approximate city from the IP address, protection against bots and, depending on the configuration, forwarding of requests to the artificial intelligence provider (Vercel AI Gateway).

Anthropic, PBC (United States): the artificial intelligence model that generates the assistant’s replies and that helps to replace personal data before the history is stored.

Google, as the provider of Google Workspace (Abalun’s calendar, Meet and email): the call event, the Meet link, the invitation you receive, the email account in which we receive notifications and Google Chat, where the team receives notifications and follows conversations live.

Hetzner Online GmbH (Germany): hosts, in the European Union, the Abalun server that takes notifications to Google Chat. It does not store what you write: only which notification corresponds to which conversation, for up to 90 days after the last message.

Resend, Inc. (United States): sending of notification and confirmation emails.

Supabase, Inc.: the database, hosted in the European Union (Ireland), in which the conversation history, contact details and rate-limiting records with a pseudonymised fingerprint of the IP address are stored (every day, records more than 24 hours old are deleted).

Google Cloud EMEA Limited (Ireland): hosts, in the European Union (Madrid), the server for the visit statistics, our instance of Plausible Analytics.

In addition, to find out what the weather is like, our server queries Open-Meteo, sending only approximate coordinates, without your IP address or any other data of yours.

Third-party videos. If the website shows you a video from YouTube (in its privacy-enhanced mode) or from Vimeo, your browser loads it directly from them: YouTube (Google) or Vimeo receive your IP address and may store data in your browser. They do so as independent controllers, in accordance with their own privacy policies, not on our behalf. This only happens if a video is shown; we explain it in the Cookie Policy.

Vercel, Anthropic and Resend are in the United States; Google, as the provider of Google Workspace, may process data in data centres inside and outside the European Economic Area, including the United States; Supabase, although it stores the data in Ireland, is a US company; and Google Cloud EMEA Limited, although the statistics server is in Madrid, belongs to a US group. When your data leaves the European Economic Area or may be accessible from outside it, the transfer is covered by the standard contractual clauses approved by the European Commission.

The full copy of the conversation in your browser: 7 days from the last message. You can delete it earlier from your browser; we explain how in the Cookie Policy.

The messages that the team writes to you live: in full for 7 days, so that you can see them if you come back; after that, only with the personal data replaced, like the rest of the history. In Google Chat they are kept like any of the team’s work messages.

The conversation history, with the personal data replaced, and the date, language, city, country and website of origin that accompany it: it is deleted automatically 24 months after the conversation starts.

The contact details you give us for a call or for us to write to you: if you do not tick the news checkbox, the website’s copy is deleted after 90 days. The call invitation and the notification we receive are kept in our calendar and in our email, like any professional meeting or email.

If you tick the news checkbox, after 90 days we still delete your company, the pre-briefing and the call details from the website’s copy, and we keep your name, your email address, your language and the record of your consent until you unsubscribe. You can unsubscribe whenever you wish with the unsubscribe link included in every news email or by writing to us at hola@abalun.com. When you unsubscribe, we stop writing to you with news and your data falls under the general rule: it is deleted from the website’s copy 90 days after your call or contact request or, if that period has already passed, at the next automatic clean-up.

Your IP address is never stored in clear text. The pseudonymised fingerprint we use for the usage limits is stored with the time of each message, each greeting, each booking and each request for us to write to you; it is not used for anything else, and every day we delete those that are more than 24 hours old.

The visit statistics: they are aggregate data, without your IP address or anything that identifies you, and we keep them for as long as they are useful to us to understand how the website is used.

You can ask us at any time for:

Access: to know whether we process data about you and to obtain a copy.

Rectification of inaccurate data or erasure of your data.

Restriction of processing in certain circumstances; in that case we will only keep the data for the exercise or defence of claims.

Objection to processing based on our legitimate interest, on grounds relating to your particular situation. We will stop processing your data except on compelling legitimate grounds or for the exercise or defence of claims.

Portability of the data you have given us with your consent or to handle your request.

Withdrawal of your consent to news whenever you wish, with the unsubscribe link in each email or by writing to us.

To exercise them, write to us at hola@abalun.com stating which right you wish to exercise, or send a letter to Yoinet Proyectos en la Red SL, Serrano 93, 28006 Madrid. If we have reasonable doubts about your identity, we may ask you for additional information to confirm it.

As we keep the history without names or contact details, to find your conversation we may need you to tell us the date and some detail of what you talked about.

If you consider that we have not handled your rights properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).

Abalun implements technical and organisational measures appropriate to the risk in order to protect your data against accidental or unlawful destruction, loss or alteration and against unauthorised processing or access. The conversation travels encrypted between your browser and our server. No system is completely invulnerable: if a security breach affecting your data were to occur, we would notify it to the Spanish Data Protection Agency (AEPD) and, where applicable, communicate it to you, in the cases and within the time limits laid down by law.

We do not verify the truthfulness of the data you give us, so we ask you to make sure it is correct.

This website is not intended for minors. If you are a minor, do not provide us with personal data.

This website does not use analytics or advertising cookies. What it stores in your browser, and how to delete it, is explained in the Cookie Policy.

If we change the way we process your data, we will update this text and its date. If you have any questions, write to us at hola@abalun.com.