Your information.Clearly explained.

1. Who is responsible.

Klonable SL, Spanish tax ID B05755202, at Calle Lepanto 270, 08013 Barcelona, Spain, is the controller for personal data processed through this website.

For privacy enquiries or to exercise your rights, email privacy@klonable.com.

2. What happens when you visit Klonable.

This policy covers Klonable’s public website, A pie de mostrador and optional analytics in the Business, Consumer and Operations applications. It does not govern actual shop operations data, which is covered by the information and agreements specific to those services.

We use PostHog to understand website usage only with your consent. We do not install advertising pixels or track you across websites. Contact requests work even if you reject analytics; they do not create an account or make purchases.

The demonstrations are interactive examples: they do not register customers, take payments or send real orders. Their changes stay in this tab’s memory. The email field in “I want my Klon” is separate from these demonstrations and sends a real contact request.

3. Technical data and enquiries.

When you open a page, our hosting processes technical connection information, which may include your IP address, date and time, requested resource, browser and request outcome. Request logs help keep the website available, diagnose errors and protect it from abuse; they are not used for advertising or commercial profiling.

The legal basis is our legitimate interest in providing and protecting this website (GDPR Article 6(1)(f)). You can object on grounds relating to your particular situation.

If you email us, we process your email address, your name if provided, your message and any attachments you choose to send, such as a voice note, to reply. Sharing more context is optional. The basis is our legitimate interest in answering enquiries; when you exercise data protection rights, we comply with a legal obligation (GDPR Article 6(1)(c)). Please share only the information needed for your enquiry.

4. If you would like to talk about your shop.

When you submit your email in “I want my Klon”, we process your address and selected language to respond to your request. We also record its date, source, privacy notice version, identifiers and the status of the request and its messages, to prevent duplicates and manage the response. We do not ask for your name, business name or website at this stage.

We handle your request based on our legitimate interest in replying to people who contact us and managing their interest in Klonable (Article 6(1)(f) GDPR). You can object on grounds relating to your particular situation. If you ask us to take steps before a contract to which you would be a party, the basis is Article 6(1)(b) GDPR. Leaving your email does not subscribe you to a newsletter or authorise advertising. Providing it is optional: we need it to reply by email, but you can continue exploring without submitting it.

“Request received” means our system has accepted your request; it does not guarantee that the confirmation email has already been delivered. That email is a response to your request, and you can reply with more about your shop if you wish. The conversation with our team takes place through hola@klonable.com.

5. Optional analytics and your preferences.

If you accept, we send page views and performance metrics to PostHog with a pseudonymous identifier, language, browser, operating system, device type, screen size and approximate location (country, region and city). Location is derived from the connection before PostHog discards the original IP address. We do not send your CTA email, form values, full URLs, fragments or parameters other than the five selected UTM tags. The legal basis is your consent (GDPR Article 6(1)(a)), which you can withdraw through the privacy icon without affecting the lawfulness of earlier processing. We also measure visit sources using campaign tags (UTM) and, if you request contact, that the request was accepted. This lets us analyse the sources and visits preceding a request without sending your email or linking them to an account.

PostHog processes this data in its European Union Cloud service. Analytics passes through our backend first to check current permission and reject unauthorized submissions. We do not automatically link the identifier to your email or an account. Session recording is not enabled in this version.

We remember your choice for 12 months. We retain a minimal record of consent changes for 3 years to demonstrate the choice and its withdrawal; it does not contain browsing content or your CTA email. Withdrawing permission stops new submissions, but does not automatically delete earlier data: you can request deletion at privacy@klonable.com.

6. Optional analytics in our applications.

In Business, Consumer and Operations you can choose analytics separately for each application and browser or installation. If you accept, we collect screen names from a defined list, language, device type, browser and operating system; web versions also collect performance metrics. We do not send shop, customer, support, form or message content, or private page addresses. Approximate location is derived before discarding the original IP, as on the website.

Where applicable, we check the session to apply permission and exclude test accounts. The receipt stores only whether the context is authenticated or anonymous, without identifying the account: it contains no name, email, person or shop identifier, or IP. We use a random analytics identifier and do not automatically link it to an account. Application session recording is not enabled. Your choice lasts 12 months and the minimal receipt 3 years; you can withdraw through each application’s preferences.

In Business and Operations, open Your account → Privacy to change your choice. Permission is independent of creating an account or using the service.

7. Who helps us deliver the service.

We use Google services: Firebase Hosting to distribute the website, Cloud Run to serve it and Cloud Logging for technical logs. Google Workspace handles contact email. These providers process the data needed to deliver their services under their data protection terms.

Contact requests are handled by Klonable’s backend on Google Cloud. Resend (Plus Five Five, Inc.) sends the team notification and confirmation message. Google Workspace handles subsequent correspondence.

Google and Resend services may involve processing outside the European Economic Area. Resend’s primary processing operations are in the United States. Where required, their terms provide transfer mechanisms such as adequacy decisions and the European Commission’s standard contractual clauses. See the applicable terms and information about subprocessors:

• Google Cloud data processing terms
• Google Workspace data processing terms
• Resend data processing terms

8. How long we keep data.

Operational Cloud Run request logs, used to run and secure the website, are retained in Cloud Logging for 30 days under the current hosting configuration.

Firebase Hosting retains IP addresses for a few months to detect abuse and analyse technical service usage, according to Google’s privacy information. This is hosting processing, separate from a commercial tracking tool on the website.

We keep the initial request in our register for a maximum of 24 months from receipt. We review its continued necessity annually and delete it earlier when appropriate. Correspondence or a subsequent relationship is managed separately, for as long as needed to handle it and meet applicable obligations; expiry of the request record does not automatically delete emails from those conversations.

We retain email enquiries as needed to resolve them and manage follow-up. Afterwards, we retain them only for periods required by law or needed to address liabilities arising from the enquiry; access is then restricted to that purpose.

Under our current plan, Resend retains emails and logs for 30 days, and backups for 7 days. Early deletion is handled manually through its support team. These periods are separate from our initial request record and correspondence in Google Workspace.

9. Your rights and how to exercise them.

You can request access, rectification, erasure, restriction, objection and, where applicable, portability of your data. We do not make decisions with legal or similarly significant effects based solely on automated processing. You can withdraw analytics consent at any time.

Email privacy@klonable.com or write to the controller’s postal address, explaining which right you wish to exercise. We will only ask for further identity information if needed to handle your request securely. We respond within one month; if the complexity or number of requests requires an extension of up to two further months, we will let you know within the first month.

You can also lodge a complaint with the Spanish Data Protection Agency, particularly if you believe we have not adequately addressed your rights.

10. Looking after information.

The website uses HTTPS connections, and access to administration services and email is restricted to authorised people. We review these measures as the service evolves.

Photos, video and fonts are served from our own website. If you follow an external link, the destination website’s policy will apply.