DRAFT — text under review, not yet legally validated. The Spanish version (/privacidad) is the binding one; before opening No Phone No Panic to the public, the owner's tax ID, the data processing agreements (DPA) with each provider listed below, and a professional legal review must be confirmed.
Privacy policy
Last updated: 2026-10-21
1. Data controller
Manuel Zafra — contact: [email protected]. For any privacy matter or to exercise your rights, this is the channel.
2. The free test never sends data to any server
The 20 test questions are answered and scored entirely in your browser (local JavaScript). No Phone No Panic does not receive, store or see your answers, your No Phone No Panic Score, or any of the detected vulnerabilities, unless you explicitly choose to share them (for example, with the "Share my score" button).
3. What data is processed, for what purpose and under what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Taking the free test | None (100% calculated in the browser) | No personal data processing |
| Sending feedback/suggestions about the site (floating button) | Comment, URL and page element being commented on; email only if the person is logged into the internal panel | Legitimate interest (product improvement) |
| Measuring site usage and test conversion (GA4, Google Ads, Meta Pixel/CAPI) — only if you accept the cookie banner | Cookie/device identifiers, pages viewed, test completion (without the answers or the result) | Consent (cookie banner, see cookies) |
| Buying the No Phone No Panic Workshop (€9.90) | Name, email and payment data, collected directly by Stripe — No Phone No Panic never sees or stores the card number | Performance of a contract |
| Sending the purchase confirmation/receipt email | Email, order summary | Performance of a contract |
| Invoicing | Tax data required to issue an invoice | Legal obligation (tax/commercial regulation) |
The last three rows apply once payment checkout is active; there are no real purchases today.
4. Data processors (providers with access to data)
| Provider | What for | Location | International transfer |
|---|---|---|---|
| Cloudflare, Inc. | Hosting (Pages); Cloudflare Access protects only the internal panel (/admin), not the public site | USA / EU | Standard Contractual Clauses (SCC) |
| Resend | Sending transactional and internal notification emails | USA / EU | SCC |
| GitHub, Inc. (Microsoft) | Internal product feedback issue tracking | USA | SCC |
| Slack Technologies (Salesforce) | Internal team feedback notifications | USA | SCC |
| In-house infrastructure (orchestrator / Engram) | Internal product feedback logging | Germany (EU) | Not applicable — no transfer out of the EU |
| Google Ireland Limited (GA4 + Google Ads) | Site analytics and advertising conversion measurement — only if you accept the cookie banner | Ireland (EU) / USA | SCC |
| Meta Platforms Ireland Limited (Meta Pixel + Conversions API) | Advertising conversion measurement — only if you accept the cookie banner | Ireland (EU) / USA | SCC |
| Stripe (once payment is active) | Workshop payment processing | Ireland (EU) / USA | SCC |
5. Retention period
Feedback data from the private demo phase is kept for as long as that phase lasts. Purchase data is kept for the legal retention period for commercial and tax documentation in Spain (up to 6 years).
6. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to [email protected]. You can also file a complaint with the Spanish Data Protection Agency (aepd.es).
7. Cookies
See the cookie policy for the detail of which cookies this site uses.