Privacy Policy

Introduction

This Privacy Policy explains how opa.so ("we", "us", or "our") collects, uses, discloses, and protects your personal data when you visit https://opa.so/. We comply with the EU GDPR, the Spanish AEPD (“Agencia Española de Protección de Datos”), and applicable data-protection regulations.

Information We Collect

1. Data You Provide Voluntarily

When you submit the Contact form, we collect:

  • Your email address
  • Your message content
  • Any additional information you voluntarily include

The form is processed by Formspree, our third-party data processor.

2. Security & Anti-abuse Data (Cloudflare Turnstile)

To protect the website from bots and malicious traffic, Cloudflare Turnstile processes:

  • IP address
  • Browser characteristics
  • Interaction data required to verify that you are human

Cloudflare acts as an independent controller for this processing.

3. Hosting, Logs & Traffic Data (Vercel)

Because the site is deployed on Vercel, standard hosting logs and edge analytics are automatically collected. These may include:

  • IP address
  • Timestamp of the request
  • URL paths visited
  • Device, operating system, and browser type
  • Referrer information
  • Basic performance and routing metrics (Edge Network telemetry)

Vercel uses this data for:

  • Security
  • Abuse prevention
  • Performance monitoring
  • Error diagnostics

Vercel acts as an independent controller.
Learn more: https://vercel.com/legal/privacy-policy

4. No Tracking or Advertising Cookies

We do not use analytics tools that track identifiable behavior, nor do we use advertising cookies.

How We Use Your Information

  • Contact form data is used only to respond to your inquiries.
  • Cloudflare and Vercel data is used for security, abuse prevention, and website performance.
  • We do not sell or share your data for marketing or advertising purposes.

Lawful Basis for Processing (GDPR)

We rely on:

  • Legitimate Interest: Responding to inquiries and ensuring website security and stability.
  • Consent: Provided explicitly when you submit the contact form. You may withdraw your consent at any time.

Third-Party Data Processors

  • Formspree — processes contact form submissions securely.
    https://formspree.io/security/
  • Cloudflare — processes security and anti-abuse data as an independent controller.
    https://www.cloudflare.com/privacypolicy/
  • Vercel — processes hosting logs and edge analytics as an independent controller.
    https://vercel.com/legal/privacy-policy

Data Transfers

Formspree and Vercel may process data in the United States or other jurisdictions.
Transfers are protected using Standard Contractual Clauses (SCCs) and other GDPR-compliant safeguards.

Data Retention

  • Contact form submissions are retained only as long as needed to respond to you.
  • Hosting logs (Vercel) and anti-abuse data (Cloudflare) follow each provider’s retention policies.
  • We do not maintain local or persistent databases of visitor information.

Your Rights

You may request to:

  • Access your personal data
  • Correct inaccurate data
  • Delete your data
  • Object to processing
  • Withdraw consent
  • Request portability of data you provided

To exercise your rights, email: contact@opa.so

You may also file a complaint with the AEPD:
https://www.aepd.es/

Contact

For privacy matters, contact us at:
contact@opa.so

Last updated: November 26, 2025