Skip to content
Free audit Get a quote
iNTERVOLUTIONS
ES EN
Legal

Privacy policy

Last updated:

In short

  • We collect the data you submit through forms and, when enabled, website measurement data.
  • We use Google Analytics and OpenAI to measure visits and advertising conversions, without sending them form contents.
  • We measure with our own analytics, Google Analytics and OpenAI. In the EEA, UK and Switzerland we ask permission; elsewhere you can disable measurement in one click.
  • Everything we keep has an expiry date, and deletion is automatic.
  • You can ask us to show, correct or delete what is yours by sending one email. No forms, no paperwork.

Who handles your data

The controller is Tombatossals Softworks LLC, the company that owns intervolutions.com.

We operate from our Princeton office at 500 Elm Pl, Princeton, IL 61356, United States.

The company is incorporated in Illinois, United States. Part of the team works remotely, always with access limited to what is strictly needed and under a confidentiality commitment. We set this out below, under international transfers.

For anything concerning your data: [email protected]

What we collect, why, and on what legal basis

Six distinct processing activities, each with its own data, purpose and legal basis. There are no others.

When What data What for Legal basis How long
Contact form Name, email, service of interest, rough timing and your message. We automatically add your IP address, your browser, the date and where you came from (campaign or referring site). Reading your inquiry and replying. The IP and browser are used only to detect abuse of the form. Pre-contractual steps at your request (art. 6.1.b GDPR). For abuse control, our legitimate interest in not letting the form become a spam relay (art. 6.1.f). 24 months from our last contact
Quote request The same as the contact form, plus the project type, budget range and timeline you selected in the form. Preparing and sending you a proposal. Pre-contractual steps at your request (art. 6.1.b GDPR). 24 months from our last contact
Newsletter signup Your email address. Plus, as context, the page you signed up from, the language, the date and your IP address. Sending you the newsletter, at most once a month. Your consent (art. 6.1.a GDPR), which you can withdraw at any time. Until you unsubscribe
Job application Name, email, the role, your LinkedIn or portfolio if you provide them, your message and the résumé you attach (PDF, DOC or DOCX, up to 8 MB). Assessing your application for that role. Pre-contractual steps at your request (art. 6.1.b GDPR). 12 months from the date you apply
Browsing the site Pages viewed, how far you read, button clicks, form submissions, language, screen size, whether the device is mobile, and where you arrived from. Your IP is NOT stored: it is turned into an irreversible code with a random salt that differs every day. Understanding which content works and what breaks, so we can improve the site. Your consent (art. 6.1.a GDPR and art. 22.2 of the Spanish LSSI). We ask when you arrive, and nothing is stored or sent until you answer. You can change your mind at any time from the cookie policy. 14 months
Client area (if you are a client) Your account (name, company, email, phone, billing details and photo if you upload one), your projects, tasks, support messages and files, invoices and payments, quotes and signed documents (name, date and a fingerprint of the document), the calls you book, the logins you store in the vault (encrypted) and, if you use GiA, the conversation. When you sign in we keep the session and a sign-in log. Providing the service you hired: work tracking, support, invoicing and payment. GiA, the client area assistant, answers automatically from your account data; it does not make decisions about it. Performance of the contract (art. 6.1.b GDPR) and, for invoices and payments, our tax obligations (art. 6.1.c). Push and text alerts only if you turn them on (art. 6.1.a). For as long as we work together and then for the periods tax and commercial law require. GiA conversations are not stored on the server.

What we don't do

  • We do not sell or rent the contents of your forms.
  • We do not build profiles or make automated decisions that affect you. A person reads everything. The only AI is GiA, the client-area assistant: it answers only when you ask it, using a summary of your account, and decides nothing about you.
  • The OpenAI pixel allows a quote request to be attributed to ChatGPT ads when measurement is enabled.
  • We neither ask for nor want sensitive data (health, beliefs, ethnicity, union membership). If you send it in a free-text message, we delete it.
  • The site is not aimed at children under 13 (14 in Spain) and we do not knowingly collect their data.

How long we keep it

The periods above are not an intention: they are written into the code and enforce themselves. These deletions are automatic:

  • Analytics events are deleted after 14 months.
  • Messages that could not be delivered because of a mail failure (which may include a résumé) are deleted from the server after 30 days.
  • The technical mail-delivery log is deleted after 90 days.

The emails that reach us through the forms live in our mailbox and we prune it periodically according to the periods in the table. If you want yours deleted sooner, say so and we will.

If we end up working together, the documentation of that relationship is kept for its duration and afterwards for as long as tax and commercial obligations require.

Who else sees your data

The full list, without euphemisms:

  • Google (Google Workspace / Gmail). Our corporate email. Everything you send through a form arrives and is stored there, attached résumés included. It acts as a data processor.
  • Our hosting provider. Serves the site and stores the technical files described above. It does not access the content except for maintenance.
  • Google Analytics, OpenAI and Cloudflare. OpenAI receives visit and confirmed quote events through its pixel and server API, plus technical browser request data. With measurement permission, we send ad click and browser references to attribute the quote, without form contents. Its processing is described at https://openai.com/policies/privacy-policy/. Google Analytics receives the pages you view and the forms you submit (not their content) when measurement is on; Google acts as a data processor. Cloudflare serves the site and protects it from attacks, counts visits in aggregate without cookies, and on forms uses Turnstile to check that whoever submits is a person, without receiving what you write.
  • If you are a client: Stripe, PayPal, Mercury, Anthropic and Twilio. When you pay an invoice, Stripe (card, Apple Pay and Google Pay) or PayPal receive the amount, the invoice number and your name or company (Stripe also your email), and you enter your payment details directly on their page: we never see your card number. If you turn on automatic payment, Stripe stores the card. Mercury is our bank: if you pay by transfer, we see the sender name, amount and reference to match the payment to the invoice. If you use GiA, Anthropic receives your question and a summary of your account (projects, invoices, domains, tickets) to generate the answer, acting as a processor and without using it to train its models. If you turn on push alerts, your browser's notification service (Google, Mozilla or Apple) delivers an empty alert; your browser then fetches the content directly from our site. All act as processors, except Stripe and PayPal, which are also controllers of their own data as payment institutions.
  • Nobody else. We do not put your data into other platforms: no external CRM, no newsletter platform, no applicant tracking system. Fewer middlemen, less exposed surface.

In addition, we may have to disclose data to public authorities, courts or law enforcement where a legal rule requires it.

International transfers

Your data is processed in the United States: the company is incorporated in Illinois, United States and our corporate email is Google's. If you write to us from outside the United States, that is an international transfer.

Google LLC participates in the EU-U.S. Data Privacy Framework, the European Commission adequacy decision that permits those transfers, and its processing terms additionally incorporate the Standard Contractual Clauses.

If you are a client, Stripe, PayPal, Mercury and Anthropic (and Twilio, if you use text alerts) also process data in the United States, under the safeguards set out in their processing terms.

Our team works from the United States, Spain and Argentina. Within it, access is limited to the people who need the data to do their job (reply to your inquiry, prepare your proposal or assess your application), wherever they work from, and always under a confidentiality commitment.

Your rights

At any time, and free of charge, you can ask us for:

  • Access: to know what we hold about you and get a copy.
  • Rectification: to correct anything wrong or incomplete.
  • Erasure: to delete it, where it is no longer needed for what it was collected for.
  • Objection: to stop processing where we rely on legitimate interest, such as the anti-abuse checks on the forms.
  • Restriction: to keep it but stop using it while a disagreement is resolved.
  • Portability: to take what you gave us in a format you can reuse.
  • Withdrawing consent: where that is the basis, as with the newsletter or the site analytics. Withdrawing does not affect what was done before.

Just write to [email protected] saying what you want. No form is needed and you don't have to justify why. We reply within one month at the latest, and usually within two or three days. If we have a reasonable doubt about who is writing, we may ask for something that confirms it, only so we don't hand your data to someone else.

And if you think we've got it wrong and you live in the European Union, you can complain to your country's data protection authority; in Spain, that is the Spanish Data Protection Agency (www.aepd.es). If you're in the United States, you can also contact your state attorney general's consumer protection office. We'd appreciate hearing from you first, but you're under no obligation to do so.

U.S. residents

  • We don't collect biometric data, so the Illinois Biometric Information Privacy Act (BIPA) doesn't apply to anything on this site.
  • The rights above (access, correction, deletion) are available to you regardless of where you live, through the same email address.

How we protect it

  • The site is always served encrypted over HTTPS, and mail leaves over an encrypted connection with the certificate properly verified.
  • The directories where data is written sit outside what the web server serves and are blocked by configuration.
  • Résumés are not stored on the server: they are attached to the email and the temporary file disappears with the request. They only remain on disk if delivery fails, and in that case they delete themselves after 30 days.
  • We validate uploaded files by their actual content and not just their extension, and we rate-limit submissions to slow down automated attacks.
  • No system is infallible. If a breach ever occurs that poses a risk to you, we will tell you and notify the authority, as the law requires.

Calls, text messages and WhatsApp

If you call us or text or WhatsApp one of our numbers, we receive your number and the content of your message and use them only to help you. We do not record calls. Clients of the client portal can turn on text alerts about their account (invoices, payments, support, approvals); we keep the date and version of that consent. We do not send marketing text messages. Mobile information and text messaging opt-in data and consent will not be shared with third parties or affiliates for marketing or promotional purposes. Call and message logs are kept by our telecommunications provider, Twilio, acting as our processor. Reply STOP at any time to stop receiving text messages. Full details are in the SMS terms.

Cookies and measurement

We use Google Analytics, the OpenAI pixel and our own storage to measure visits and conversions when measurement is enabled. You can change your choice. Full details are in the cookie policy.

Changes to this policy

If what we do with your data changes, we update this page and the date above. If the change is significant and we have a way to reach you, we will tell you. We will not apply a substantially new purpose to data you already gave us without asking you first.

Contact

Any question about this policy, or about your data: [email protected].

See also: Legal notice · Cookie policy · Terms and conditions