Privacy policy

Controller and contact

Carlos Zamora is responsible for personal data processed by this portfolio, carloszamora.dev. For privacy questions or rights requests, email metawiser@gmail.com.

Data and purposes

The contact form collects your name, email, optional company, subject and message to respond to your enquiry. Bookings collect your name, email, chosen time and optional reason to verify your address, manage the meeting and send a Google Meet invitation. Please do not submit passwords or particularly sensitive information.

Hosting and security services process technical data such as IP addresses, requests, errors and response times to deliver the website and prevent abuse. The application uses identifiers derived from IP addresses or email addresses for rate limits; these identifiers are not treated as anonymous data.

Professional enquiries and meetings are handled to take steps you request before a possible contract where applicable; other enquiries and security rely on the legitimate interests of answering requests and protecting the service. Forms do not subscribe you to advertising or make automated decisions with legal effects.

Google Calendar and Google Meet

Only Carlos connects his Google account through OAuth. Visitors do not grant access to their calendars. The server queries Carlos’s busy/free intervals to calculate availability without exposing the titles or details of his other events.

A confirmed booking creates an event containing your name, email, optional reason and time, and requests a Meet link. The application may retrieve that event to resolve retries and delete it upon cancellation. Google sends invitations and updates to attendees. OAuth credentials are stored in Google Cloud Secret Manager and used server-side.

Information received from Google APIs is used only for these scheduling functions. It is not sold, used for advertising or used to train AI models. Its use complies with the Limited Use restrictions of the Google API Services User Data Policy and the Google Workspace user data policy.

Carlos may revoke authorization in his Google account connections. Visitors may cancel using their cancellation link or request deletion by email. Cancellation does not automatically erase all copies of messages or invitations.

Providers and recipients

Google Cloud hosts the application and booking records. Google Calendar and Meet handle events and meetings. Resend delivers messages and verification codes. Contact messages reach Carlos’s Gmail inbox. Cloudflare provides domain/DNS services and may process connection or security data on routes served by its services. If Turnstile anti-abuse verification is enabled, it is presented through the form’s verification control.

Providers receive the data required for their services; invitations are shared with meeting participants. Providers may process data outside the European Economic Area under their applicable terms and transfer mechanisms. Not all data is necessarily kept in the EU. See Google, Resend and Cloudflare.

Retention

Verification codes expire after 10 minutes. Unconfirmed request records are marked for deletion after one day; confirmed booking records, 30 days after the meeting. Firestore deletion is asynchronous and may occur later. Daily anti-abuse counters are marked for deletion after two days.

These periods do not erase email messages, Google Calendar events, participants’ copies or providers’ own logs. Messages and events are retained as needed to handle the conversation, maintain the professional relationship, or meet legal obligations and address claims. You may request review or deletion by email. Technical logs follow the relevant hosting service’s retention settings.

Cookies and local preferences

A session security cookie (csrf) protects forms. Your browser stores language, appearance, music, introductory-screen preferences and arcade records in local storage. You can clear them in browser settings. Music is served by this website. The external Google calendar loads only when you open that alternative and is subject to Google’s practices.

Your rights

You may request access, correction, deletion, restriction, objection and portability where applicable at metawiser@gmail.com. Where processing relies on consent, you may withdraw it without affecting earlier processing. Proportionate information may be requested to verify your identity. You may also complain to the Spanish Data Protection Agency.