Privacy policy

1. Controller

2. Scope of this policy

This policy covers exclusively what economiq.io does today: a static site (HTML/CSS/JavaScript) with a minimal PHP backend for registering interested people (the “waitlist”) and managing unsubscribes, hosted on OVHcloud, with contact management through Brevo and the mailbox hello@economiq.io also on OVHcloud. The waitlist is not a product phase and is not a beta: it is a current website feature during the pre-launch preparation of Economiq. Economiq is a technology project currently developed from Spain, with its first availability planned for Spain. The website and waitlist are accessible internationally and do not apply geoblocking; joining from another country does not mean the product is already available there. When the Economiq application incorporates new processing (accounts, bank connection, payments, and so on), this policy will be updated — or replaced by a specific one — before that processing starts.

3. What data we process and where it comes from

Inventory of data processed by economiq.io

Data	Source	Required?
Email address	You enter it in the waitlist form or the unsubscribe form	Yes, to register or to process an unsubscribe
Waitlist consent (form checkbox and later email confirmation)	You give it by accepting the checkbox and confirming the one-time link. Waitlist consent is reflected when the contact moves to the accepted waitlist. Attributes named ECONOMIQ_MARKETING_CONSENT or ECONOMIQ_WAITLIST_CONSENT are not written in Brevo.	Yes, to complete waitlist registration
Promotions status (pending request or accepted/revoked consent)	Generated by PHP when promotions are requested, confirmed or revoked. Promotional consent exists only after confirmation (attributes economiq_promotions_consent and economiq_promotions_consent_at). A pending request is not consent.	Only if you request or manage promotions
Interface language (economiq_language)	Taken from the language of the page or form you use (UI locale: Spanish or English). It is not inferred from IP address or country.	Technical; generated from the interface, not from a separate field
Coarse country code (economiq_country), if detected	Generated server-side when a two-letter country code can be detected from trusted hosting infrastructure. The IP address is used only transiently for that lookup and is not stored as country evidence. Client-supplied country values and spoofable HTTP headers are ignored. This is not precise location and is not used to block access.	Technical, if a code can be detected; not collected from a form
IP address (for anti-abuse), as a fingerprint (SHA-256 hash) used only to count attempts	Your connection, captured temporarily by the PHP script (request limit)	Technical, not configurable by you; discarded over time (see §9)
User-Agent, Referer, Origin, method and request path	HTTP headers sent automatically by your browser	Technical; used to validate the origin of the request (CORS) and, if OVHcloud enables it, in server logs
Brevo contact identifier, list membership, subscription/blacklist status	Generated and managed by Brevo after registration	Necessary for Brevo to send you emails and for you to unsubscribe
Measurement of email opens and clicks (distinct from website tracking)	Economiq uses Brevo as the email service provider for transactional emails, including the waitlist confirmation. Brevo processes the technical and operational information needed to send and deliver those emails (for example, that a message was sent or delivered). Transactional email tracking is configured with Brevo’s anonymous email-tracking mechanism. That does not mean that all information associated with the email is anonymous: Brevo’s contact history may show engagement information such as whether the email was opened, whether it was clicked, and how many times it was opened. Brevo transactional logs are retained for 1 month; that period is independent of Economiq’s pending-contact retention and deletion process. The Brevo Tracker (website activity tracking) is a different product: economiq.io does not implement Brevo Tracker, Google Analytics, Meta Pixel or similar website tracking code. Campaign email tracking is a separate setting. UTM tracking is disabled. That measurement happens in email and in Brevo’s infrastructure; it is not a website cookie and is not website analytics.	Email-account configuration; not collected from the form
Hosting visit-statistics data (IP, URL, duration; anonymised/aggregated by OVHcloud)	Generated by OVHcloud infrastructure when serving the pages	Depends on hosting, not on a form; see §11
Domain-ownership data (name, contact, country, etc.)	Those recorded in the domain-registration contract with OVHcloud as registrar agent	Required by the relevant Registry to keep the domain active
Messages sent to hello@economiq.io	You write them when you contact us	Voluntary

economiq.io’s code does not set first-party HTTP cookies. During the checked public navigation, no Set-Cookie response header and no Economiq first-party cookies were observed. The site may store a language preference (es or en) in the browser’s localStorage when you choose ES or EN, or when a default language is applied on a first visit. That is not a cookie, it is not sent automatically to the server, and it is not used for website analytics or advertising. Transactional email open/click measurement by Brevo is not website visitor tracking. Anonymous transactional email tracking does not mean that all information associated with the email is anonymous. See the detail in the cookie policy.

4. Purposes and legal bases

The form separates two decisions. The waitlist checkbox is required to start any registration, but it is never pre-ticked. The promotions checkbox is optional and independent.

1. Waitlist: enrolment, confirmation, and communications about Economiq’s launch, availability, user testing, early access or news, depending on the territory, and, where applicable, priority for future testing. The website is accessible internationally; the product is designed initially for Spain. Joining the waitlist does not mean Economiq is already available in your country.
2. Promotions: promotional communications from Economiq (for example discounts, gifts, prize draws or similar campaigns where they exist), only if the optional checkbox is ticked and that choice is later confirmed expressly. Declining or revoking promotions does not remove you from the waitlist. The general promotions subscription is not limited to Spain: each future campaign may have its own eligibility conditions, including geographic ones, which will be communicated with that campaign. Promotional communications and offers may vary depending on the country, region, campaign or other eligibility conditions applicable to each promotion.

The legal basis of each purpose is explicit consent (Art. 6(1)(a) GDPR), obtained separately. Ticking the optional promotions checkbox starts the process, but promotional consent exists only after the later express confirmation. Declining promotions does not prevent you from joining the waitlist. You can withdraw each consent without affecting the lawfulness of processing already carried out.

Providing your email address is necessary to join the waitlist or to process an unsubscribe. If you do not provide it, we cannot register you or send those communications. Promotions are optional: you are not obliged to request them in order to join the waitlist.

Promotions subscription is not limited to Spain as a general rule. Individual campaigns may have geographic eligibility conditions, which will be communicated with each campaign. Campaign eligibility is not promotional consent: a country code or a campaign condition does not replace the express POST confirmation of promotions.

economiq_country, when present, is used to analyse waitlist interest by territory and, later, to apply campaign eligibility where a campaign has geographic conditions. It is not a consent signal and it is not used to geoblock the website. economiq_language records the interface language you used, so communications can match that language; it is not derived from IP.

No automated decisions with legal effects are taken, and no profiles are built from the data of this website.

Other processing on this website rests on different legal bases:

• Security and abuse prevention (request limit, hidden anti-spam field, blocking unauthorised-origin requests): legitimate interest (Art. 6(1)(f) GDPR) in keeping the service available and free of abuse.
• Hosting, technical logs and OVHcloud statistics: legitimate interest in operating and maintaining the website securely, on the terms OVHcloud offers as part of the contracted hosting service.
• Registration and management of the economiq.io domain: contractual necessity with the relevant Registry and, where applicable, a legal obligation arising from domain-registration rules.
• hello@economiq.io email: legitimate interest in being able to reply to your queries, and performance of pre-contractual measures or management of the relationship itself when you write by that means.

5. Email confirmation (double opt-in)

There are two distinct confirmation outcomes. Waitlist consent and promotional consent are not treated as a single purpose.

A) Waitlist only. If you do not request promotions, PHP adds the contact to the pending waitlist (list 5) and sends a Brevo transactional email with a one-time link valid for 72 hours. Confirmation is performed by api/confirm-waitlist.php: visiting the link (GET) does not change the status; an express confirmation (POST) is required. PHP then moves the contact from the pending list (list 5) to the accepted waitlist (list 4). The static /confirmed.html page does not confirm anything. The language of that confirmation is the language of the original request, not the geolocation at click time. This confirmation is of the waitlist registration: it does not grant promotional consent.

B) Waitlist and promotions (joint DOI). If you request promotions and your email is not yet confirmed, PHP adds the contact to the temporary promotions list (list 9) and sends a single transactional email with two buttons: one to confirm the waitlist only, and another to accept promotional communications as well. The second button is a separate affirmative action: it adds the person to promotional communications. The resulting accepted state is the accepted waitlist (list 4) and accepted promotions (list 8). Each button uses a link with its own token. Visiting the link (GET) does not change the status: an express confirmation (POST) is required. The “waitlist only” option confirms the waitlist (list 4) and leaves promotions in an explicit declined state; it does not activate promotional consent and does not remove the waitlist. Joining the waitlist does not by itself grant promotional consent.

If you are already confirmed on the waitlist and request promotions later, we will send you an email to confirm promotions only. That later acceptance is a distinct event from the original waitlist consent: it is not merged into a single consent. The promotional consent date (economiq_promotions_consent_at, UTC calendar YYYY-MM-DD on entry to list 8) does not replace waitlist consent. Requesting that email leaves promotions in a pending state: it is not consent. If you do not confirm within 7 days, the pending request expires in the application: there is no promotional consent and the address is not added to the confirmed promotions list (list 8). If you were already on the confirmed waitlist, that membership is not touched. If you had not yet confirmed the waitlist (the contact was only on the temporary promotions list, list 9), expiry of that request does not create a confirmed waitlist: the joint process ends without promotional consent. That 7-day period is the application TTL of the pending promotions-request token; it is not the retention policy for an unconfirmed pending DOI contact. Retention of a pending contact (waitlist-only on list 5, or joint process not yet confirmed on list 9) is governed by economiq_pending_at and §9: eligibility after 72 hours, first planned check around 73 hours, and an absolute maximum of 240 hours. This is not instantaneous deletion at 72 hours. The former 7-day panel automation on list 9 is not the current retention policy.

Promotions states used in the application are: requested / pending, confirmed, declined, revoked and expired. Only confirmed (after POST) is promotional consent.

5 bis. International access, country and language

economiq.io is accessible internationally and does not apply geoblocking. Economiq is a technology project currently developed from Spain, with its first availability planned for Spain. You may join the waitlist from another country; that does not mean the product is already available there, or that there is a worldwide launch. Waitlist communications may concern launch, availability, testing, early access or product news depending on the territory.

There is no country selector. Where it is proportionate, the server may derive a coarse country code (economiq_country) from the hosting’s own geolocation information or from a local table, using the IP address only transiently. That code is a coarse technical connection-origin estimate, not domicile, nationality or tax residence. It is not used to block registration or to refuse the general promotions subscription. Country values sent by the browser are not trusted. VPNs, proxies, corporate networks and mobile networks may produce an incorrect country. The website does not detect or block VPNs. A mismatch between a real location and the detected country is not treated as a legal violation by this website. If detection is not reasonably reliable, no country is stored (UNKNOWN internally). Country is not required to join the waitlist and is not treated as verified residence.

The public interface exists in Spanish (/) and English (/en/). Language and country are separate. An explicit language choice (ES or EN) is respected and is not overwritten by GeoIP. English pages under /en/ stay English unless you have chosen Spanish expressly. If there is no explicit choice, the site uses the URL, then the browser Accept-Language header, and only then, on a first visit, the approximate country as a last fallback: Spanish for a documented list of Spanish-speaking countries (including Equatorial Guinea GQ and Puerto Rico PR), English for other known countries. If language or country cannot be determined, the visitor-language fallback is English (/en/). Spanish URLs (/) are not converted into English: they stay Spanish if you are already on that tree. That first automatic resolution is stored as an implicit localStorage preference and is not recalculated from the IP on every visit. The contact attribute (economiq_language: es or en) is taken from the version of the site you use when you submit a form, not from the IP or from a country selector. 404 error pages follow the URL tree (/… in Spanish, /en/… in English) and not GeoIP.

Contact country, promotional consent and the eligibility of a specific campaign are different concepts. Promotional subscription is global, while individual campaigns may have their own regional or legal eligibility requirements. A person may have confirmed promotions and still not be eligible for a campaign limited to certain countries. Conversely, a broader campaign may include them. Those conditions will be communicated with each campaign; this policy does not state that every promotion is Spain-only, nor that every promotion is worldwide. GeoIP does not prove residence. If a campaign (for example a giveaway or a legally restricted promotion) requires residence or other conditions, that campaign’s own terms control participation, not the technical country estimate.

6. Recipients and processors

Providers that process data on behalf of economiq.io

Provider	Role	Data received
Brevo (Sendinblue SAS)	Waitlist and promotions management, lists, automations, transactional/promotional emails and email activity	Email address, request/consent/revocation attributes, coarse country code if detected, interface language, list membership, operational send/delivery information and, in the contact history, email engagement information (opens, clicks and open counts) when Brevo displays it
OVHcloud	Web hosting, PHP execution, technical backups, server logs, visit statistics, mailbox (Zimbra), domain registration	All traffic served by the website, emails sent/received at hello@economiq.io, domain-ownership data

Both act as processors in respect of the data economiq.io entrusts to them, within the terms of their respective contracts. OVHcloud’s Data Protection Agreement covers hosting, email and domain. Brevo’s DPA forms part of its contractual terms and applies, where applicable, the GDPR Article 28 processor framework: processor obligations, security, subprocessors and international transfers under that contract. Economiq remains responsible for its own controller obligations. This policy does not claim that every subprocessor listed in Brevo’s generic DPA is used for Economiq’s exact processing, and it does not describe a Brevo hosting region or data-residency selector that this account does not expose.

7. OVHcloud subprocessors

According to the document “Subprocessors of data processing” of OVH Hispano S.L. (version of 16 October 2025), which complements the Data Protection Agreement / personal-data processing contract, OVHcloud uses two types of subprocessors:

• OVHcloud group affiliates, for all Services, regardless of their location: OVH GmbH (Germany), OVH Hispano (Spain), OVH SAS (France), OVH SRL (Italy), OVH Hosting Limited (Ireland), OVH Sp. z o.o. (Poland), OVH Hosting Sistemas Informáticos Unipessoal (Portugal), OVH BV (Netherlands), OVH Hébergement Inc. (Canada, except SecNumCloud and Trusted Cloud services) and OVH Limited (United Kingdom).
• Additionally, OVH Australia Pty Ltd (Australia), OVH Tech R&S Private Limited (India) and OVH Singapore Pte Ltd (Singapore) intervene only for services provided from Asia-Pacific data centres or where the particular conditions of the affected service expressly so provide. The OVH datacentre identifier declared for this hosting is eu-west-gra (Gravelines, France). That does not describe a more precise physical location than those identifiers allow. It does not indicate an Asia-Pacific data centre.
• A third group of affiliates (for example DCD Data Center Deutschland GmbH, OVHcloud Austria GmbH, and equivalents in Belgium, Bulgaria, Denmark, Finland, Italy, Ireland, Luxembourg, Norway, the Netherlands, Poland, the Czech Republic, Romania, the United Kingdom, Switzerland, Sweden, Australia, Canada and Morocco) only intervene for maintenance of the specific data centre where the infrastructure of the contracted service is located. The datacentre identifier for this hosting is eu-west-gra. This policy does not name a specific maintenance entity beyond what that identifier allows.
• Third-party subprocessors (outside the OVHcloud group): the document itself refers to the particular conditions of each affected service instead of listing them in a general catalogue. The reviewed Web Hosting particular conditions for this project do not identify a specific third-party subprocessor outside the group. That is not a statement that OVHcloud has no subprocessors: OVH Group affiliates may participate according to the subprocessors document and the DPA. The Zimbra particular conditions name Synacor as software publisher; it is not established in that text that Synacor processes mailbox content as a subprocessor.

This is the version in force at the date of publication of this policy; if OVHcloud publishes a later version of the subprocessors document, that version prevails over this summary. Datacentre countries are not invented here.

8. International transfers

The subprocessor list above confirms that, for all OVHcloud Services regardless of their location, affiliates situated outside the European Economic Area may intervene — specifically OVH Hébergement Inc. (Canada) and OVH Limited (United Kingdom), both countries without a full adequacy decision of the European Commission for this type of transfer. OVHcloud’s own Data Protection Agreement incorporates as an annex the EU Standard Contractual Clauses (Module 3, processor-to-processor transfers), adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as the applicable safeguard whenever OVH SAS or its European affiliates transfer processing to an importer in a country without an adequacy decision. The identifier for this hosting is eu-west-gra (Gravelines, France). This policy does not invent which specific maintenance affiliates intervene beyond those OVH declares applicable to all Services and beyond what that identifier allows.

Regarding Brevo, the contractual DPA covers, where applicable, adequacy decisions, Standard Contractual Clauses, supplementary measures and the EU-US Data Privacy Framework. This policy does not assert that those safeguards have been verified as a panel configuration of this account, nor does it list every possible Brevo subprocessor as if Economiq used them. Economiq uses Brevo for contacts, lists and email as described in §6; it does not use website tracker, embedded forms, SMS, WhatsApp or analytics connectors on this website. The anonymous transactional email tracking described in §3 is not a website tracker and does not mean that all information associated with the email is anonymous. The account does not expose a data-residency selector or hosting region that this policy can cite.

9. Retention periods

Retention periods by processing

Data / processing	Period and criterion
Contact in Economiq Waitlist - Pending or joint DOI pending, unconfirmed	The clock is economiq_pending_at (TEXT, ISO-8601 UTC), written server-side only after a successful confirmation email send, and cleared after a valid confirmation. After 72 hours (3 days) the contact becomes eligible; that threshold is not instantaneous deletion. The first planned check is approximately at 73 hours. Later checks occur at 96 h, 120 h, 144 h, 168 h, 192 h, 216 h, 239 h and 240 h. The 239 h check is the last check before the hard deadline. The absolute maximum retention of a pending contact is 240 hours (10 days) from that stamp. A valid unused confirmation link may delay deletion before that deadline, but not beyond 240 hours. Confirmed waitlist contacts and accepted promotions contacts are not deleted by this process. If economiq_pending_at is missing or is not a valid date, no age is calculated: that contact is not deleted by ordinary retention. There is no Cron on this hosting plan: the email provider triggers the checks and PHP decides deletion. This process is independent of Brevo’s 1-month transactional-log retention.
Brevo transactional email logs	Configured to be deleted automatically after 1 month. After that period, Brevo deletes those transactional log records according to the account setting. This period is independent of Economiq’s pending-contact retention and deletion process (eligible after 72 hours; absolute maximum 240 hours).
Confirmed waitlist contact	While they remain on the waitlist. Leaving starts the operational retention indicated below.
Promotions-only unsubscribe	Immediate after POST confirmation: economiq_promotions_consent is revoked, economiq_promotions_revoked_at is recorded and the contact is removed from the promotions lists. The contact and the waitlist are kept. The date of last effective consent (economiq_promotions_consent_at) is not erased on that unsubscribe.
Waitlist unsubscribe	Also revokes promotions and stops placing the contact on the waitlist and promotions lists. PHP then starts deletion in Brevo: the first attempt is immediate and, if needed, it is retried. The maximum period to complete that operational deletion is 30 days. If the contact re-enters any of those lists, deletion is cancelled. Erasure requests are handled under their own requirements and are not automatically postponed by this period.
Consent evidence (date, policy version, purpose, origin)	Kept with the contact in Brevo while the contact exists, as proof that consent was given; not reused for another purpose
IP fingerprint for request limiting (anti-abuse)	Current 10-minute window on the server; temporary files are not intended to be kept beyond that
Confirmation tokens	Waitlist confirmation links expire after 72 hours. Waitlist-unsubscribe or promotions-unsubscribe tokens requested from the website expire in 1 hour. Pending promotions-request tokens expire in 7 days. The link is sent by email. It is invalidated when used, expired, when promotions are revoked, when leaving the waitlist or when replaced. The raw token is not stored.
Local promotions evidence	Server log (JSON files) of the action (request, confirmation, decline, revocation, expiry), the email, the purpose, the date, the text version and a hashed token reference (not the raw token). IP and User-Agent are not collected as proof of consent. This log is independent of Brevo. If the contact is deleted in Brevo, PHP anonymises the clear-text email in those files and keeps the hash. There is no separate audit database.
Operational retention records (Brevo contact deletion)	Until the contact has been deleted or deletion is cancelled by re-entry. The file includes the email in clear text until deletion. After a successful deletion a summary remains with an email hash, without the email in clear text.
OVHcloud server logs	According to the owner-stated operational observation from the OVH panel (not a numeric period found in OVH’s public product technical guides), access logs and error logs are retained for approximately 12 months and are purged automatically. Economiq does not control that period. Official OVH guides list log types (Web, Error, FTP, CGI, out, SSH, CRON) and monthly/day archives, but do not state how many months customer-visible raw archives are kept. The French décret cited in some hosting particular conditions (the client’s duty to retain certain identification data for 12 months) is not presented here as the product archive duration. “Daily Logs only” describes daily processing/organisation, not a one-day retention period. Logs can be downloaded from the OVH logging interface. In the standard hosting environment, raw archived logs cannot be deleted manually by the user. OVHcloud Web Statistics is the visit-report product (anonymised/aggregated according to the technical specifications). The panel may also show AWStats; it is not established from the reviewed documentation that they are the same store. Whether OVH’s internal access/error logs are included in Web Hosting technical backups of customer storage space (D-1…D-14) is not established by the reviewed documentation.
OVHcloud visit-statistics reports	Available for consultation for up to 40 months under OVHcloud’s web-hosting conditions (this is a period of availability of the aggregated report, not direct retention by Economiq of each visitor’s IP)
OVHcloud technical backups (hosting)	Hosting is OVHcloud Shared Web Hosting in Gravelines, France. According to OVHcloud technical documentation for this hosting type, non-contractual automatic backups of the customer storage space exist at D-1, D-2, D-3, D-7 and D-14, also stored in Roubaix, France. That description covers files in the customer storage space; it does not describe OVH’s internal access/error logs. It does not replace the owner’s own backup or restoration responsibility. Economiq does not control that cycle. If token/evidence directories sit on that same FTP space, those snapshots may reintroduce application files; whether the preferred directory above www/ is included is not verifiable from the repository.
Email in the hello@economiq.io mailbox	Until it is deleted manually; OVHcloud does not back up this email by default (it is the responsibility of whoever manages the mailbox)
Outgoing messages blocked by OVHcloud’s antispam/antimalware filter	Up to 12 months, under OVHcloud’s email (Zimbra) service conditions
Domain-ownership data	While the domain is registered in the owner’s name; subject to the relevant Registry’s rules after cancellation or transfer
Rights requests managed via hello@economiq.io	The email thread is kept for as long as needed to handle the request. If the owner records the request in an internal compliance register, personal data in that register is retained for one year from receipt and then anonymised, unless the request is still open. Full copies of the data subject’s original data are not kept in that register.

10. Cookies and tracking technologies

economiq.io’s code does not set first-party HTTP cookies. During the checked public navigation, no Set-Cookie response header and no Economiq first-party cookies were observed. The language switcher uses URLs (/ and /en/). If the browser allows it, the site may store a language preference in localStorage (economiq_language) and, when you choose ES or EN expressly, an associated flag (economiq_language_explicit). That is not an HTTP cookie, it is not sent with every request, and it is not used for analytics or advertising. Economiq does not implement analytics or advertising cookies. The full audit of cookies, external scripts and provider technologies (Brevo, OVHcloud) is in the cookie policy. Economiq uses Brevo as the email service provider for transactional emails, including the waitlist confirmation. Brevo processes the technical and operational information needed to send and deliver those emails. Transactional email tracking is configured with Brevo’s anonymous email-tracking mechanism. That does not mean that all information associated with the email is anonymous: Brevo’s contact history may show engagement information such as whether the email was opened, whether it was clicked, and how many times it was opened. Brevo transactional logs are retained for 1 month; that period is independent of Economiq’s pending-contact retention and deletion process. Measurement of email opens or clicks by Brevo is an account setting distinct from the Brevo Tracker (website activity tracking). economiq.io does not implement Brevo Tracker, Google Analytics, Meta Pixel or similar website tracking code. Campaign email tracking is a separate setting. UTM tracking is disabled. That measurement happens in email, not as a website cookie or website analytics.

11. Visit statistics (OVHcloud)

OVHcloud web hosting includes, as part of the contracted service, visit statistics. OVHcloud’s technical specifications describe OVHcloud Web Statistics (enabled by default; disable via support) from traffic data that is then anonymised and aggregated (IP, logs, URL, duration, user-agent). The panel may also show AWStats; it is not established that this is the same store as Web Statistics or that it creates its own retention period. Under some OVH hosting particular conditions, aggregated reports may remain available for up to 40 months; that is not Economiq keeping each visitor’s IP for 40 months. Economiq does not control raw access/error log retention: the owner-stated panel observation is approximately 12 months with automatic purge; public product technical documentation does not state that number. Whether those internal logs are included in Web Hosting technical backups of customer storage is not established by the reviewed documentation.

12. The economiq.io domain

The domain economiq.io is registered through OVHcloud, which acts as registrar agent vis-à-vis the relevant Registry. This involves communicating and keeping up to date the domain owner’s contact data. WHOIS/RDDS public-data protection is enabled for this domain, so the owner’s personal data are not published in the public directory to the extent the Registry allows. TLS/SSL is active for economiq.io and www.economiq.io.

13. The hello@economiq.io mailbox

Email to hello@economiq.io is managed with OVHcloud’s email service (Zimbra). OVHcloud automatically analyses incoming and outgoing messages to detect spam and malware; outgoing messages blocked by that filter are kept for up to 12 months, and incoming email identified as spam is directed to a junk folder. OVHcloud may temporarily block the service if it detects mass or abusive sending. OVHcloud does not provide a customer mailbox-content restore backup as a default mailbox backup service: keeping and backing up mailbox content is the responsibility of whoever manages that account, unless a distinct product or contractual guarantee is verified. Web Hosting technical backups of storage space are not to be read as an independent mailbox backup. Reviewed Zimbra particular conditions: outbound messages detected as malware, one (1) year; outbound detected as spam, twelve (12) months; after service end, contents immediately inaccessible and kept 15 days (not a restore guarantee).

14. Google Search Console

The owner uses Google Search Console for this property. The repository includes the HTML verification file google10a40792f88eb6f1.html at the site root (HTML-file verification method). economiq.io does not embed any Google Search Console script in the visible pages, nor does it set Search Console cookies from this site’s code. Search Console is a tool for the owner to consult indexing; it is not part of navigation for people using economiq.io.

15. Security

The Brevo API key is stored exclusively on the server, outside any public file, HTML or JavaScript accessible from the browser. Requests to the waitlist form are validated on the server (email format, explicit consent), the number of attempts per origin address is limited, submission is silently discarded if a filled hidden anti-spam field is detected, and only requests coming from https://economiq.io or https://www.economiq.io are accepted. Confirmation links use random identifiers; only their hash is stored as a filename. Waitlist confirmation links expire after 72 hours. Those requested from the website for an unsubscribe expire in one hour. Those for pending promotions confirmation expire in 7 days. The website is served exclusively over HTTPS.

16. Your rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and, where applicable, portability, as well as withdraw your consent, by writing to hello@economiq.io. No automated individual decisions with legal effects are taken from the data of this website. In addition:

• You can leave the waitlist at any time from the link in the email you receive, or from this unsubscribe page. Both paths use the same one-time confirmation mechanism.
• You can revoke or activate promotions only from the promotions management page without leaving the waitlist. You will receive a confirmation email with a one-time link. Pending activation confirmation expires in 7 days; an unsubscribe requested from the website expires in one hour. Promotional revocation does not delete the contact. No individual unsubscribe URL is stored as a Brevo contact attribute.
• Leaving the waitlist also revokes promotions and stops placing the contact on the waitlist and promotions lists. PHP then attempts to delete the contact; the maximum to complete that operational deletion is 30 days. If you also request erasure as a right, say so expressly by email; that request is handled under its own requirements and is not automatically postponed by the operational period.
• We will respond to your request within one month of receipt, with the possibility of an extension of up to two further months where complexity or the number of requests justifies it, under the GDPR and, where it applies, other applicable data protection law. The channel is hello@economiq.io. To verify identity reasonably, a reply is requested from the same email account to which the data relate, or equivalent proof if that route is not enough. If the request is recorded in an internal compliance register, personal data in that register is kept for one year and then anonymised, unless the request is still open.

17. Complaint to the AEPD

The controller is currently established in Spain. Processing for this website is governed by the GDPR and Spanish data protection law. If you consider that the processing of your data does not comply with applicable data protection law, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es), without prejudice to any other administrative or judicial route.

18. Changes to this policy

When we materially change what this policy describes, we will update the date and version indicated at the beginning of the document. The version accepted at the time of registration remains associated with your contact as evidence of consent (see §4).

19. Contact

For any question about this policy or about your data, write to hello@economiq.io.