Legal
Privacy Policy
Last updated: 8 Oct 2026
This is a translation provided for convenience. In case of discrepancy, the Spanish version prevails.
This policy explains how we process the personal data of people who visit this website or contact us, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Data controller
- Controller: Miguel Martín Lacoma (CherryPick)
- Tax ID (NIF): 53390054Q
- Address: Avenida de la Armada Española 13, Boadilla del Monte (Madrid)
- Email: info@cherrypick.tech
2. What data we process, why, and on what legal basis
| Processing | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Diagnosis form and contact by email or phone | Name, email, company (optional) and whatever you tell us in the form, by email or by phone | To answer your request and, if you ask, prepare a proposal | Your consent (art. 6(1)(a) GDPR); pre-contractual steps at your request (art. 6(1)(b)) | 12 months from the last contact if you don't become a client; if you do, for the duration of the relationship and then, blocked, for the statutory periods (art. 32 LOPDGDD) |
| Digital twin (AI voice assistant) | Your voice, the conversation transcript and technical connection data; and, only if you choose to share them, your name, company, sector, size, role, what you need and an email or phone number | To handle your enquiry through a conversation with an AI assistant and, if you expressly agree during the conversation, for Miguel to contact you afterwards | Your consent when you press "Talk now" and, for being contacted, your express agreement during the conversation (art. 6(1)(a) GDPR); pre-contractual steps at your request (art. 6(1)(b)) | 30 days at ElevenLabs. If you agree to be contacted, the summary and transcript Miguel receives by email are kept like form requests: 12 months from the last contact if you don't become a client |
| Clients | Contact and billing details | To provide the contracted service and meet tax obligations | Performance of the contract (art. 6(1)(b)) and legal obligation (art. 6(1)(c)) | For the duration of the contract and then the tax and commercial periods (up to 6 years) |
| Browsing | IP address, date and time, technical browser data | Security and operation of the website | Legitimate interest (art. 6(1)(f)) | Only as long as strictly necessary for that purpose |
The digital twin is an artificial intelligence system: you are not talking to a person. When the conversation ends, the AI summarises it and estimates whether your need fits our services, only to prioritise replies; Miguel decides whether and how to contact you. We do not use it to identify you by your voice or to make automated decisions with legal effects on you.
We do not send electronic commercial communications without your prior express consent (art. 21 LSSI-CE).
3. Recipients
We do not share your data with third parties unless legally required. We work with these providers, which process data on our behalf (processors) under the agreement required by article 28 GDPR:
- Railway Corporation (USA), with servers in the EU (Amsterdam): hosting of the website and the form server.
- Google (Google Workspace): email.
- Resend (Plus Five Five, Inc., USA): sending the form emails and the digital twin summaries.
- ElevenLabs (USA): digital twin (AI voice assistant).
If you play the talk video, your browser connects to YouTube (Google Ireland Limited) and sends it your IP address and technical browser data. This only happens when you press play, after the notice that appears when you press "Watch the talk", so the legal basis is your consent (art. 6(1)(a) GDPR). From then on Google processes that data under its privacy policy.
4. International transfers
Railway, Google, Resend and ElevenLabs may process data outside the European Economic Area; the website and the form server are hosted in the EU, but Railway is a US company. Those transfers rely on the standard contractual clauses approved by the European Commission (art. 46 GDPR) or, where the provider is certified, on the EU-US Data Privacy Framework.
5. Your rights
You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent without affecting prior processing. Write to info@cherrypick.tech stating which right you are exercising. We will reply within one month. If you disagree with the reply, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
6. Minors
This website is not aimed at children under 14. If you are under that age, do not send us data or use the voice assistant without your parents' or guardians' consent (art. 7 LOPDGDD).
7. Security
We apply appropriate technical and organisational measures: HTTPS encryption, restricted access to information and two-step verification on provider accounts.
8. Changes
We may update this policy to reflect legal changes or changes to our services. The date of the last update appears at the top of the page.