Who we are and who controls your data
The data controller for the processing described in this notice is Francisco Olivares Martín, trading as Olivares AI, with registered address at Calle San Antón, 13, 45700 Consuegra (Toledo), España and tax identification number 70361419A. The identity card above sets out our full registration details.
For any question about this notice or about how we handle your personal data, and to exercise the rights described below, you can contact us at privacy@olivares.ai. Where we have appointed a data protection officer or representative, their details appear in the entity card above.
Scope of this notice
This notice covers personal data processed through the public website at olivares.ai, which is a static, informational site, and personal data you send us when you choose to contact us.
It does not cover the self-hosted product. Our product runs on infrastructure that you, the customer, operate within your own perimeter. You remain the controller or processor of the data handled by the product, and Francisco Olivares Martín never receives that data. There is therefore no vendor-side processing of your product data to describe here. For more detail on this separation and on how the website is secured, see our security overview.
What we collect and why
We deliberately keep data collection to a minimum. There are two situations in which personal data may be processed.
Browsing the website. The site sets no cookies, uses no client-side storage, and runs no analytics, advertising or tracking. We do not build profiles and we make no automated decisions about you. The website is served through a third-party hosting and content delivery provider that, purely to deliver and secure the page, processes the connection metadata that is technically necessary for any web request, such as your IP address, user-agent string and the timestamp of the request. We do not use this metadata to identify or track individuals.
Contacting us. When you choose to write to us, for example by emailing enterprise@olivares.ai or security@olivares.ai, or by requesting a Data Processing Agreement, we process the content of your message together with the contact details you provide, such as your name and email address. We use this solely to read, understand and respond to your enquiry and to maintain the resulting correspondence.
Legal bases for processing
We rely on the following legal bases under Article 6(1) of the GDPR:
- Legitimate interests (Article 6(1)(f)): delivering the website, keeping it available and secure, and preventing abuse. This covers the connection metadata processed by our hosting and content delivery provider. Our legitimate interest is the secure and reliable operation of our own website, and we consider it is not overridden by your interests or fundamental rights given the limited nature of the data.
- Performance of a contract or steps taken at your request prior to entering into a contract (Article 6(1)(b)), and our legitimate interest in handling enquiries (Article 6(1)(f)): when you contact us, we process your message and contact details to respond and, where relevant, to take pre-contractual steps such as discussing a Data Processing Agreement or a commercial relationship.
- Compliance with a legal obligation (Article 6(1)(c)): where we are required to retain certain correspondence or records to meet a legal obligation.
Cookies and tracking
The website sets no cookies and uses no client-side storage. We do not use analytics, advertising, fingerprinting or any other tracking technology, and we do not load third-party scripts for those purposes. Fonts are self-hosted and the site enforces a strict same-origin content security policy. Because no cookies or similar technologies are used, no cookie consent banner is required.
Recipients and subprocessors
We do not sell personal data and we do not share it for advertising or analytics. We do not use advertising or analytics processors of any kind.
The only recipient involved in ordinary use of the website is our third-party hosting and content delivery provider, which processes the connection metadata described above on our behalf, under a data processing agreement, solely to deliver and secure the page.
For the self-hosted product there is no vendor-side subprocessor, because we never receive your product data. To formalise a commercial relationship we make a GDPR Article 28 Data Processing Agreement available on request at enterprise@olivares.ai. Should we ever offer a managed service in the future, it would publish its own subprocessor list; there is none today.
International transfers
We aim to keep processing within the European Economic Area (EEA). Where any processing carried out by our hosting and content delivery provider, or by us in responding to your enquiry, takes place outside the EEA, we ensure that appropriate safeguards are in place as required by Chapter V of the GDPR, such as an adequacy decision of the European Commission or the European Commission's Standard Contractual Clauses, together with any additional measures needed to protect your data. You may request further information about the safeguards we rely on by contacting privacy@olivares.ai.
How long we keep your data
Connection metadata processed by our hosting and content delivery provider is retained only for the short period needed to deliver and secure the website and to investigate abuse, in accordance with that provider's standard operational practice.
Correspondence you send us is kept only for as long as needed to handle the matter to which it relates, and thereafter only for any period during which we are required to retain it to comply with a legal obligation or to establish, exercise or defend legal claims. When data is no longer needed for these purposes, we delete it or anonymise it.
Your rights
Subject to the conditions set out in the GDPR, you have the following rights in relation to your personal data:
- Access: to obtain confirmation of whether we process your data and a copy of it (Article 15).
- Rectification: to have inaccurate data corrected and incomplete data completed (Article 16).
- Erasure: to have your data deleted where the conditions are met (Article 17).
- Restriction: to have our processing of your data restricted in certain circumstances (Article 18).
- Data portability: to receive the data you provided to us in a structured, commonly used, machine-readable format, and to transmit it to another controller, where applicable (Article 20).
- Objection: to object to processing carried out on the basis of our legitimate interests (Article 21).
- Withdrawal of consent: where any processing relies on your consent, to withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
- Not to be subject to automated individual decision-making, including profiling (Article 22); we do not carry out any such processing.
Exercising your rights and complaints
To exercise any of these rights, contact us at privacy@olivares.ai. We may need to verify your identity before acting on your request. We will respond within the time limits set by the GDPR, normally one month, which may be extended for complex or numerous requests.
If you believe our processing of your personal data infringes data protection law, you have the right to lodge a complaint with a supervisory authority, in particular the Spanish Data Protection Agency (AEPD) or the authority of your country of residence or place of work. We would, however, appreciate the chance to address your concerns directly first.
Changes to this notice
We may update this notice from time to time to reflect changes in our practices or in the law. When we do, we will revise the date below and, where the changes are significant, take reasonable steps to bring them to your attention. The version in force is the one published on this page.
Last updated: 2026-06-13.