Data protection

Privacy Policy

Coralia CRM · Last updated: 6 July 2026

Translation for information purposes. This is an English translation of a document originally drafted in Spanish. In the event of any discrepancy, the Spanish version shall prevail and is the legally binding text.

This Privacy Policy describes how we process the personal data we collect from users (hereinafter, "the Consultant" or "the user") through this website and through the licence management of the Coralia CRM application, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Act 3/2018, of 5 December (LOPDGDD).

The key point: Coralia CRM is a desktop application with local storage. Your customers' data (names, phone numbers, history, notes) is stored exclusively on your own computer. We do not receive it, we do not host it and we have no technical access to it at any time. This policy refers only to the data you provide to us (mainly your email address). You are the sole Data Controller for your customers' data — see the EULA for details.

1. Data controller

Identity / legal name: Joan Martínez Cervelló
Tax ID (NIF/CIF): 38131415Z
Postal address: C/ Sant Pau 25, 08330 Premià de Mar (Barcelona), Spain
Email: [email protected]
Data Protection Officer (DPO): None appointed, as this is not mandatory under art. 37 GDPR. For any privacy matter, please use the email address above.

2. What data we process, for what purpose and on what legal basis

We only process data relating to the platform's user; never data relating to their end customers. The processing activities are as follows:

Data	Purpose	Legal basis (GDPR)	Retention
Email address and name associated with the purchase	To generate and send the Pro licence key, provide support and send security patches and application updates.	Performance of a contract to which the data subject is party — art. 6(1)(b).	For as long as the licence is in force and, thereafter, for the applicable legal and tax limitation periods.
Licence status and technical device identifier (hardware fingerprint / machine ID) generated to link the licence	To validate activation, limit the number of devices per licence and prevent fraudulent use or unauthorised copying of the software.	Legitimate interest in protecting intellectual property and preventing fraud — art. 6(1)(f). (You may object; doing so may prevent licence validation.)	Until the licence is cancelled or the associated device identifier is released.
Email address and message content when you write to us (contact or support)	To handle and answer your query, question or support request.	Legitimate interest in replying to those who contact us — art. 6(1)(f); if the query relates to the purchase, pre-contractual measures — art. 6(1)(b).	For as long as necessary to handle the query and, thereafter, for as long as liabilities may arise.

We do not send marketing: your email is used only to reply to you, deliver your licence and, for Pro customers, notify you of application updates and security patches. We do not send commercial communications or newsletters.

Hardware identifier: for the licence to work, the application generates a technical identifier of your device. This is personal data and that is why we declare it expressly here. It does not allow you to be located or files on your computer to be accessed; it only serves to link your licence to your machine.

Providing your purchase email is necessary in order for us to deliver your licence: if you do not provide it, we will not be able to supply the Pro service.

3. Recipients and processors

To provide the service we rely on the following providers, which process data on our behalf or as independent controllers:

Payment gateway (Merchant of Record): Lemon Squeezy, LLC. It handles payment collection, invoicing and VAT settlement, acting as merchant of record. When you buy, you provide your billing details and email directly to this entity (which may load technical scripts such as lemon.js on the site), and it passes on to us your name, email and transaction ID so we can generate your licence.
Website hosting provider: Cloudflare Pages (Cloudflare, Inc.).
Image storage and delivery provider (CDN): Cloudinary, Ltd. Used to host and optimise the loading of the landing page's screenshots and graphic assets.
Email provider: Brevo (Sendinblue SAS).

We do not disclose your data to any other third party, except where legally required.

4. International data transfers

Some of the providers listed (in particular the payment gateway and, where applicable, the email provider) are located in or have infrastructure outside the European Economic Area, mainly in the United States. Those transfers are carried out with appropriate safeguards, using one of the mechanisms provided for in Chapter V of the GDPR:

The provider's adherence to the EU–U.S. Data Privacy Framework (an adequacy framework recognised by the European Commission), where the provider is certified; and/or
The signing of Standard Contractual Clauses approved by the European Commission, together with supplementary technical and organisational measures.

You may request information about the mechanism applicable to each provider and obtain a copy of the safeguards by writing to our contact email address.

5. Your rights

You may exercise the following rights in relation to your personal data:

Access, rectification and erasure of your data.
Restriction of and objection to processing.
Portability of the data you have provided to us.
Withdrawal of consent at any time, without affecting the lawfulness of processing carried out beforehand. This right will only apply if we process data based on your consent in the future (for example, voluntary subscription to a newsletter); at present, none of the processing activities described in section 2 is based on consent.

To exercise them, write to [email protected] stating the right you wish to exercise. We will verify your identity through the email address on record for your licence or request; you do not need to send us a copy of your ID card or any other identity document. Only if there were reasonable doubts about your identity might we ask you for strictly proportionate additional information.

Right to lodge a complaint with the supervisory authority: if you consider that the processing of your data does not comply with the applicable rules, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan, 6, 28001 Madrid, Spain — www.aepd.es.

6. Cookies

This website uses only technical or strictly necessary cookies (first-party and payment gateway cookies), which do not require prior consent. We do not use analytics or advertising cookies. You can find the details in the Cookie Policy.

7. Security

We apply reasonable technical and organisational measures to protect the data we process (users' email addresses). Remember that your customers' data resides solely on your own device and its security depends on you; see the recommendations in the EULA.

8. Changes to this policy

We may update this Privacy Policy to adapt it to regulatory or service changes. We will publish the version in force on this same page, stating the date of the last update.