Your data, plainly

The controller of your personal data is BLACKNOSAUR, S.L., Madrid, Spain. For anything about this policy or your data, write to [email protected].

This policy covers blacknosaur.com and the services on it: the newsletter, the Evolution Lab and the site assistant.

Newsletter

Your email address, where you signed up (for example “newsletter page”), your subscription status, an opaque token for the confirm and unsubscribe links, and when you signed up and confirmed. If you sign up from the Evolution Lab and gave a name, we keep that too.

We use it only to send the weekly notes. Nothing goes out until you confirm by email (double opt-in), and every issue has a one-click unsubscribe link.

Evolution Lab

The style you type, the image generated from it, its size, and a one-way salted hash of your IP address (we can’t turn it back into your IP). The hash and a daily budget keep the Lab from being abused.

Images appear in the public Lab feed. If you choose to claim one, you can add a name, which is shown with the image, and an email, which is never shown. Ticking the newsletter box starts the same double opt-in as above.

Site assistant (B-01)

What you type, or say if you turn on voice, is sent to our AI providers to produce a reply. We keep the text of each conversation (with the page section you started from, the kind of device, and a one-way hash of your IP address) so we can read what people ask and improve the assistant. It isn’t linked to your name or email unless you type them in. The microphone is only used while you have voice mode on, and recordings aren’t kept after they’re transcribed.

If you ask the assistant to send your brief, it emails us your name, email and the details you gave (company, project summary, timeline, budget) so we can reply.

Emails to us

If you write to us, we keep the email and your address to answer and, if we work together, to run the project.

Technical data

Like any website, our servers see your IP address and browser details with each request. Our hosting provider keeps standard request logs. To limit abuse, our code counts recent requests per hashed IP address (and sign-ups per hashed email) for up to a day.

We count page views without cookies: the page, the site that linked you here, and whether you’re on a phone, tablet or desktop. To count unique visitors we keep a one-way hash of the day, your IP address and browser, so the same visitor counts again the next day and can’t be traced back. If your browser sends Do Not Track or Global Privacy Control, we don’t count you at all. Daily totals are kept for 400 days.

We don’t build profiles, buy data or combine what we hold with other sources.

Consent

The newsletter, the optional name and email on a Lab image, and voice input (art. 6.1.a GDPR; art. 21 LSSI for commercial email). You can withdraw it at any time.

Steps you ask for

Generating your Lab image and handling a brief or email about a project (art. 6.1.b GDPR).

Legitimate interest

Keeping the site secure and free of abuse (IP hash, rate limits, logs), counting visits without cookies, answering questions through the assistant and reviewing those conversations to improve it, and keeping an unsubscribed address only to make sure we never email it again (art. 6.1.f GDPR).

Legal obligation

Keeping records we’re required to keep if we do business together (art. 6.1.c GDPR).

These companies process data on our behalf, only for the purposes above:

• GoogleOptional analytics, with consent
• RailwayHosting, database and visit counts
• Amazon Web ServicesEmail delivery (Amazon SES)
• Cloudflare / Amazon Web ServicesStorage for Lab images (R2 or S3)
• falRuns the AI models below
• OpenRouterRoutes assistant requests to the model
• OpenAILanguage model behind the assistant, the Evolution Lab’s image model and its content checks
• ElevenLabsVoice: speech to text and text to speech

We don’t sell personal data or share it with anyone for advertising.

Several of these providers are based in the United States, so your data may be processed there. Where a provider is certified under the EU–US Data Privacy Framework we rely on that adequacy decision; otherwise on the European Commission’s Standard Contractual Clauses (art. 46 GDPR). Write to us for a copy of the relevant safeguards.

Newsletter

While you’re subscribed. When you unsubscribe we keep your address marked as unsubscribed so you never get another issue. Ask and we delete it completely.

Lab images

As long as the image is part of the Lab. Ask and we remove it, with any name and email attached.

Assistant

Conversations for 12 months, then deleted. Ask and we delete yours sooner. Providers process it to answer and may keep it briefly under their own terms, for abuse monitoring.

Briefs and emails

As long as the conversation, and any project, needs. If we work together, as long as Spanish tax and commercial law requires.

Request counts

Hashed, for up to a day.

Visit counts

Daily totals and hashes, 400 days.

Google Analytics loads only after you accept analytics. Its _ga and _ga_* cookies last up to 180 days. We store your choice in bn-analytics-consent-v1 for 180 days. Rejecting or withdrawing consent stops collection and removes these analytics cookies. Do Not Track and Global Privacy Control take precedence. Fonts are served from our own domain. Other browser storage:

• bn-intro bn-return bn-dock-muted
  Session storage. Whether you’ve seen the intro, where to return to, and whether the assistant is muted. Gone when you close the tab.
• bn-404-hi bn-sound
  Local storage. Your high score in the game on the 404 page, and whether you turned the site’s sound off.
• bn_admin
  A cookie set only for our team when they sign in to the admin. Strictly necessary, 14 days.

The preference values stay in your browser. The admin cookie authenticates our team. Google Analytics cookies, when accepted, distinguish browsers for measurement.

You can ask us to:

• see the data we hold about you, and get a copy (access, portability);
• correct it (rectification);
• delete it (erasure);
• limit how we use it (restriction);
• stop using it, where we rely on legitimate interest (objection);
• withdraw consent at any time, without affecting what was done before.

Write to [email protected]. We reply within one month, and may ask you to confirm you own the address in question. We don’t make decisions about you by automated means that have legal or similarly significant effects.

If you’re not happy with our answer, you can complain to the Spanish data protection authority: Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, aepd.es .

Everything travels over HTTPS. Access to the database, storage and email accounts is limited to our team. IP addresses are hashed with a secret salt before they’re stored, and confirm and unsubscribe links use random tokens instead of your email.

This site isn’t meant for children under 14, and we don’t knowingly collect their data. If you think a child has given us data, write to us and we’ll delete it.

The site assistant is an AI, not a person, and Lab images are generated by an AI model. The assistant can be wrong. Anything that matters, like scope, price or dates, is confirmed by a person from our team.

If we change how we handle data, we’ll update this page and the date at the top. If the change is significant and you’re subscribed, we’ll tell you in the newsletter first.

← Back to the site