Last updated: July 11, 2026
Cafe9 (“we”, “us”) is an AI consultancy operated from Valencia, Spain. This policy explains what personal data we collect through cafe9.ai, why we collect it, and the rights you have over it. We’ve written it in plain language on purpose — the same way we write everything else.
Who is responsible for your data
The data controller for cafe9.ai is Cafe9, Valencia, Spain. For anything related to your personal data, contact us at tom@cafe9.ai.
What we collect, and why
Email correspondence. If you email us (for example to book a consult), we receive your email address, your name if you include it, and whatever you write. We use it to reply and, if we end up working together, to prepare and perform our engagement. Legal basis: taking steps prior to entering a contract, and our legitimate interest in responding to enquiries (GDPR Art. 6(1)(b) and 6(1)(f)).
Technical and log data. Like almost every website, our hosting provider automatically records short-lived server logs — IP address, browser type, pages requested, timestamps — used for security, abuse prevention, and keeping the site running. Legal basis: legitimate interest (Art. 6(1)(f)). These logs are routinely rotated and are not used to profile you.
Analytics. We do not currently run analytics cookies. If we enable visitor analytics in the future, we will only do so with a consent banner that lets you refuse as easily as accept, and this policy will be updated first. Legal basis when enabled: consent (Art. 6(1)(a)), which you can withdraw at any time.
What we don’t do: we don’t sell your data, we don’t run advertising trackers, we don’t make automated decisions about you, and our web fonts are served from our own server — not from a third-party CDN that could log your visit.
Cookies
For ordinary visitors, cafe9.ai currently sets no tracking cookies. Purely functional cookies may be set if you log in (staff only) or if a future feature strictly requires them. Anything beyond strictly necessary will ask for your consent first. You can review or change your choice any time via cookie settings.
Who else touches the data
We use a small number of service providers (“processors”) to run the site and our email:
- Web hosting — our site is hosted by DreamHost in the United States. Transfers of technical data to the U.S. are safeguarded by the European Commission’s adequacy framework and/or Standard Contractual Clauses.
- Email — messages to tom@cafe9.ai are handled by our email provider on our behalf.
These providers process data only on our instructions. We don’t share your data with anyone else unless the law requires it.
How long we keep things
- Server logs: rotated automatically on a short cycle (typically days to a few weeks).
- Email correspondence: kept as long as needed to handle your enquiry or our engagement, then for as long as legitimate business and legal record-keeping requires.
Your rights
Under the GDPR you can ask us at any time to:
- access the personal data we hold about you (Art. 15);
- correct it (Art. 16) or delete it (Art. 17);
- restrict how we use it (Art. 18);
- receive it in a portable format (Art. 20);
- object to processing based on legitimate interest (Art. 21);
- withdraw any consent you’ve given, without affecting processing that happened before (Art. 7(3)).
Email tom@cafe9.ai and we’ll respond within one month. You also have the right to lodge a complaint with a supervisory authority — in Spain, the Agencia Española de Protección de Datos (aepd.es), or the authority in your own EU country.
Children
cafe9.ai is a business-consulting site and is not directed at children under 16. We don’t knowingly collect their data.
Changes to this policy
If our data practices change — for example, if we add analytics or a contact form — we’ll update this page and change the date at the top before the new practice starts.