Privacy policy

Data controller

Controller

ZERO1 MEDIA SL

VAT / NIF

ESB70826946

Registered office

C/ Valencia 74, 4-4, 08015 Barcelona, Spain

Privacy contact

info@ultimatetools.eu

No Data Protection Officer has been appointed: the processing described below does not reach the thresholds of Article 37 GDPR and Article 34 LOPDGDD. For any question about your data, write to the address above.

In short

• You can use the site without signing up and without giving any personal data.
• Google Analytics and the Meta pixel run only if you accept them in the banner, each asked separately.
• We collect your email only when you type it: for the newsletter, for a Google Workspace promo code or for a sponsorship request.
• We do not sell personal data and we show no ads on this site.
• You can ask at any time to see, correct or delete your data.

What we collect, and when

• While you browse. Like any website, the servers that deliver it log, for each request, the technical data needed to serve it: IP address, date and time, requested page, referring page, browser and device type, language and rough location. This keeps the site running and fast, and protects it from attacks.
• Visit counts and error reports from the platform. Lovable, the platform that builds and serves the site, records each page view with the address, the referring page, your browser, its language and a country guessed from your time zone, tied to a session identifier that expires after 30 minutes. If a page fails, it also receives a technical description of the error. This runs without consent, as part of how the site is served, and produces only aggregate figures.
• Statistics, only if you accept. With your consent, Google Analytics 4 records which pages you view, for how long, roughly where from (country and city, derived from your IP address, which Google does not store), your device, browser and the site that sent you, tied to a random identifier stored in a cookie. Google Analytics' advertising features (Google Signals, sharing with Google Ads) are switched off.
• Marketing, only if you accept. With your consent, the Meta pixel tells Meta Platforms Ireland Limited which pages you view here, which tool and offer pages you open and whether you sign up to the English newsletter, together with a browser identifier (_fbp cookie) and, if you came from an ad, the click identifier (_fbc). The same events are also sent from our server through Meta's Conversions API, with your IP address, your browser and, when you sign up to the English newsletter, your email turned into a non-reversible code (SHA-256 hash), which Meta uses only to match the sign-up. We use this to measure our campaigns on Facebook and Instagram and to show them to people who already know the site. If you decline or withdraw consent, none of this is sent, neither from your browser nor from our server.
• Italian newsletter. The sign-up form on the Italian Newsletter page is Substack's, loaded from substack.com: your email goes straight to Substack, which sends the newsletter, and this site neither receives nor keeps it. From then on Substack handles your data under its own privacy policy (substack.com/privacy).
• English newsletter. The form on /en/newsletter/ is ours: our server receives your email and passes it to beehiiv, which sends the English newsletter, without keeping it. beehiiv keeps the subscription and records email opens and clicks for the newsletter's statistics.
• Google Workspace promo code. To get a personal code you leave your email and pick a plan. We store the email with the code assigned and the time of the request, so the same email always gets the same code and each code goes to one person only. We use it for nothing else and do not pass it to Google.
• Newsletter sponsorship request. In the sponsor slot booking form you give us your name, email, company, website, an optional message and the slots you are interested in. We store the request in our database and receive an email notice, so we can answer and, if we agree, prepare the sponsorship.
• When you write to us. If you email us, we keep the message, your address and our reply.
• Content from other sites inside our pages. Some pages show content loaded from other services: tool videos from YouTube (in its youtube-nocookie.com version, which sets no cookies until you play the video), Google's “Preferred sources” button on blog articles (from news.google.com), and the newsletter sign-up form and issue images from Substack. To show them your browser connects to those services, which receive your IP address and browser details and can read their own cookies already in your browser, for example if you are signed in to Google. None of this data reaches us.
• Preferences saved in your browser. Your answer to the cookie banner and some technical details (for example that a promo code was copied) are kept in your browser's local storage and do not reach us.

We do not collect special categories of data (health, opinions, religion and the like). The site is not aimed at children under 14 and we do not knowingly collect their data: if you think a child has given us data, write to us and we will delete it.

Why we process it, and on what legal basis

• Running, measuring in aggregate and protecting the site — legitimate interest, Article 6(1)(f) GDPR: serving pages, keeping them fast, fixing errors, blocking abuse.
• Google Analytics statistics — consent, Article 6(1)(a), asked in the banner and revocable at any time.
• Meta pixel and Conversions API — consent, Article 6(1)(a), asked separately in the banner and revocable at any time.
• Newsletter — consent, Article 6(1)(a), given by signing up and withdrawn with the “unsubscribe” link at the bottom of every email.
• Google Workspace promo code — carrying out your request, Article 6(1)(b): without the email we cannot give you a personal code.
• Sponsorship requests — pre-contractual steps you asked for and, if it becomes an agreement, performance of the contract, Article 6(1)(b); afterwards, tax and accounting obligations, Article 6(1)(c).
• Answering when you write — legitimate interest, Article 6(1)(f), in replying to people who contact us.
• Defending claims and complying with the law — legitimate interest, Article 6(1)(f), and legal obligations, Article 6(1)(c).

Giving us your data is always optional. Without it you can use the site just the same; we simply cannot subscribe you, give you a personal code or answer a request. We make no decisions based solely on automated processing that have legal effects on you. If you accept marketing, Meta may use the data to include you in the audiences our ads are shown to: that is the only profiling connected to this site, and it depends on your consent alone.

Affiliate links, and what happens when you click one

Many outbound links are affiliate links: if you buy something after clicking, the vendor pays us a commission, at no extra cost to you. These links go through an address on our site (/go/…) that sends you straight on to the vendor; we do not record who clicks, beyond the ordinary technical data of every request. On the vendor's site, and sometimes on the affiliate network in between (for example Impact, Awin, Partnerize, PartnerStack, TradeTracker or financeAds), their cookies are set to credit the sale to us, under their own privacy policies: we do not control or see them. What comes back to us is an aggregate report — how many sales a link produced — never who you are or what you bought. The detail is on the affiliate disclosure page.

Who we share data with

These providers process data on our behalf, as processors (Article 28 GDPR), under a contract and only on our instructions:

• Cloudflare, Inc. — hosting, content delivery and protection against attacks.
• Lovable Labs Incorporated — the platform that builds, deploys and serves the site, including its visit counter and error reports.
• Supabase, Inc. — the site's database: catalogue, assigned promo codes and sponsorship requests, plus images and logos.
• Resend (Plus Five Five, Inc.) — sending the email notices we receive when a sponsorship request arrives.
• beehiiv, Inc. — sending the English newsletter and managing its subscribers.
• Google Ireland Limited — Google Analytics, only if you accepted it, with advertising features switched off.

These parties process data as independent controllers, under their own policies:

• Meta Platforms Ireland Limited — the Meta pixel and Conversions API, only if you accepted marketing. For collecting and sending the data we are joint controllers with Meta (Article 26 GDPR), under the terms Meta provides (facebook.com/legal/controller_addendum); for what Meta does afterwards it is an independent controller (facebook.com/privacy/policy). You can exercise your rights over this data with us or directly with Meta.
• Substack, Inc. — the sign-up form and delivery of the Italian newsletter (substack.com/privacy).
• Google (YouTube and the “Preferred sources” button) — for the embedded content described above (policies.google.com/privacy).
• Vendors and affiliate networks — after you click a link and leave our site.

We may also share data with tax and legal advisers bound by professional secrecy and, where the law requires it, with the competent authorities. We do not sell personal data, we do not pass it to newsletter sponsors and, apart from the Meta pixel if you accept it, we do not share it for anyone else's marketing.

Transfers outside the European Economic Area

Several of these providers are based in the United States or use infrastructure there (Cloudflare, Lovable, Supabase, Resend, beehiiv, Substack, Google and Meta). Transfers rely on the adequacy decision for the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses together with the supplementary measures they require. You can ask us for a copy of the safeguards in place at the address above.

How long we keep it

• Technical data and server logs: normally no more than 30 days, unless needed to investigate an attack.
• Hosting platform visit counts: in aggregate form; the session identifier expires after 30 minutes.
• Google Analytics data: 14 months, then deleted automatically.
• Meta pixel cookies: 90 days; the data Meta receives follows its own policy.
• Newsletter subscription: until you unsubscribe.
• Email tied to a Google Workspace code: for as long as needed to run the code campaign and make sure each person gets one code only.
• Sponsorship requests: for as long as needed to handle the request and, if it becomes an agreement, for as long as tax and commercial law requires.
• Emails you send us: as long as the matter is open, and afterwards for as long as we may need them to defend a claim.
• Your answer to the banner: in your browser, until you change it or clear your browser's storage.

How we protect it

The site runs only over HTTPS. Form data is stored in a database that only our server and the people who run the site can reach, with access rules that stop visitors from reading it; the keys to outside services stay on the server and never reach the browser. No system is 100% secure: if a breach affecting your data ever happened, we would notify the authority and, where the law requires it, you as well.

Your rights

You can ask for access to your data (Article 15), its correction (16), erasure (17), restriction of processing (18) and portability (20), and you can object to processing based on legitimate interest (21). Where processing rests on consent you can withdraw it at any time (Article 7(3)) without affecting what was done before: for cookies from the cookie settings, for the newsletter from the link at the bottom of every email.

For anything else write to info@ultimatetools.eu. We answer within one month and may ask you to show that the address is yours. If you think we have handled your data badly you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es) or to the supervisory authority where you live.

Cookies

Strictly necessary cookies and the hosting platform's 30-minute visit counter are set without asking; Google Analytics and Meta pixel cookies only after you accept them in the banner, each asked separately. The detail, cookie by cookie, is on the cookie policy.

Changes to this policy

When what we do with data changes, this page changes with it and the date at the top moves. Substantial changes to processing based on your consent will be asked of you again, not announced quietly here.