Privacy policy

Who is responsible

The data controller is D-Legacy SAS, a company incorporated in Ecuador and based in Quito, operating under the Daleki Lab brand. For any personal data matter, write to dalekilab@gmail.com.

What data we process

The website has no public accounts or bookings. The demos and the AI assessment run in your browser and do not store your choices or answers; for the demos, we only count that they were used.

• If you chat with ARCO: the text you type is sent to OpenRouter and to the language model provider only to generate the answer, using providers that do not use the data for training. Unless you ask us to contact you, we do not store the conversation in our database; we only record the amount of text processed and its cost, without the content. If you tick the box asking the team to contact you, we store the conversation and the contact details you give us as an inquiry. To prevent abuse, the same limit based on an IP fingerprint described below applies.
• If you write to us on WhatsApp: the data you decide to share, such as name, company, contact details, and the content of your message.
• If you email us: your name and address as they arrive, the subject, the message and the replies we exchange. We store them in our database as an inquiry, with its conversation, to answer you and follow up. Automated, mailing list and bounce emails are not stored as inquiries.
• If you send a request through the contact form: your name, your company and phone if you give them, your email, what you write, the language, the page you sent it from and the date. We store it in our database to answer you and send the team an email alert. If you also tick the newsletter box, that permission is recorded separately and only becomes active once you confirm it from your email.
• If you subscribe to the newsletter: your email, language, which issues we sent you and, if you unsubscribe, the date you did. We keep the date you subscribed and confirmed, the version of the text you accepted and the form you used, so we can prove your consent. We do not store your IP.
• Visit measurement, without cookies: the page you view, the site or campaign you came from, your approximate country, device type, and a few actions: clicks to WhatsApp or email, opening ARCO, using a demo, requesting the newsletter, and sending a contact request, without your name, your email or what you wrote. From your IP and browser we compute a pseudonym that changes every day. The key that generates it is deleted automatically from the second day on, with the next visit the site records, and from then on the record cannot be linked to you. The IP is not stored in the statistics. To stop abuse we keep, for a short time, an irreversible fingerprint of the IP, computed with a secret key, which is not used to measure visits.
• Technical connection data: the hosting provider processes IP address, browser, and access logs to serve and protect the website.
• If we work together: data about the people responsible for the project or taking part in advisory, a workshop, or a program (name, email, attendance, and exercises), and the information needed to deliver it, as we agree.

Automated emails: when you write to us through the form or by email, or when you agree in ARCO that we contact you, we may send you an automatic reply confirming we received your message and, if the conversation is still open, up to two reminders after 2 and 5 days. Each one says it is automated, links to this policy and includes a one-click link to stop receiving automated emails.

To answer urgent inquiries first, we rank them with a score based only on what you told us: the type of company, the problem, and whether you want to move forward. The score only orders the team's inbox. A person decides anything we reply beyond the automated emails.

We do not use advertising, build advertising profiles, or record sessions. If your browser sends a Do Not Track or Global Privacy Control signal, we do not measure your visit.

What we use it for

1. Answering your inquiries and following up.
2. Preparing a proposal when you ask for one.
3. Delivering, invoicing and supporting a contracted project.
4. Meeting legal, tax, and corporate obligations.
5. Keeping the website secure.
6. Sending you the newsletter and other Daleki Lab communications about its services, if you authorized it and confirmed your email.
7. Understanding which pages are useful and improving the website with aggregated statistics.

We only send you marketing communications if you expressly agreed. We do not make automated decisions that produce legal effects on you.

Legal basis

• Your consent, when you write to us or agree to receive communications.
• Pre-contractual measures or the performance of a contract, when we prepare a proposal or work with you.
• Compliance with legal obligations.
• Our legitimate interest in answering inquiries you started, protecting the website and measuring its use in aggregate, without cookies and without identifying you.

You can withdraw your consent at any time, without affecting what was done before.

If you do not give us your data

Giving us your data is voluntary. Without an email we cannot send you the newsletter, and without a way to contact you we cannot reply. If some data is wrong, we may not reach you or may prepare a proposal based on incorrect information; you can correct it whenever you want.

How long we keep it

• Inquiries that do not lead to an engagement, including contact form requests: up to 24 months from the last contact.
• Clients: for the duration of the relationship and 7 years after, due to tax and corporate obligations.
• Newsletter subscribers: while you remain subscribed. If you unsubscribe, we keep only the record of that request so we do not write to you again; if you ask us to delete it, we do.
• Visit statistics: 13 months.
• IP fingerprint to stop abuse: deleted automatically after two days, with the next request the site processes.
• Technical logs: according to the hosting provider's policy.

Once that period ends, data is deleted or anonymized.

Who else processes it

• Vercel Inc.: hosting and delivery of the website.
• Supabase Inc.: database for the newsletter, statistics, inquiries and their conversations, the contact cases we log, and the internal panel.
• Resend Inc.: delivery of newsletter emails, automatic replies and reminders, and the internal alert the team receives when you send a request. It also receives the emails that reach our mailbox and delivers them to our database.
• OpenRouter Inc.: AI models we use to draft content. If you wrote to us and we logged your case, it may receive your company name, the service you are interested in and our notes so it can suggest a next step; we do not send it your name or contact details, and a person reviews every suggestion. It receives what you write through the form, by email or in ARCO to summarize in one line what you need. It also processes what you type in ARCO to generate its answer.
• Lab, our internal operations agent: it may read inquiries and their conversations to prepare the team's follow-up. It only reads: it does not write to anyone or change data.
• Fal: generates images from text descriptions, with no personal data.
• Google (Gmail): our mailbox, which receives what you write to us that way and forwards it to our database.
• Meta (WhatsApp): messaging, when you choose to write to us through that channel.
• The project providers or AI tools used in a training engagement, agreed with you in the proposal.

We do not sell your data or share it for advertising purposes.

Transfers outside Ecuador

Vercel, Supabase, Resend, and OpenRouter process data on our behalf, under contract and following our instructions; they do not use it for their own purposes. Their servers are mainly in the United States. When sending data outside the country is an international transfer, we make it with safeguards recognized by Ecuador's Superintendency of Personal Data Protection. If you write to us on WhatsApp or Gmail, Meta and Google also process those messages under their own policies.

Your rights

Ecuador's Organic Law on Personal Data Protection grants you these rights:

• Access to the data we hold about you
• Rectification and updating if it is wrong, incomplete, or outdated
• Deletion when it is no longer needed or you withdraw consent
• Objection to a specific processing activity
• Portability of your data to you or to another controller
• Suspension of processing
• Not being subject to decisions based solely or partly on automated assessments that produce legal effects or affect your rights

To exercise them, write to dalekilab@gmail.com stating the right and the data it concerns, and including what we need to verify that you are the data subject. We respond within 15 days at most. For portability we give you your data in a structured, commonly used format. If you are not satisfied, you can file a complaint with Ecuador's Superintendency of Personal Data Protection.

How we protect it

The website is served only over HTTPS and with security headers. The database enforces role-based permissions: only the authorized team can access subscribers and statistics, signing in through a link sent to their email. In our projects we apply least-privilege access, data separation and human approval for sensitive actions.

If a security breach puts your data at risk, we notify the authority and you within the time limits set by law, explaining what happened, what we did, and what we recommend you do.

Minors

This website is intended for companies and professionals. We do not knowingly collect data from minors.

Cookies

The public pages do not use cookies. The team's internal panel uses strictly necessary session cookies. Details are in our cookie policy.

Changes

If this policy changes, we publish the new version with its effective date.