Privacy

Controller

Data controller: Marion Delaporte, promoter of Saber-Hacer (a company being set up), Málaga. Contact: marion@saber-hacer.com · +34 680 833 235.

What data we process

Your email, and your name and phone number when you book, buy, commission a piece or write to an artisan. The names of the people coming with you to a workshop, and your address if we ship you a piece.

The messages you exchange with artisans, the reviews you post and your favourites.

If you are an artisan: your application, profile, photos and tax details. Your bank details are collected by Stripe, not by us.

If you coordinate a school programme: your name, school and contact. Students' feedback is anonymous: it uses a code and we do not store their names.

Payments are processed by Stripe: we never see your card number.

While we take no payments, the email you leave on the waitlist or to hear when your city opens.

If you email Saber-Hacer, or we email you: who writes, to whom, the subject, the date and a one-line summary, noted in our contact book. The full text and attachments stay only in our mailbox.

Why, and on what legal basis

Running your account, bookings, orders, commissions and messages: to perform our contract with you (GDPR art. 6.1.b).

Issuing receipts and invoices and keeping accounts: legal obligation (art. 6.1.c).

Telling you when we open or when a new city opens: your consent (art. 6.1.a), which you can withdraw at any time.

Security, fraud prevention and review moderation: our legitimate interest (art. 6.1.f).

Assessing an artisan application: steps before a contract (art. 6.1.b).

We send no advertising without your permission, do no profiling and do not sell your data.

Managing our relationship with you (answering on time, remembering what we talked about) and finding artisans, schools and companies to work with: our legitimate interest (art. 6.1.f). An artificial intelligence system summarises and sorts emails to help Marion; it makes no decision about you. If your contact details come from a public source, we tell you so the first time we write and you can object.

Who else sees your data

The artisan of your booking, order or commission, who needs your name and contact to serve you.

Our providers, who process data only on our instructions: Supabase (database, hosted in the European Union, in Paris), Vercel (web hosting), Stripe Payments Europe (payments, Ireland), Resend (email delivery), Google Workspace (email), Anthropic (machine translation of texts and messages, and summarising and sorting the emails we receive) and Adobe Fonts (typefaces: your browser requests them from Adobe, which sees your IP address).

Vercel, Resend, Google, Anthropic and Adobe may process data in the United States. They do so under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

How long we keep it

Your account, until you ask us to delete it.

Bookings, orders, receipts and invoices: six years, as the Spanish Commercial Code requires (art. 30).

Waitlist and city alerts: until we write to tell you, and at most one year after that.

Artisan applications that are not accepted: one year.

Our providers' technical logs, for the short time each of them states.

Email summaries and contact notes: while the relationship lasts and at most two years after the last contact. If you object, we delete them.

Your rights

You can ask us to access, correct, delete or port your data, to restrict or object to its use, and to withdraw your consent, by writing to marion@saber-hacer.com. We reply within one month at most.

If you disagree with our reply, you can complain to the Spanish Data Protection Agency (AEPD) at www.aepd.es.

Children

Saber-Hacer is for adults. Children under 14 must not create an account. In school programmes, students rate workshops with an anonymous code.

Changes

If we change this policy we will say so here with the date of the last update, and write to you if the change affects you.