Privacy notice

Last updated: 31 October 2026

Who I am

This site is run by Owen Moss, trading as Mosswerk, a sole trader in Spain. I decide what happens to the details you send me, so I am the data controller.

What I collect

  • What you type in the contact form: your name, email address, the package you picked (if any) and your message.
  • Your IP address: it appears in the server logs on every visit, it is used to limit how often one address can send the form, and it goes to the spam check when you send the form.

If you only read the site and don't send the form, the only thing recorded about you is your IP address in the server logs.

Why, and on what legal basis

  • To answer your enquiry and, if you ask, to prepare a proposal. Legal basis: steps you ask for before entering into a contract (GDPR Article 6(1)(b)).
  • To keep the site secure and free of spam, through server logs, rate limiting and the spam check. Legal basis: my legitimate interest in running a secure site (Article 6(1)(f)).

You don't have to give me your details, but I can't reply to an enquiry without an email address. Nothing about you is decided automatically, apart from the spam filter, which only decides whether I get an email about your message.

Who receives it

  • Scalingo hosts the site and its database in France (Paris region).
  • Resend delivers the notification email that tells me about your enquiry.
  • Google provides the Gmail mailbox that the notification email goes to.
  • Cloudflare runs the spam check (Turnstile) on the form and receives your IP address.

Resend, Google and Cloudflare may process data in the United States. All three are certified under the EU-US Data Privacy Framework, which the European Commission recognises as giving adequate protection. Resend and Google also use the Commission's standard contractual clauses.

I don't sell your details or share them with anyone else. If you use the "Book a call" link or pay for a Scoping Session, you leave this site for Google Calendar or Stripe, and their own privacy notices apply.

How long I keep it

  • Enquiries are deleted automatically after 12 months.
  • Messages flagged as spam are deleted automatically after 30 days.
  • The notification email in my mailbox is moved to the trash automatically after 12 months and permanently deleted 30 days later.
  • Rate-limit counters that hold your IP address expire after 1 hour.
  • Server logs are kept by Scalingo for 1 year, as French law requires.

If we do sign a contract, what the contract needs is copied into the client file before then. That file is kept for six years, as the Spanish Commercial Code (article 30) requires for business correspondence.

Your rights

You can ask me to show you the details I hold about you, correct them, delete them, stop using them (objection), or give them to you in a portable format. Email owenkmoss@gmail.com and I'll reply within one month.

If you're unhappy with how I've handled your details, you can complain to the Spanish data protection authority, the AEPD (aepd.es). If you live in the Netherlands, you can also go to the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

Cookies

There's no analytics, no advertising and no tracking on this site. The site sets one cookie:

  • _mosswerk_session: keeps the contact form secure (it holds an anti-forgery token) and shows you a confirmation message after you send the form. It is deleted when you close your browser. This cookie is strictly necessary, so it doesn't need your consent.

The Cloudflare spam check runs in a frame loaded from challenges.cloudflare.com and sets no cookies.

Changes

If I change how I handle your details, I'll update this page and the date at the top.