Legal
Privacy Policy Last updated: October 24, 2026
1. Who is responsible for your data
The data controller for personal data processed through this website is Naolito Animation Studios (“Naolito”, “we”), with registered address at Sor Teresa Prat 15, 29003 Malaga, Spain. For anything related to your data, write to contact@naolito.com.
2. What data we process, why, and on what legal basis
Contact form. When you send us a message through the contact form we process what you enter: your name, email address, subject, type of project, the details of your project and your message, together with your acceptance of this policy. We use it to answer your inquiry and to follow up on a possible project. Legal basis: your consent, given when you tick the acceptance box (Art. 6.1.a GDPR), and the steps you ask us to take before entering into a contract (Art. 6.1.b GDPR).
Keeping the form free of spam. We keep a copy of every message sent through the form in our website’s database, hosted by Cloudflare, together with the visit it came from: the page, the website or campaign that brought you here (referrer and utm parameters), the random identifier of your browser tab described under “Visit statistics”, the type of device (mobile or desktop) and your country as detected by Cloudflare. We do not store your IP address or browser details with it. Before your message is accepted, Cloudflare Turnstile checks that it is sent by a person and not by an automated program, using technical signals from your browser and connection; our server also looks at your browser’s user agent for the same check, only in memory. An automated filter then reads the message with an AI language model that runs on Cloudflare’s own infrastructure (Cloudflare Workers AI) to set aside spam and unsolicited sales offers. The filter only sorts messages: it takes no decision with legal or similarly significant effects on you, and the messages it sets aside are not deleted at once, so that we can review them and recover any genuine inquiry. Only messages that pass the filter are forwarded to our inbox. Legal basis: our legitimate interest in protecting the form from abuse and handling genuine inquiries (Art. 6.1.f GDPR).
Visit statistics. We measure how the website is used with our own statistics, kept in our database at Cloudflare, with no cookies and no third-party analytics service. For each page you view we record the page, the website that linked to it (when it is another website), the campaign parameters of the link (utm_source, utm_medium, utm_campaign, utm_content), the type of device (mobile or desktop, from the screen width), your country, the network your visit comes from (the number and name of its autonomous system, usually your internet provider or a hosting company, so that we can separate automated traffic coming from data centres), how long the page was visible on your screen, and your clicks on the main contact buttons. Page views are grouped by a random identifier of your browser tab, which your browser deletes when you close the tab, and each page view has a random identifier of its own; neither is linked to your name or email address. Cloudflare derives your country and network from your IP address, but we do not store your IP address or your browser’s user agent. If you send us a message, it is linked to the statistics of the visit in which you sent it, so that we know which pages and campaigns bring inquiries. Pages viewed from browsers that send a Do Not Track signal are not recorded, and requests from known robots are discarded. Legal basis: our legitimate interest in understanding how our website is used and improving it (Art. 6.1.f GDPR). You can object at any time by turning on Do Not Track in your browser or by writing to us.
Technical data and embedded content. To deliver the website, Cloudflare processes technical information such as your IP address, browser type and the pages requested, as strictly necessary to serve the site securely and protect it from attacks. Some content is loaded directly from other providers, which therefore receive your IP address and browser details: the website’s fonts come from Google Fonts, and some videos and their preview images are embedded from YouTube in its privacy-enhanced mode (youtube-nocookie.com). Some of these videos start automatically, without sound, as part of the page design. Legal basis: our legitimate interest in offering a fast and secure website that shows our work (Art. 6.1.f GDPR).
Advertising measurement. Only if you accept advertising cookies, we use the Meta Pixel and the Reddit Pixel to measure the visits and contact requests that come from our ads on Facebook, Instagram and Reddit. With your consent these tools process the public pages you visit on this site (only addresses that contain nothing but campaign parameters), your clicks on the contact buttons, your contact requests, the campaign that brought you here (utm parameters and the ad click identifiers fbclid and rdt_cid), technical data such as your IP address and browser, and the identifiers stored in their cookies.
When you send us a message after accepting, and the message passes the spam filter, our server also reports that contact request to Meta and Reddit through their Conversions APIs, so that each platform can attribute it to its ad and count it only once, even if your browser blocks the pixel. It sends a unique identifier of the request, the time, the address of the page of the form, your email address in hashed form (SHA-256, pseudonymised), your IP address and browser user agent, the ad click identifier of the campaign that brought you here (fbclid or rdt_cid), and the identifiers stored in the cookies listed in section 6. The content of your message is never shared, and our server does not store or log your IP address or user agent when doing so. Legal basis: your consent (Art. 6.1.a GDPR and Art. 22.2 of the Spanish LSSI), which you can withdraw at any time from “Cookie settings”.
3. Who receives your data and international transfers
The following providers receive personal data from this website. Cloudflare and Formspree process it on our behalf as data processors, under data processing agreements. Google receives technical data when its fonts and videos load, as an independent controller. Meta and Reddit receive advertising data only if you accept advertising cookies, and also use it for their own purposes as described in their privacy policies.
Some of these providers are based in the United States or may access data from there. Each transfer is covered as described below, by the EU-U.S. Data Privacy Framework or by the Standard Contractual Clauses approved by the European Commission.
We do not sell personal data, and we do not share it with anyone else except when legally required.
- Cloudflare, Inc. (United States, with EU infrastructure) — hosts the website and delivers its content, including images and video (Cloudflare Images and Cloudflare Stream); keeps our website’s database with the messages sent through the contact form and our visit statistics; checks with Cloudflare Turnstile that the form is sent by a person; runs the automated spam filter (Cloudflare Workers AI); and runs the server that reports contact requests to Meta and Reddit. Transfers are covered by the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.
- Formspree, Inc. (United States) — delivers to our inbox the messages sent through the contact form that pass the spam filter. Transfers are covered by the EU Standard Contractual Clauses.
- Google Ireland Limited and Google LLC (United States) — serve the website’s fonts (Google Fonts) and the videos and preview images embedded from YouTube, and receive your IP address and browser details when they load. Watching an embedded video is subject to Google’s privacy policy. Transfers to Google LLC are covered by the EU-U.S. Data Privacy Framework.
- Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland) — only with your consent, receives through the Meta Pixel and its Conversions API the advertising data described in section 2. For this measurement Meta acts as joint controller with us under its Controller Addendum. Meta may transfer data to Meta Platforms, Inc. in the United States; these transfers are covered by the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.
- Reddit, Inc. (United States) — only with your consent, receives through the Reddit Pixel and its Conversions API the advertising data described in section 2. Transfers to the United States are covered by the EU Standard Contractual Clauses.
4. How long we keep your data
Messages received through the contact form are kept in our website’s database and in our inbox for as long as needed to handle your inquiry and any resulting business relationship, and afterwards only for the periods required to meet legal obligations; you can ask us to delete them earlier. Messages set aside as spam are deleted automatically 30 days after being set aside. Formspree keeps its copy of each delivered message for up to 30 days.
Our visit statistics are kept for as long as they are useful to compare how the website performs over time. They contain no name, email address or IP address.
The data used by Cloudflare Turnstile and by our server to report contact requests to Meta and Reddit is used only at that moment and is not kept by us. Technical logs are kept by our providers for short periods for security purposes.
In your browser, your cookie choice is kept for up to 12 months, the campaign that brought you here for up to 90 days (only if you accept advertising cookies), and the identifiers of our visit statistics until you close the tab (see section 6). Meta, Reddit and Google keep the data they receive according to their own privacy policies.
5. Your rights
Under the GDPR you have the right to access, rectify and erase your data, to restrict its processing, to object to it (including to our visit statistics and to any processing based on our legitimate interest), to data portability, and to withdraw your consent at any time without affecting the processing carried out before. To exercise any of these rights, write to contact@naolito.com indicating the right you wish to exercise. We may ask you to verify your identity, and we will answer within one month.
If you believe your rights have not been respected, you can lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD), at www.aepd.es or at C/ Jorge Juan 6, 28001 Madrid, Spain.
6. Cookies and browser storage
Without your consent. We only use what is needed to run the website and our own visit statistics, which use no cookies. Our hosting provider may set technical cookies for security purposes. These items do not require consent, and they are listed at the end of this section together with the advertising ones.
Advertising, only with your consent. Nothing is loaded before you choose, and rejecting is as easy as accepting. If you accept advertising cookies, the Meta Pixel and the Reddit Pixel set the cookies listed below, and we remember the campaign that brought you here.
You can change or withdraw your consent at any time from the “Cookie settings” link at the bottom of every page. When you withdraw it, the pixels and our server stop sending data, and we delete the pixel cookies on this site and the stored campaign. You can also delete cookies and site data from your browser settings.
Embedded YouTube videos, including those that start automatically, may store data in your browser under Google’s own policies. Google Fonts does not set cookies.
- site_cookie_consent (local storage, necessary) — remembers your cookie choice for up to 12 months, after which we ask again; we also ask again if we add or remove an advertising technology.
- naolito-theme (local storage, necessary) — remembers the light or dark display of the website until you clear it.
- naolito-metrics-session and naolito-metrics-utm (session storage, our visit statistics) — keep the random identifier of your browser tab and the campaign of your visit. Your browser deletes them when you close the tab.
- _fbp (Meta Pixel, set on this site, only with consent) — identifies your browser to measure our ads on Facebook and Instagram. Expires after 90 days.
- _fbc (Meta Pixel, set on this site, only with consent) — stores the ad click identifier (fbclid) when you arrive from a Meta ad. Expires after 90 days.
- _rdt_uuid (Reddit Pixel, set on this site, only with consent) — identifies your browser to measure our ads on Reddit. Expires after 90 days.
- _rdt_cid (Reddit Pixel, set on this site, only with consent) — stores the ad click identifier (rdt_cid) when you arrive from a Reddit ad. Its duration is set by Reddit.
- _rdt_em (Reddit Pixel, set on this site by some versions of its script, only with consent) — used by Reddit to match conversions. This site does not give your email address to the pixel. Its duration is set by Reddit.
- site_ad_campaign (local storage, only with consent) — remembers the campaign that brought you here (utm parameters, fbclid, rdt_cid) so that a later contact request is attributed to it. Kept for up to 90 days.
- Meta and Reddit may also set or read cookies on their own domains under their own cookie policies.
7. Changes to this policy
We may update this policy to reflect changes in the website or in legal requirements. The date at the top indicates the latest revision.