Privacy Policy

Last updated: 28 October 2026

This policy explains how Mainifesto handles personal data when you read mainifesto.com, send an enquiry, subscribe to the newsletter, comment on an article or interact with embedded content. It also explains your choices about cookies and how advertising data would be handled if advertising is activated.

At a glance: you can read our articles without subscribing; submitting a contact enquiry does not subscribe you to marketing emails; optional analytics is subject to your cookie choices; and you can withdraw consent or ask us about your data. As of the date above, Google AdSense advertising is not active on this website.

1. Who is responsible for your data?

The data controller is Francesc Gasch Garcia, trading as Mainifesto, Almirall Pròixida 1, 2nd floor, door 15, Barcelona, Spain.

For privacy enquiries or to exercise your rights, use our contact form and select “Privacy or personal-data request”. You may also write directly to info@francescgaschstudio.com or contact us at the postal address above. The form routes privacy requests to the responsible contact; you do not have to subscribe or accept optional cookies to make a request.

2. What data do we use, and why?

We obtain information directly from you when you submit it, automatically from your browser and our server when you access the website, and from service providers when they deliver the functions described below. We apply the EU General Data Protection Regulation (GDPR) and applicable Spanish data-protection and electronic-communications legislation.

• Enquiries, corrections and collaboration proposals: name, email address, topic, optional article URL, message and subsequent correspondence. We use these to respond and manage the matter raised. The basis is our legitimate interest in communicating with readers and maintaining the publication (Article 6(1)(f) GDPR); where an enquiry concerns entering into a contract, steps requested before a contract may apply (Article 6(1)(b)).
• Privacy-rights requests: contact details, the request and proportionate identity-verification information if needed. We use these to fulfil our legal obligations (Article 6(1)(c)).
• Newsletter subscriptions: email address, optional name, subscription source, confirmation token, subscription status and relevant dates. The basis for sending the newsletter is your consent (Article 6(1)(a)).
• Reader comments: the submitted comment, display name, email, optional website, IP address and browser information. We use these to publish and moderate discussion and prevent abuse, relying on our legitimate interests (Article 6(1)(f)). Optional device storage remains subject to the relevant cookie rules.
• Website delivery, security and abuse prevention: requested URLs, IP address, timestamps, response codes, browser/user-agent details and referring URLs where supplied. Our legitimate interests are operating the website, diagnosing faults and protecting readers and systems (Article 6(1)(f)). We also process records when legally required (Article 6(1)(c)).
• Cookie preferences: consent choices and associated technical records, to remember and honour your choices and demonstrate compliance. The basis is our legal obligations and legitimate interest in administering those choices, as applicable.
• Optional analytics and external services: browsing events, device/browser information, approximate location and online identifiers, depending on the service and your choices. Optional analytics storage and associated measurement rely on consent (Article 6(1)(a)). Future personalised advertising is described separately below.

Required form fields are marked. Without the necessary contact details and message, we cannot respond through the form; without an email address, we cannot provide a subscription. Please do not send identity documents, passwords, payment information or sensitive personal data unless we specifically request information that is necessary and explain why.

3. Contact forms and newsletters

The contact form uses Contact Form 7 within our WordPress installation. Messages are sent through our server’s email system to the appropriate Mainifesto contact. The form does not create a separate message archive in the WordPress database; email copies and server delivery logs may nevertheless be retained. Sending a message does not add you to the newsletter.

To reduce automated spam, the form includes a hidden trap field and a submission limit. The limit uses a salted cryptographic digest of the IP address, held in a temporary record for up to one hour. This does not replace the separate technical logs kept by the server.

Newsletter registration uses double opt-in: we send a confirmation link and activate the subscription after confirmation. Subscription details are held in our website database, and Resend processes the recipient address and email content to deliver confirmation messages and newsletters. Service delivery and diagnostic records may also be processed by the email provider.

You can unsubscribe through the link in a newsletter or by contacting us. Unsubscribing stops newsletter delivery; a limited status record may remain to honour the unsubscribe and document the subscription history. You can also request erasure, subject to applicable exceptions.

4. Public comments and profile images

Where reader comments are enabled, your comment, chosen display name and any website link you supply may be public. Your email address is not displayed as part of the comment. Please avoid including information you do not want published. Public contributions may be indexed by search engines or copied by others.

Comments are subject to moderation and anti-spam checks. Where a Gravatar profile image is requested, a hash derived from the commenter’s email address may be sent to Automattic’s Gravatar service. A hash is not a guarantee of anonymity, and loading an external image also involves a connection to its provider. See Automattic’s privacy notice for visitors.

5. Cookies, consent and Google Analytics

We use Complianz to present cookie choices. Essential technologies support functions such as security and remembering your choices. Optional statistics and marketing categories can be accepted or rejected through the banner. You can reopen “Manage consent” on the website to change your choices; withdrawing consent does not affect processing that was lawful before withdrawal.

Google Analytics 4 is used to understand readership, referring traffic, article engagement and errors such as missing pages. The current setup loads Analytics after acceptance of the statistics category. Depending on your browser and choices, Google receives usage events, page addresses, device and browser details, identifiers and network information used to provide the service. We use reports to improve the publication, not to identify readers by name. Contact-form message contents and email addresses are not intentionally sent to Analytics.

For service and cookie details, including recorded expiry information, see our Cookie Policy. You can also manage cookies in your browser; blocking essential storage may affect some functions. Google explains its processing in Google’s Privacy Policy and how Google uses information from partner sites. Google also offers an Analytics opt-out browser add-on.

6. Google AdSense and advertising choices

Current status: Google AdSense ad requests remain paused as of this policy’s update date. The Google AdSense script is loaded to connect the website for verification and review. Loading it connects your browser to Google and transmits technical information such as your IP address and browser details, even before you make a cookie choice. Existing cookies on Google’s domains may be read; Google’s documented pause mechanism prevents ad requests and does not set new advertising cookies. Loading this script is not equivalent to enabling personalised advertising. The following explains the additional processing that would apply if advertising is enabled.

If activated, third-party advertising providers, including Google and participating advertising partners, may use cookies, web beacons, local storage, IP addresses and other online identifiers to deliver, measure and report ads, limit repeated ads and combat fraud. Google and its partners may use advertising cookies to show personalised ads based on previous visits to this website and other websites or apps.

Where legally required, optional advertising storage and personalisation require consent. For personalised ads in the European Economic Area, the United Kingdom and Switzerland, activation also requires a Google-certified consent management platform integrated with the IAB Transparency and Consent Framework. A general cookie banner alone does not establish that this requirement has been met. Before activation, the consent interface must identify the participating providers, purposes and relevant privacy information and allow the required choices.

You can manage personalised Google advertising in My Ad Center. For participating third-party providers, additional choices may be available through Your Online Choices or the Digital Advertising Alliance’s opt-out tool. These tools have their own scope and may depend on your browser or device; they do not replace the choices on this website. Opting out of personalisation does not necessarily remove all advertising. Non-personalised advertising can still involve personal data or storage and must meet the requirements applicable to its configuration.

See Google’s advertising technology information and its Privacy Policy. We do not sell our subscriber list or contact correspondence to advertisers.

7. Who receives data? Are there international transfers?

Access is limited to the people and providers needed for the relevant purpose, including authorised editorial or technical personnel, hosting and email infrastructure providers, security and maintenance providers, Resend for email delivery, Google for consented Analytics and YouTube, and advertising providers only if advertising is activated. Authorities or professional advisers may receive information where required by law or necessary to establish, exercise or defend legal claims.

Providers processing data on our behalf act as processors under the applicable arrangements. Some services, including Google, YouTube and Gravatar, may also process information for their own purposes under their privacy notices. Installing WordPress or Contact Form 7 does not itself mean that form messages are sent to those software developers.

Some providers or their support operations may process data outside the EEA, including in the United States. Such transfers must be covered by an applicable GDPR mechanism, such as an adequacy decision where it applies to the recipient, or the European Commission’s Standard Contractual Clauses with any necessary supplementary safeguards. You may contact us to request information about the recipients and transfer safeguards relevant to your data, including a copy or explanation of applicable safeguards subject to lawful redactions. See also Resend’s Privacy Policy.

8. YouTube, external links and social platforms

Articles may include YouTube videos using the privacy-enhanced youtube-nocookie.com player. External content is subject to the website’s applicable consent controls. Privacy-enhanced mode does not make a connection anonymous: when the player loads or you interact with it, YouTube may receive your IP address, browser/device details and interaction information, and may use storage or associate activity with an account according to its settings and policies.

Links to YouTube, Instagram, Facebook, Pinterest and other websites take you to services with their own privacy policies. An ordinary external link does not by itself subscribe you or send the contents of your enquiry. Once you follow a link or load an embed, the destination controls its own processing. Google’s privacy information linked above also covers YouTube.

9. How long do we keep information?

Retention depends on the purpose and the relevant system; one fixed period would not accurately describe all the information we handle. We use the following criteria:

• Enquiries and privacy requests: for managing the request and follow-up, and afterwards only where needed to document its handling, comply with obligations or resolve potential disputes within the applicable limitation periods.
• Subscriptions: active details while you remain subscribed. Unconfirmed subscriptions are subject to cleanup; unsubscribe records may be retained to prevent unwanted re-enrolment and document consent or withdrawal.
• Comments: while the contribution remains relevant to the discussion or publication, subject to moderation, valid erasure requests and applicable legal or editorial exceptions.
• Technical and delivery logs: according to the hosting or provider’s rotation and retention settings and the time needed to investigate failures or abuse. Relevant records may be preserved longer for an incident or legal claim. The contact form’s separate rate-limit record expires within one hour.
• Cookie and Analytics records: according to cookie expiry and service retention settings, your consent choices and any required compliance records. Cookie lifetime and server-side data retention are not necessarily the same.
• Backups: data may remain in restricted backup copies until they are replaced under the backup cycle. A deletion request does not mean every historical backup can be edited immediately; any restoration must take account of the request.

You can ask us for the retention information relevant to a particular request or dataset. Where information is no longer needed, it should be deleted or irreversibly anonymised; information required for legal claims or obligations is restricted to those purposes.

10. Your rights and how to exercise them

Subject to the conditions and exceptions in applicable law, you can request access to your personal data, correction of inaccurate data, erasure, restriction of processing and portability where the processing is based on consent or a contract and carried out by automated means. You can object to processing based on legitimate interests, explaining your particular situation, and object to direct marketing at any time. You may withdraw consent at any time without affecting earlier lawful processing.

Use the privacy option in our contact form or the privacy email or postal address in section 1. Explain your request and the email address or other details needed to locate the relevant information. If there are reasonable doubts about identity, we may ask for proportionate additional information; please do not send an identity document routinely.

We respond without undue delay and normally within one month of receiving a request. Where legally permitted because of complexity or the number of requests, this may be extended by up to two further months; we will explain the extension within the initial month. Requests are generally free, subject to the GDPR rules on manifestly unfounded or excessive requests.

You may complain to the Spanish Data Protection Agency (AEPD) or the competent supervisory authority in your place of residence, work or alleged infringement. You do not have to contact us before exercising that right.

11. Security, children and automated processing

We use measures appropriate to the website and risks, including HTTPS, access restrictions, software maintenance and anti-abuse controls. No online system can guarantee absolute security. Please avoid submitting unnecessary personal information.

Mainifesto is a general-interest design publication, not a service directed at children. We do not knowingly seek children’s personal data or offer advertising specifically aimed at them. If you believe a child has supplied information inappropriately, contact us so we can assess and address it.

We do not use visitor data to make solely automated decisions producing legal or similarly significant effects. Automated anti-spam controls can block submissions; if a legitimate enquiry is blocked, the privacy email and postal contact remain available. If personalised advertising is later enabled, it may involve interest-based profiling as described in section 6, subject to the required choices.

12. Updates to this policy

We update this policy when the website’s features, providers or relevant requirements change. The revision date appears at the top. Where a change requires new information or consent, publishing an updated policy does not replace those requirements. This policy should be read alongside our Cookie Policy and Editorial & AI Policy.