Legal · Effective from 27 May 2026

Privacy Policy

Last updated: 27 May 2026 · GDPR & LOPDGDD compliant

This Privacy Policy explains how Trenzados y Laminados San Martín, S.L. ("San Martín", "we") collects, uses, stores and shares personal data when you use the platform at tlsanmartin.com ("Platform"). It is written for transparency under the EU General Data Protection Regulation (GDPR), Spain's Organic Law 3/2018 on Data Protection (LOPDGDD) and the ePrivacy Directive.

01Data controller

The data controller for personal data processed via the Platform is:

Trenzados y Laminados San Martín, S.L.
CIF: B53044061
Calle Italia, Polígono Industrial Campo Alto 56
03600 Elda, Alicante (Spain)
Phone: +34 966 950 481
Privacy contact: jorge@tlsanmartin.com

02What data we collect & why

Category	Examples	Purpose	Legal basis
Identity & contact	Name, email, phone, company name, VAT number, country, role	Account creation, sample shipping, B2B verification	Contract performance (Art. 6.1.b GDPR)
Shipping address	Street, ZIP, city, state, country	Ship physical samples and catalogues	Contract performance
Billing	Card last 4 digits + Stripe customer ID. Full card data never reaches our servers.	Studio Pro subscription	Contract + legal obligation (invoice retention)
Activity & engagement	Downloads, sample requests, favorites, AI generations performed	Service operation, gamification (SM tokens), product improvement	Legitimate interest (Art. 6.1.f GDPR)
AI inputs	Images, sketches and briefs you upload to Atelier Vision	Producing AI Outputs you requested + service security	Contract performance + consent (where applicable)
Technical & device	IP address, browser, language, OS, referrer URL, anonymous error logs	Security, fraud prevention, debugging	Legitimate interest
Communications	Emails you send us, chatbot conversations, support tickets	Respond to inquiries	Legitimate interest
Marketing preferences	Newsletter opt-in, trend report opt-in, promotional opt-in	Send only what you've asked for	Consent (Art. 6.1.a GDPR)

03Local storage on your device

To deliver the Platform without a heavy backend, we use browser localStorage and sessionStorage to keep your profile, favorites, basket, SM token balance, AI usage counters and subscription state. This data lives on your own device and is sent to our servers only when you explicitly trigger an action (sample request, catalog request, signup, etc.). Clearing your browser data clears this state permanently and is not recoverable by us.

04Who receives your data

We share personal data only with carefully selected processors, bound by Data Processing Agreements (DPAs) under Article 28 GDPR:

Stripe Payments Europe, Limited (Ireland) — payment processing for Studio Pro. Stripe is PCI-DSS Level 1 certified.
Google Ireland Limited / Google LLC — Atelier Vision uses the Gemini AI family for image-generation inference. AI inputs (images, prompts) are transmitted to Google for the sole purpose of returning the AI Output. Google's processing is governed by their Privacy Policy and Generative AI Additional Terms.
IONOS SE (Germany) — hosting of the Platform website and email infrastructure.
Mailgun Technologies, Inc. (United States, Standard Contractual Clauses signed) — transactional email delivery (welcome emails, sample-shipped notifications, password resets).
Sales agents and resellers — only where you explicitly indicate interest in a territorial partnership; otherwise your contact details are not shared with them.

We do not sell personal data. We do not run third-party ad networks that profile users on our Platform.

05International transfers

Some of our processors (Google, Mailgun, Stripe) operate infrastructure outside the European Economic Area. Such transfers rely on Standard Contractual Clauses (2021/914 EU), the EU-U.S. Data Privacy Framework (for U.S. recipients), and supplementary measures (encryption in transit and at rest). You may request a copy of the relevant safeguards by emailing the privacy contact above.

06How long we keep your data

Account data: for the duration of your Account, plus 12 months after closure to facilitate reactivation.
Invoices & tax records: 6 years from issuance (Spanish General Tax Act, Art. 66 LGT).
AI inputs: 30 days from generation, then deleted from our servers. The corresponding AI Outputs you save to your boards are retained for the life of your Account.
Marketing preferences: until you withdraw consent.
Security logs: 12 months.

07Your rights under GDPR

You may exercise the following rights at any time by emailing jorge@tlsanmartin.com with proof of identity:

Right of access — receive a copy of the personal data we hold about you.
Right to rectification — correct inaccurate or incomplete data.
Right to erasure ("right to be forgotten") — request deletion subject to legal retention rules.
Right to restriction of processing — limit how we use your data while a complaint is reviewed.
Right to data portability — receive your data in a structured, machine-readable format.
Right to object — object to processing based on legitimate interest, including direct marketing.
Right to withdraw consent — at any time, with no effect on lawful prior processing.
Right to lodge a complaint with the Spanish data-protection authority (AEPD, aepd.es).

We will respond to requests within 30 days, extensible to 60 days for complex cases (with notice).

08Security measures

We apply technical and organisational measures appropriate to the risk: TLS encryption in transit, password hashing, role-based access controls, intrusion logging, periodic backups, restricted admin access via HTTP Basic Auth + JS gate, no plaintext credentials in source, and quarterly security review of third-party processors. No system is 100% impenetrable; in the event of a personal-data breach we will notify affected Users and the AEPD within 72 hours, as required by Art. 33 GDPR.

09Children

The Platform is not intended for individuals under 16. We do not knowingly collect data from minors. If we become aware that we hold data on a minor without parental consent, we will delete it promptly.

10Automated decisions & profiling

The Platform performs lightweight scoring of accounts (verified vs. unverified B2B; basic gamification metrics). These do not produce legal effects nor significantly affect you, and no fully automated decision-making in the sense of Art. 22 GDPR takes place. You can always escalate to a human (Jorge San Martín) by writing to the privacy contact.

11Changes to this policy

Material changes will be announced on the Platform and emailed to Account holders at least 14 days before they take effect. The current version is always at this URL.