1. Thirty-second summary
- This website uses no cookies, no analytics and no third-party scripts. You can read it without anything being collected about you.
- If you email or call me, I use your data only to reply and, if we work together, to provide and invoice the service.
- The client panel (panel.soydavid.es) may ask for read-only access to your Google Analytics and Google Search Console. That data is used only to show you your reports. It is not sold, not used for advertising, not used to train AI models and not shared except as strictly needed to provide the report.
- You can revoke access at any time at myaccount.google.com/permissions and ask me to delete your data at hola@soydavid.es.
2. Data controller
| Controller | David García Martínez (self-employed professional, Spain) |
|---|---|
| Tax ID (NIF) | 48637127Q |
| Address | Plaza de las Flores, 2, 2.º E, 30820 Alcantarilla, Murcia (España) |
| hola@soydavid.es | |
| Phone | +34 649 517 104 |
Given the type and volume of processing, I am not required to appoint a Data Protection Officer. I handle any privacy request personally at the email above.
3. Scope
- The website soydavid.es (Spanish and English).
- The client panel panel.soydavid.es, where each client views the SEO and GEO reports of their project.
- The consulting services (SEO, GEO, AI automation and training) I provide.
Other websites of mine, such as iaquetrabaja.com and academy.iaquetrabaja.com, have their own privacy policies.
4. If you just browse soydavid.es
- It sets no cookies of any kind (see the cookie policy).
- It uses no analytics, advertising pixels, heatmaps, embedded videos or tracking social buttons.
- Fonts and all assets are served from this server, so your browser does not contact third parties.
- There are no forms: contact happens by email or phone.
To deliver a page, the server necessarily receives your IP address and the technical data any browser sends. It is used only to deliver the page at that moment. The soydavid.es web server is configured without access logs, so this information is not stored. Legal basis: legitimate interest in serving the website securely (Art. 6(1)(f) GDPR).
5. If you email or call me
| Data | Whatever you give me: name, email, phone, company and what you tell me about your case. |
|---|---|
| Purpose | To reply, study your case and, if you ask, send you a proposal or quote. |
| Legal basis | Pre-contractual steps at your request (Art. 6(1)(b) GDPR) and, for general enquiries, legitimate interest in replying (Art. 6(1)(f)). |
| Retention | While the conversation lasts and, if we do not end up working together, up to 12 months after the last contact. Then it is deleted. |
I will not add you to mailing lists or automated sales sequences.
6. If you are a client
| Data | Identification and contact data of the client and their contacts, billing and payment data, and project information you provide (access, documents, data about your website or tools). |
|---|---|
| Purpose | To provide the contracted service, communicate during the project, issue invoices and meet tax and accounting obligations. |
| Legal basis | Performance of the contract (Art. 6(1)(b) GDPR) and legal obligations (Art. 6(1)(c)). |
| Retention | For the duration of the relationship and then for the periods required by Spanish commercial and tax law (generally six years for accounting records and four years for tax purposes) and limitation periods for possible liabilities. |
Where a project requires me to process personal data for which you are the controller (for example, your customers' data in an automation), I act as a processor and we sign the data processing agreement required by Article 28 GDPR.
7. The client panel (panel.soydavid.es)
The panel is a private web application, accessed with a username and password, where each client views the reports of their project (Google rankings, traffic, visibility in AI search engines and technical health) and can leave questions or comments.
| Account data | Username or email, name (optional), password stored only as a hash (never in plain text), creation date, last login date and the projects you can access. |
|---|---|
| Content you add | Questions, replies and comments you write, with their date and author. |
| Panel cookies | One technical session cookie, strictly necessary to keep you signed in (lasts up to 14 days; HttpOnly, Secure, SameSite=Lax), which includes an anti-CSRF token. No analytics or advertising cookies. |
| Purpose | To give you access to your reports, store your questions and keep the service secure. |
| Legal basis | Performance of the services contract (Art. 6(1)(b) GDPR). |
| Retention | While your account is active. When the service ends, the account and its content are deleted within 30 days, except what must be kept by law. |
8. Google user data (Google Analytics and Google Search Console)
This section explains how panel.soydavid.es uses information received from Google APIs.
8.1. Permissions requested
With your explicit authorisation, through Google's consent screen (OAuth 2.0), the application panel.soydavid.es requests only these two scopes, both read-only:
| Scope | Purpose |
|---|---|
https://www.googleapis.com/auth/analytics.readonly | Read reports from your Google Analytics 4 property: aggregated sessions, users, purchases and revenue, channels and traffic sources (including visits from ChatGPT, Gemini, Perplexity or Copilot), landing pages and countries. |
https://www.googleapis.com/auth/webmasters.readonly | Read your Google Search Console performance data: search queries, pages, clicks, impressions, CTR and average position. |
These are read-only scopes: the application cannot modify, create or delete anything in your Google Analytics or Search Console, and it does not request access to Gmail, Drive, contacts or any other Google service. These APIs return aggregated statistics about your website; they do not identify your website's visitors individually.
8.2. How the data is used (and how it is not)
Data obtained from Google APIs is used exclusively to generate and display the panel reports to the account owner who authorised it and to the people that owner designates (for example, team members with a panel account), and so that I, as the hired consultant, can analyse it and recommend improvements within the service you contracted.
In particular, information received from Google APIs:
- Is not sold.
- Is not used for advertising: not to serve ads, build advertising profiles, retarget, or serve personalised or interest-based ads.
- Is not used to develop, improve or train artificial intelligence or machine learning models, ours or anyone else's, and is not sent to third-party AI services.
- Is not used to determine creditworthiness or for lending purposes.
- Is not shared with third parties, except in the strictly necessary cases listed in section 8.4.
- Is not combined with other clients' data or used for any purpose other than your own project's report.
8.3. Compliance with the Google API Services User Data Policy
panel.soydavid.es's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In line with those requirements, no human reads your Google data except: (a) with your affirmative agreement, as with my analysis of your reports as part of the service you hire me for; (b) when necessary for security purposes, such as investigating abuse or a bug; (c) to comply with applicable law; or (d) when the data has been aggregated and anonymised for internal operations.
8.4. Who it is shared with
- You and whoever you authorise in the panel.
- Hosting provider: Hetzner Online GmbH (Germany), on whose servers in the European Union (Helsinki, Finland) the panel runs. It acts as a processor and does not access the data for its own purposes.
- Authorities, only where required by law or court order.
- If the business were ever transferred (for example, sold), I would notify you beforehand; the data would remain protected by this policy or be deleted if you disagree.
8.5. How it is stored
- The Google authorisation (access and refresh token) is stored on the panel server, in a directory outside the public area with access restricted to the administrator. It is never shown in the panel or sent by email.
- Report data downloaded from Google is stored on the same server, separated by project, and shown only to users with access to that project.
- All communications are encrypted (HTTPS/TLS), between your browser and the panel and between the panel and Google.
8.6. Retention
- While the service is active, the history needed to show trends in the report (weekly and period comparisons) is kept.
- If you revoke access, end the service or ask for deletion, I delete the Google authorisation and the data obtained from Google APIs within 30 days at most. Any backups containing it are overwritten within the same period.
8.7. How to revoke access
- Go to myaccount.google.com/permissions with the Google account that granted access.
- Find the panel application (panel.soydavid.es) among the third-party apps with access to your account.
- Click Remove access. From then on the panel can no longer read new data.
- If you also want me to delete what was already downloaded, email hola@soydavid.es with the subject "Google data deletion" and the project name. I will confirm the deletion in writing.
Revoking access changes nothing in your Google Analytics or Search Console; it only stops the panel from reading.
9. AI visibility measurements
As part of the GEO service, the panel periodically sends a set of generic questions (such as "what is the best shop for…?") to AI services such as Gemini (Google) and ChatGPT (OpenAI) through their APIs, and records which brands they recommend and which sources they cite. Those questions contain no personal data and no data from your Google Analytics or Search Console.
10. Providers involved
| Provider | Purpose | Where |
|---|---|---|
| Hetzner Online GmbH | Hosting of soydavid.es and the panel | European Union (Finland) |
| Email hosting provider for soydavid.es | Sending and receiving email | BanaHosting (external hosting and email provider). If its servers are outside the European Economic Area, the transfer relies on the safeguards provided for in the GDPR. |
| Google LLC / Google Ireland | Analytics and Search Console APIs (where your data is read from) and Gemini API (generic questions only) | EU / USA |
| OpenAI | ChatGPT API, generic questions only, no personal data | USA |
Where a provider is outside the European Economic Area, transfers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. No personal data is sent to OpenAI or the Gemini API.
11. Your rights
You may exercise, free of charge, your rights of access, rectification, erasure, objection, restriction, data portability and to withdraw consent at any time, by emailing hola@soydavid.es. If I have reasonable doubts about your identity I may ask you to confirm it. I will reply within one month, extendable by two further months for complex requests, as the GDPR provides.
I do not make decisions based solely on automated processing that produce legal effects on you.
You can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan 6, 28001 Madrid, www.aepd.es) or with the supervisory authority of your country of residence.
12. Security
I apply technical and organisational measures appropriate to the risk: HTTPS with HSTS on all sites, hashed passwords, CSRF protection in the panel, least privilege (read-only Google scopes), per-project data separation, restricted administrative access and server updates. In the event of a personal data breach, I would notify the AEPD and, where appropriate, you, within the legal deadlines.
13. Minors
My services are aimed at businesses, freelancers and adult professionals. I do not knowingly process data of children under 14; if I find out I have, I delete it.
14. Changes
If something relevant changes, I will update this page and the date above and, if it affects panel users, notify them before applying it. I will never extend the use of Google data beyond what is described here without first asking for new consent.
See also the terms of service, the legal notice and the cookie policy.