Skip to content

Privacy policy

Last updated: July 22, 2026

This policy explains what personal data we process at Llar, for what purpose, for how long, and what rights you can exercise. Llar is a multi-space platform where artists and organisations publish their content, send newsletters and receive support payments.

Llar is a project in the process of incorporating as a cooperative. Until its registration is complete, the person identified below acts as the operator and controller of this site; this information will be updated once the entity is incorporated.

Data controller

  • Operator: Eevee Zayas Garín
  • Tax ID (NIF): 48676228V
  • Registered address: Carrer del Duc de Calàbria 14 València 46005 España
  • Email: info@llar.art

What data we process

  • Account data: name, email address, password (stored encrypted), profile image and, if you enable it, your two-factor authentication settings.
  • Newsletter: email address, preferred language, subscription status and your consent record (date and version of the text you agreed to).
  • Contact form: name, email and any other details you choose to include in your message (phone, company, dates, location).
  • Payments and donations: amount, date, status of the transaction and the associated email address. Your full card details are handled exclusively by Stripe; they never reach our servers.
  • Published content: the texts, images and media files that the people managing a space upload to the platform.
  • Technical data: session and preference cookies strictly necessary for the site to work.

Purposes and legal basis

We do not make automated decisions with legal effects about you, nor do we build profiles.

  • Managing your account and providing the service: performance of a contract (Art. 6(1)(b) GDPR).
  • Sending you the newsletter you subscribed to: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
  • Responding to your contact messages: your consent and, where applicable, pre-contractual measures.
  • Processing payments, donations and support subscriptions: performance of a contract (Art. 6(1)(b) GDPR) and compliance with legal, accounting and tax obligations (Art. 6(1)(c) GDPR).
  • Keeping the service secure and preventing abuse: legitimate interest (Art. 6(1)(f) GDPR).

Minimum age

The service is not aimed at children under 14. In line with Article 7 of the Spanish LOPDGDD, we do not create accounts or accept subscriptions for children under that age without the consent of their parents or legal guardians.

Newsletter: double opt-in

A newsletter subscription only becomes active once you confirm the link we send you by email. Together with your consent we store the date and the exact version of the text you agreed to, so we can demonstrate what you authorised and when.

Every newsletter email includes an unsubscribe link. If you unsubscribe, we stop sending you the newsletter immediately and keep only the minimal record needed to honour your decision.

Payments

Payments, donations and support subscriptions are processed by Stripe, on its own secure pages. Stripe acts as payment service provider and handles your card details under its own privacy policy; we only receive and keep the transaction record (amount, date, status and email address) for the legally required accounting and tax periods.

Data retention

We keep your account data while your account is active and, after it is closed, only for the legally required periods. Newsletter data is kept until you unsubscribe; contact messages for as long as needed to handle your inquiry; and payment records for the legally required accounting and tax periods.

Recipients and processors

We do not sell your data or share it with third parties for commercial purposes. To provide the service we rely on providers acting as data processors or joint controllers:

  • Email delivery: Resend, Inc. (United States), for transactional email and the newsletter.
  • Payments: Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (United States), to process payments and, where applicable, transfer them to space accounts (Stripe Connect).
  • File storage: Hetzner Online GmbH (Alemania), where uploaded images and media files are stored.
  • Hosting: Hetzner Online GmbH (Alemania), where the application and its database run.

International transfers

Some providers (such as Resend or Stripe) are located in or process data in the United States. These transfers rely on the EU-U.S. Data Privacy Framework adequacy decision where the provider is certified and, otherwise, on the standard contractual clauses approved by the European Commission or other equivalent safeguards.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, as well as withdraw your consent, at any time by writing to info@llar.art. You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

Cookies

We only use technical cookies, exempt from consent under Spanish AEPD guidance: the session cookie that keeps you signed in (including, if you enable it, the two-factor authentication cookie), the one that remembers your preferred language and, in the admin area, the one that remembers the sidebar state. We do not use analytics, advertising or third-party tracking cookies.

Changes to this policy

If we change this policy, we will publish the updated version here and indicate the date of the last revision. When a change affects newsletter consent, we will also update the consent text version we record with each subscription.

esenca