Privacy Policy

Who we are

Sosta Studio, a Mota Media company based in Barcelona, Spain, is responsible for the personal data processed through sostastudio.com (the “Website”). You can reach us about anything in this policy through our contact page.

What we collect

• AI Visibility Report requests: the website address and email address you enter. To apply the daily limit on free reports, we also keep a one-way, salted hash of your IP address, never the address itself.
• Your report: what the report finds about the restaurant or hotel, drawn from its public website, public guides and listings, and the answers of ChatGPT, Gemini and Claude.
• Contact form: your name, email address, restaurant or hotel (if you give it) and your message.
• Usage data: pages visited, referring site, device and browser type, and approximate location, through Google Analytics. Cookies are only used for this if you accept them; see our Cookie Policy.
• Technical data: like any website, our hosting provider records server logs (including IP addresses) to deliver and secure the Website, and a bot check reads signals from your browser when you request a report.

We do not collect sensitive personal data or financial information, and the Website is not directed at children.

How we use it, and on what basis

• To prepare your report and email you its link, and to answer your messages: to take the steps you ask for (Article 6(1)(b) GDPR).
• To limit free reports and keep the Website secure from abuse: our legitimate interest (Article 6(1)(f)).
• To understand how the Website is used and improve it: your consent for analytics cookies (Article 6(1)(a)), which you can withdraw at any time on the Cookie Policy page.

We email you about the report you requested and reply when you write to us. We don’t send newsletters, and we never sell your data.

Who we share it with

Service providers that process data on our behalf, under contracts that oblige them to protect it:

• Vercel: hosting, bot protection and server logs.
• Supabase: the database where requests and reports are stored.
• Resend: sending email.
• Anthropic (Claude), OpenAI (ChatGPT) and Google (Gemini): they receive the venue’s website address and public information about it, and the questions we ask, to produce the report. They do not receive your email address.
• Google Analytics: usage statistics, as described above.

Some of these providers are based in the United States. Transfers rely on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

How long we keep it

Report requests and reports: up to 24 months, so a new report can be compared with earlier ones. Contact messages: as long as needed to deal with your enquiry. Analytics data: 14 months. Cookies: as set out in our Cookie Policy.

Your rights

You can ask to access, correct or erase your personal data, to restrict or object to its processing, and to receive it in a portable format. Write to us through our contact page. You can also complain to the Spanish Data Protection Agency (AEPD) at www.aepd.es.

Changes to this policy

We may update this policy. Changes are posted on this page with a new effective date.