Privacy and cookies

In short

• Who is responsible: Maider García Llorente, who makes inklui. Contact: info@inklui.com.
• You do not need to give us any data to browse, we use no cookies of our own and we do not track you.
• What you type into the tools stays on your device and does not reach us, unless you upload it yourself (whiteboard with a code).
• We only keep your email if you sign up for the newsletter, and only to send it to you.
• You can ask at any time to see, correct or delete your data by writing to info@inklui.com.

1. Data controller

Maider García Llorente, owner of inklui.com. Email: info@inklui.com (subject “Data protection”).

2. What data we process and why

Newsletter. If you sign up, we keep your email, language, where you signed up, the date and the text you accepted. It is used to send you the newsletter (once a month). We do not keep your IP address.

Emails you send us. If you write to info@inklui.com, we use your email and what you tell us to reply to you.

Suggestions, comments and proposals. If you use the box at the foot of a page or the proposals form, we keep in our database what you write, the page you write from, the language and, if you give it, your email (required for proposals; optional for suggestions and comments), and we also get an email notice. It is used to read it and, if you left an email, to reply to you. We do not keep your IP address.

Whiteboard with a code (“Move to another device”). If you use it, the notebook (pages, drawings, text, images and lists you added) is stored in our database with a code. Anyone with the code can open it: do not share it with people who should not see it, and do not put photos or health data about children in it.

Visit statistics. We use Vercel Web Analytics, which counts visits without cookies and without identifying you. We get daily aggregate figures (page, country, referring site, device type and browser) and keep them in that aggregate form to learn which content is useful.

“It helped me” and links. If you press “It helped me” on a page, a profile, an article, a book or a resource, or a link to a resource or a download, we add one to a counter for that day and that page, profile, article, book, resource or link. We do not keep who pressed it. Your browser remembers that you already pressed “It helped me” (local storage, no cookies), so it is not counted twice. Next to the button we publicly show the accumulated total of people it has helped on that page: an aggregate, anonymous figure with no data about anyone, read from our database and refreshed at most once a minute. It is a thermometer, not an exact count: we do not identify anyone, so someone who presses it from two browsers counts twice.

Security. To prevent abuse of the newsletter, the whiteboard and the counters, your IP address is used as a counter for one hour at most; that counter is stored at Upstash (see section 6). In addition, the server hosting the site (Vercel) logs, like any server, technical data for each visit (IP, page and browser) to serve and protect it.

What stays on your device. The tools (schedules, social stories, logs, whiteboard, favourites…) keep what you type, the photos you add and voice recordings in your own browser. It does not reach us. If you share a social story, a file is downloaded to your device: you decide who gets it.

3. Third-party services that see your connection

Some parts of the site load content from other services. When they do, those services receive your IP address and act under their own privacy policy:

• ARASAAC (Government of Aragon): pictogram images load from its servers, and the words you type or dictate to search for pictograms are sent to it.
• YouTube (Google): the videos on the sign language page only load if you press them. When you do, YouTube may store its cookies in your browser.
• Speech recognition: in the voice pictotranslator, it is your browser that turns your voice into text, and it may send the audio to its maker (Google, Microsoft or Apple). inklui does not record or keep that audio.
• Supabase: some pages, such as the blog list, request their content directly from our database, which sees your IP.
• Library, “Read here”: for documents read inside inklui, our server requests the PDF from the site that publishes it and hands it to you; that site sees inklui, not your IP.
• External links: when you press a link you leave inklui and the other site’s policy applies. inklui does not use affiliate links.

4. Legal basis

• Newsletter: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
• Whiteboard with a code and replies to your emails and to your suggestions, comments and proposals: because you ask us to (Art. 6(1)(b) GDPR).
• Statistics and security: our legitimate interest in knowing which content is useful and in protecting the site (Art. 6(1)(f) GDPR). You can object by writing to us.

5. How long we keep data

• Newsletter: until you unsubscribe.
• Emails: as long as needed to reply and, afterwards, to handle any possible claims.
• Suggestions, comments and proposals: as long as needed to read them and, if you left an email, reply. You can ask us to delete them by writing to info@inklui.com.
• Whiteboard with a code: it is deleted automatically if nobody opens or saves it for 12 months. Before then, you can ask us to delete it by writing to info@inklui.com with the code.
• Security counter: one hour at most. Server technical logs: the period set by Vercel.
• What stays on your device: until you delete it.

6. Who helps us process data

We do not sell or pass on your data. These providers process it on our behalf and only to provide their service to us:

• Vercel Inc. (USA): hosts the site and counts visits. Safeguards: EU-US Data Privacy Framework and standard contractual clauses.
• Supabase Pte. Ltd. (Singapore): database (newsletter, whiteboards, suggestions and proposals box, and aggregate statistics). Safeguards: standard contractual clauses.
• Upstash Inc. (USA): stores the security counter against abuse (your IP for one hour at most). Safeguards: EU-US Data Privacy Framework and standard contractual clauses.
• IONOS (European Union): email for info@inklui.com, including notices of suggestions and proposals.

These are the safeguards the GDPR requires for processing data outside the European Economic Area: the EU-US Data Privacy Framework (a European Commission adequacy decision) and the standard contractual clauses approved by the Commission. If we use a service to send the newsletter in future, we will add it here before using it.

7. Children

inklui is designed for adults: families and professionals. The newsletter is for people aged 14 and over. Many tools let you type a child’s name or add their photo: that stays on your device and does not reach us. Do not put health data or photos of children on the whiteboard with a code.

8. Your rights

You can ask to access your data, correct it, delete it, restrict or object to its use, take it to another service and withdraw your consent. Write to info@inklui.com with the subject “Data protection”. We will reply within one month at most.

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

9. Cookies and storage in your browser

inklui uses no cookies of its own, no advertising cookies and nothing to follow you from site to site.

It does store in your browser (local storage and IndexedDB) your choices and what you do in the tools: theme, text size, favourites and your work (schedules, social stories with their photos and recordings, logs, whiteboard…). It is only used so that the site works as you ask, it is not sent anywhere and you can delete it whenever you like from your browser settings (“clear site data”). If you administer the site, the panel session is stored there too.

Vercel Web Analytics statistics use no cookies and do not identify you.

That is why we do not show you a banner to accept cookies: the law does not require consent for what is needed to provide the service you ask for, to remember your preferences or to measure visits without identifying you (Art. 22(2) of Spain’s LSSI and the Spanish Data Protection Agency’s cookie guide).

The only exception is YouTube videos: they do not load until you press them, and we tell you so next to them. If we ever use something that needs your permission, we will ask for it before using it.

10. Security

The site uses an encrypted connection (HTTPS) and security headers. The database only lets the administrator read newsletter emails, and the panel requires signing in. If a security breach affecting your data occurred, we would report it to the Spanish Data Protection Agency and, if there were a high risk, to you as well.

11. Reporting a security flaw

If you find a security flaw on inklui.com, write to info@inklui.com with the subject “[Seguridad]”: what you saw, the page address and, if you can, the steps to reproduce it. We acknowledge receipt within 5 working days, the same deadline as for corrections.

• Do not access other people’s data, do not modify or delete data and do not run tests that overload the service.
• Give us a reasonable time to fix it before disclosing it publicly.
• inklui is a one-person project and does not offer monetary rewards. Once it is fixed, we will tell you.

The security contact details are also in /.well-known/security.txt.

12. Changes

If what we do with data changes, we will update this page first. If the change affects newsletter subscribers, we will tell them.