Updated 11 October 2026.
1. Who is responsible
TheWhiteBoxCompany S.R.L. · VAT ID B70713003 · Calle Azofra 2, 5º 3ª, 28050 Madrid, Spain. Contact: nacho@thewhitebox.ai (also reachable at nacho@thewhiteboxcompany.org).
2. Advisory enquiries
The contact form collects your name, email address and message, plus optional company or role and engagement interests. These details are delivered through Google Workspace to Ignacio’s inbox to handle and reply to your enquiry. They are not used to sign you up to the newsletter. Please avoid sending unnecessary sensitive information.
Handling an enquiry about a possible service is necessary to take steps at your request before a contract; handling other correspondence relies on our legitimate interest in responding to people who contact us. We retain correspondence while dealing with the enquiry and any resulting relationship, and for applicable legal record-keeping or claims. You may ask us about the retention of your particular enquiry.
3. Newsletter sign-in and article access
When you request newsletter access, this website processes your email address, checks it against your Beehiiv subscription and sends a six-digit code through Google Workspace. The code is valid for 10 minutes from your request and is bound to the browser that requested it. Successful sign-in creates a session lasting up to 12 hours. Beehiiv remains the source of truth for active, free and tier-specific premium access. Your browser does not decide whether you are a paid subscriber.
We process this information to provide subscriber access you request and protect that service. No subscription or payment is created by requesting a code. Separately, when you submit our newsletter signup form with your consent, we send your email address and signup-source information to Beehiiv to register a free subscription. Beehiiv handles newsletter delivery, any confirmation or welcome email, unsubscribe requests and subscription management. You can withdraw newsletter consent using the unsubscribe link in newsletter emails. Optional premium payments remain with Beehiiv and the payment services identified at checkout. Our signup abuse records contain keyed email hashes, request identifiers, coarse outcomes and timestamps, rather than a plaintext subscriber profile.
4. Security and storage
The website runs on GoDaddy Node.js hosting in North America. Its MySQL security store contains keyed hashes of email and browser identifiers, code hashes, encrypted identity tokens, random request identifiers, timestamps and delivery outcomes. It does not store enquiry text or a plain-text subscriber profile in those security tables. Hashes and encrypted records are pseudonymous, not anonymous.
Login request records expire after twenty-four hours; sessions expire after 12 hours and are revoked on sign-out. Enquiry and newsletter-signup abuse and duplicate-prevention records expire after seven days. Expired records are deleted during subsequent relevant operations, so physical deletion may occur later during inactivity. Email messages remain in the Google Workspace mailbox under the correspondence retention described above. Hosting operational logs and provider backups have separate provider-managed retention; contact us for current details.
Cached article bodies are encrypted on the server and refreshed in the background. Before releasing subscriber content the server verifies the session and obtains current membership from Beehiiv. Browser cookies and theme preferences are described in the cookie policy.
5. Providers and international processing
GoDaddy hosts the website and security database; Google Workspace sends login codes and delivers enquiries; Beehiiv manages the newsletter and subscription record. These providers receive information needed for those services. Original article images may load from Beehiiv-hosted media, exposing ordinary connection data such as your IP address to that media provider. If you separately allow ad measurement in the cookie banner, OpenAI receives a confirmed new free-signup event through its measurement pixel or server conversion API, an opaque event identifier and available ad-click/browser references to measure ChatGPT ads. We also send campaign labels to Beehiiv with the new subscription. This optional choice is separate from newsletter consent. We do not deliberately send your email address or purchase revenue in these events. OpenAI processes measurement information under its privacy policy; its configured automatic matching may process supported form information as hashes.
Processing may take place outside the European Economic Area, including the United States. International transfers are subject to the safeguards applicable to our provider arrangements, such as an applicable adequacy decision or contractual safeguards. You can request information about the safeguards that apply to your data. External links, including Beehiiv checkout, are governed by the destination’s own privacy notice.
6. Your rights
You may request access, rectification, erasure, restriction or portability where applicable, and object to processing based on legitimate interests. If processing relies on consent, you may withdraw it without affecting earlier lawful processing. Contact nacho@thewhitebox.ai. We may ask for proportionate evidence of identity when necessary; a copy of an identity document is not required by default. You may complain to the Spanish Data Protection Agency (AEPD), www.aepd.es.
7. Required information and changes
Contact name, email and enquiry are required to send the form; the other fields are optional. A newsletter email and successful verification are needed for subscriber access. We do not make automated decisions with legal or similarly significant effects about you through these features. We update this notice when relevant handling changes.