Legal notice and privacy

Who publishes this site

Legal name: NALTO TECHNOLOGIES, S.L., trading as nalto. Legal form: Spanish private limited company (S.L.), with share capital of €3,000. Registered office: Calle Lepant 270, bajos, 08013 Barcelona (Spain). Tax identification number (NIF): B05815048.

Responsible for publication: Valentin Cordier and Louis Pradère, joint and several directors.

Contact for anything on this page, including exercising your rights: contact@nalto.io.

Where the site is hosted

The site and the diagnostic API are hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, United States, vercel.com.

Completed diagnostics are stored in a Supabase database, supabase.com. Hosting region: Frankfurt (Germany), inside the European Union.

What we collect, and when

Browsing this site: nothing. No cookies, no analytics, no tracking pixels. There is no cookie banner because there is no cookie to accept.

At the end of the free diagnostic, and only if you fill in the form: your first name, your email, your company name and, optionally, your phone number. Stored alongside them is what you told us during the conversation — the process you described and the transcript — because that is the diagnostic itself.

On the application form, and only if you send it: your first and last name, your email, the role you're after, your years of experience, where you're based, your availability, the contract you prefer (employee or freelance) and a link to your public profile — plus your phone number if you choose to give it, since that field is optional. Nothing is stored without the box ticked at the bottom of the form.

On every request to the server: your IP address, held in memory to curb abuse. It is not written to our database. Vercel, as the host, keeps its own access logs.

What we use it for

To hand you back your diagnostic, to discuss what comes out of it, and to prepare a call if you ask for one. Nothing else.

If you send an application: to review it, answer you, and write again if a role matching your profile opens up. Nothing else.

There is no mailing list, and we neither sell nor pass this data to anyone for commercial purposes.

Legal basis: your consent, given when you submit the form, and our legitimate interest in answering a request for contact.

Who else sees it

Anthropic (anthropic.com) — the model that runs the interview and writes the diagnostic. What you type during the conversation goes through its API.

Supabase — the database where the finished diagnostic is stored, and the one behind our CRM, where the contact is recorded for our sales follow-up, and where applications are kept.

Vercel — hosting for the site and the API.

Google — the booking link leads to Google Calendar. The site's fonts, on the other hand, are served from our own servers: Google does not see your visit.

Some of these providers may process data outside the European Union, mainly in the United States. Those transfers rely on the EU-US Data Privacy Framework for certified providers and, otherwise, on the European Commission's standard contractual clauses included in their data processing agreements.

How long we keep it

Diagnostics and contact details: 3 years after the last contact. After that, they are deleted or anonymised.

Applications: 2 years after the last contact, unless you ask us to delete them sooner.

A diagnostic's share link does not expire today. Whoever holds the link can read the diagnostic — not the contact details, not the transcript. If you want it switched off, say so and it is done.

Your rights

You can ask us to access your data, correct it, delete it, restrict its use, object to it, or receive it in a reusable format. An email to contact@nalto.io is enough, with no need to justify yourself.

If our answer does not satisfy you, you can complain to the Spanish data protection authority (aepd.es) or, in France, to the CNIL (cnil.fr).

Site content

The text, design and code of this site are ours. Third-party trademarks and logos shown here belong to their owners and appear for reference.

What we deliver to a client is a different matter: it belongs to them. That is a house rule, not a negotiated exception.