Privacy and cookies

Last updated: 8 October 2026

This is a personal photography website. It only collects the data needed for the two things you can do here: subscribe to updates about new work and write in the guestbook. There is no advertising or analytics, and your data is never sold or shared with anyone.

Who is responsible

Guillem Duñó. For any question about your data, write to hola@guillemduno.com.

What data I collect and why

• Subscription: your email address and the language you were browsing in, to let you know when there are new photographs.
• Guestbook: the name and message you write, to publish them on the site once reviewed. Your IP address and any other data are not stored.

Legal basis

Your consent, given when you send the form (and, for the subscription, when you confirm it from the email). You can withdraw it at any time.

How long it is kept

• Your subscription email, until you unsubscribe. Every email includes a link to do so.
• If you don't confirm your subscription, the address is deleted automatically after 30 days.
• Guestbook comments, until you ask for them to be deleted.

Where it is stored

To work, the site uses these providers, which only process data to provide their service to me:

• Render: website hosting (servers in Frankfurt, Germany).
• TiDB Cloud: database (servers in Frankfurt, Germany).
• Cloudflare R2: photo storage.
• Resend: email delivery (United States, under the EU–US Data Privacy Framework).

Your rights

You can ask at any time to access, correct or delete your data, to object to or restrict its processing, or to receive it in a portable format. Just write to hola@guillemduno.com. To stop receiving emails, use the "Unsubscribe" link in any email or the unsubscribe page. If you believe your rights have not been respected, you can file a complaint with the Spanish Data Protection Agency (AEPD).

Cookies and local storage

The site only uses technical cookies, needed for it to work or to remember a choice you made. There are no analytics or advertising cookies, so your permission isn't required.

laravel-session

Keeps your session while you browse (your chosen language and form messages). Lasts 2 hours.

XSRF-TOKEN

Protects forms against forged submissions. Lasts 2 hours.

subscriber

Remembers that you've subscribed, so the form doesn't show up again. Lasts 5 years or until you unsubscribe.

theme (local storage)

Remembers whether you chose light or dark mode. It's never sent anywhere and stays until you clear it.

You can delete them at any time from your browser settings.