Privacy Policy
Version v1.0 · Effective date: 2026-06-29 · Last updated: 2026-06-29
Scope. This policy explains how Desplega Labs, S.L. (“desplega labs”, “we”, “us”) handles personal data when you visit www.desplega.sh, our single-page marketing and landing site. The site has no user accounts, no paid service, and no dashboard — the only personal data we deliberately collect is the email address you give us if you subscribe to our newsletter. Unlike some of our sister sites, this site does run an advertising pixel; we describe exactly what it does, and why, below.
1. Data Controller & Contact
The data controller responsible for processing your personal data is:
Desplega Labs, S.L.
A Spanish sociedad de responsabilidad limitada
Tuset 3, planta 5, 08006 Barcelona, Spain
Registro Mercantil de Barcelona · CIF B27645381
Email: contact@desplega.sh
For any question about this policy or about how we process your personal data, please contact us at the email address above.
2. Information We Collect
Newsletter email address
When you submit the subscribe form, we collect the email address you enter. It is processed and stored on our behalf by Resend (our email service provider) as a contact within a mailing segment, so we can send you our newsletter. We do not ask for your name or any other detail.
Server logs and IP address
Our hosting and content-delivery provider, Vercel, automatically processes basic technical request data — including your IP address, user-agent string, and the pages requested — in server logs, as is standard for any website. We use this to keep the site secure, available, and working.
Cookieless analytics
We use Plausible to understand aggregate traffic — for example, how many people visit and which pages are popular. Plausible is cookieless: it sets no cookies, stores no personal data, and measures only anonymous, aggregate trends. Because it stores nothing on your device and cannot identify you, it needs no consent — so it is essential, always on, and not affected by your choice in the banner.
Advertising identifiers (X / Twitter)
When advertising tracking is enabled (see “Where this applies” below), we use X (formerly Twitter) Ads tracking. This involves three things:
- Web pixel. We load X's advertising pixel (uwt.js, pixel id qqtw4), which sets X advertising and measurement cookies in your browser.
- Navigation events. When you click through to one of our four projects (desplega.ai, agent-swarm, qa-use, agent-fs), a conversion event fires client-side to X, tagging which project you opened.
- Conversions API (CAPI). When you sign up for the newsletter, our server sends X a conversion event for measurement and ad attribution. That event includes a SHA-256 hashed version of your email address (we do not send X your email in clear text), together with your IP address and user-agent string.
Where this applies. In the EEA and the UK, this advertising tracking is off until you opt in via the banner. Elsewhere it runs by default — but you can opt out at any time via the banner or the “Cookie settings” link in the footer, and we honor that everywhere. If you opt out (or have not opted in where consent is required), none of the X advertising pixel, navigation events, or Conversions API calls run.
3. Cookies & Similar Technologies
The table below lists the cookies and similar technologies the site uses. Our cookieless analytics run at all times. The X advertising pixel and the Conversions API are consent-based: in the EEA and the UK they run only after you opt in via the banner (shown on your first visit); elsewhere they run by default and you can opt out at any time. You can change your choice via the “Cookie settings” link in the site footer; it is stored in a first-party cookie so we do not ask again, and is withdrawable at any time (see Section 8).
| Name / Technology | Purpose | Set by | Type | Consent-gated |
|---|---|---|---|---|
| Consent choice | Remembers whether you accepted or rejected advertising tracking | desplega labs (first-party) | Strictly necessary | No |
| Plausible | Aggregate, privacy-friendly traffic statistics | Plausible | Essential — cookieless analytics (no cookie set) | No (always on) |
| X (Twitter) pixel (uwt.js) | Conversion measurement and ad attribution; sets X advertising cookies | X Corp. | Advertising / marketing | Yes (EEA/UK); default-on elsewhere |
The server-side Conversions API described in Section 2 does not itself set a cookie on your device, but it is part of the same X advertising tracking and is gated by the same consent choice.
4. Legal Bases for Processing
Under the GDPR and the Spanish Organic Law on Data Protection (LOPDGDD), we rely on the following legal bases:
- Consent (Art. 6(1)(a) GDPR) — for sending you the newsletter, and for all X advertising tracking (pixel, navigation events, and Conversions API). You can withdraw consent at any time.
- Legitimate interest (Art. 6(1)(f) GDPR) — for keeping the site secure and available (server logs) and for measuring aggregate, cookieless traffic so we can improve the site.
5. Third Parties & Processors
We share personal data only with the service providers needed to run the site and, where you have consented, to measure advertising:
- Resend — email service provider that stores your newsletter email and delivers our messages.
- Vercel — hosting and CDN provider that serves the site and processes server logs (including IP addresses).
- Plausible — cookieless analytics provider for aggregate traffic statistics.
- X Corp. — advertising provider and recipient of the consent-gated pixel data and the Conversions API event (your SHA-256 hashed email, IP address, and user-agent), used for conversion measurement and ad attribution.
We do not sell your personal data.
6. International Data Transfers
Some of our providers — in particular X Corp. and Vercel — may process personal data on servers located outside the European Economic Area (EEA), for example in the United States. Where that happens, the transfer is protected by appropriate safeguards under the GDPR, such as the European Commission's Standard Contractual Clauses (SCCs) and any applicable adequacy decisions. You can contact us for more information about these safeguards.
7. Data Retention
We keep your newsletter email address for as long as you remain subscribed. When you unsubscribe (every newsletter contains an unsubscribe link) or ask us to delete it, we remove it from our active mailing list. Server logs are retained only for a short period for security and operational purposes, in line with our providers' standard log-retention practices. Advertising data shared with X is retained and processed according to X's own policies.
8. Your Rights
Under the GDPR and the LOPDGDD, you have the right to: access your personal data; have inaccurate data rectified; request erasure; restrict or object to processing; data portability; and withdraw any consent you have given (including by rejecting advertising tracking in the banner — re-open it at any time via the “Cookie settings” link in the site footer — or by unsubscribing from the newsletter), without affecting the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, email us at contact@desplega.sh. You also have the right to lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD), at www.aepd.es.
9. Children's Privacy
This site is not directed to children under the age of 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us and we will delete it.
10. Security
We take reasonable technical and organizational measures to protect personal data against unauthorized access, loss, or misuse — including serving the site over HTTPS, transmitting only a hashed (not clear-text) email to X, and relying on reputable processors. No method of transmission or storage is completely secure, but we work to keep the limited data we hold safe.
11. Changes to This Policy
We may update this policy from time to time. When we do, we will revise the version and “Last updated” date at the top of this page. Material changes that affect how we use your data will be reflected here, and where required we will ask for fresh consent.
12. Governing Law
This policy and any matter relating to it are governed by Spanish law, including the GDPR, the LOPDGDD, the LSSI (Ley 34/2002 on Information Society Services), and the ePrivacy Directive. Any dispute is subject to the exclusive jurisdiction of the Courts and Tribunals of Barcelona, Spain.
13. Contact
Questions about this Privacy Policy or your personal data? Email us at contact@desplega.sh, or write to Desplega Labs, S.L., Tuset 3, planta 5, 08006 Barcelona, Spain. See also our Terms of Use.