Privacy policy.
Last updated 31 May 2026.
This policy explains what personal data Eskultura collects, why, and the rights you have over it, in line with the EU General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
Who is responsible for your data.
The data controller is Jesús Bermudo Farfán, trading as Eskultura, based in Madrid, Spain. Full identification details are in our aviso legal. For any question about your data or to exercise your rights, write to contact@eskultura.com.
What we collect.
- Account data. Your name, email address, and a password that is stored only in hashed form by our authentication provider. We never see your password in plain text.
- Library activity. The assets you download and the pieces you mark as favourites, so we can show your history and honour your download entitlements.
- Subscription data. Your plan, its status, and the identifiers needed to link your account to your subscription. Card and payment details are collected and stored by our payment provider, not by us.
- Technical data. A strictly necessary session cookie to keep you signed in, plus basic server logs (such as IP address and request times) used for security and to keep the service running.
Why we use it, and our legal basis.
- To provide your account and downloads — performance of the contract between you and the Studio.
- To process your subscription and issue invoices — performance of the contract and compliance with a legal obligation.
- To keep the service secure and working — our legitimate interest in protecting the site and its users.
- To send you optional product news — only with your consent, which you may withdraw at any time.
Who we share it with.
We do not sell your data. We share it only with the service providers that make Eskultura work, each acting as a data processor under contract with us:
- Supabase — database, authentication and file storage, hosted in the European Union.
- Vercel — website hosting and delivery.
- Lemon Squeezy — payments, subscription billing and invoicing, acting as merchant of record.
Some of these providers are based outside the European Economic Area. Where that is the case, transfers are protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an equivalent adequacy mechanism.
How long we keep it.
We keep account and library data for as long as your account is active. If you close your account, we delete or anonymise your data, except records we are legally required to retain — billing and tax records, for example, which Spanish law requires us to keep for several years.
Your rights.
You may at any time request access to your data, ask us to correct or delete it, restrict or object to its processing, request portability, or withdraw a consent you previously gave. To do so, write to contact@eskultura.com. We will respond within the timeframes set by the GDPR.
If you believe we have not handled your data correctly, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos) at www.aepd.es.
Changes to this policy.
We may update this policy as the service evolves. When we make a material change, we will update the date at the top of this page and, where appropriate, let you know by email.