Last updated: 6 September 2026
Who we are
This website is operated by COSMICALLEY — UNIPESSOAL LDA, a company registered in Portugal (NIF 519121821), with registered office at Rua Custódio Vieira, n.º 2, 3.º Esq., 1250-086 Lisboa, Portugal. For anything in this policy, write to hello@cosmicalley.io. Cosmicalley is the controller of the personal data described below.
The short version
This is an informational website with no user accounts. We receive the information you send us by email or through our HubSpot call-booking page, and technical data needed to deliver the site securely. We use HubSpot to manage business enquiries and bookings, and Google Workspace for email and calendar appointments. With your consent, we also use Google Analytics and Google Tag Manager for website and campaign measurement. We do not sell personal data, and we make no automated decisions about you.
What we process, and why
Email you send us. If you write to us — for example to book a 30-minute call — we receive your email address and whatever you include (typically your name, company and question). We use it to reply and to follow up on your enquiry. Legal basis: steps taken at your request prior to a possible contract, and our legitimate interest in responding to business enquiries (GDPR art. 6(1)(b) and (f)).
Technical and security data. The site is served by Cloudflare, which processes connection data such as your IP address to deliver pages, balance load and block abuse. This connection data is processed for delivery and security; it is separate from optional audience measurement. Legal basis: our legitimate interest in operating a secure, functioning website (art. 6(1)(f)).
Booking a call. If you book through our HubSpot scheduling page, HubSpot collects your name, email address and chosen appointment, creates or updates your contact record, and adds the meeting to Paula's connected Google Calendar. We use this information to arrange the call, send its confirmation and calendar invitation, and respond to your enquiry. Cancellation and rescheduling update the meeting record. Google Meet provides the video-call link. If you book through Google Calendar, Google collects the details on that page and adds the appointment to our calendar. Legal basis: steps taken at your request before a possible contract where applicable (GDPR art. 6(1)(b)), or our legitimate interest in arranging and responding to business enquiries when you act on behalf of your organisation (art. 6(1)(f)). Booking a call does not subscribe you to marketing emails.
Business enquiry records. We use HubSpot to keep a record of business enquiries, related correspondence, meetings and their outcomes. This can include your name, business contact details, company, the subject of your enquiry and relevant follow-up notes. If your booking link includes campaign source, medium or campaign-name tags, HubSpot can retain those tags with the booking record to help us understand where enquiries came from. We use these records to respond, coordinate follow-up and manage prospective client relationships. Legal basis: our legitimate interest in managing business enquiries (GDPR art. 6(1)(f)). You may object to this processing by contacting hello@cosmicalley.io. We do not treat a booking as consent to unrelated marketing.
Measurement — your choice. “Analytics only” allows Google Analytics to measure pages visited, traffic sources, tool-opening links, visits and links to the contact page, calendar openings and fallback navigation, clicks to email or the calendar, and confirmed call bookings linked to your website visit. “Accept all” also allows Google Tag Manager to load campaign-measurement tags when campaigns are enabled. Campaign tags are currently disabled. Google Analytics uses cookie identifiers and event data. If you allow analytics, we pass permitted campaign tags to the calendar and use a temporary visitor identifier to verify your new booking in HubSpot. Only a verified booking is eligible for a lead event; a calendar-link click is not confirmation that you booked. The event uses your Analytics browser and session identifiers, not your name, email, phone number, company, meeting notes or HubSpot contact ID. “Decline” loads neither service. We do not send names, contact details, tool inputs, imported files or the text of your enquiry to analytics. Declining analytics keeps the ordinary external booking link available and does not enable this visit-to-booking linkage. Legal basis: your consent (GDPR art. 6(1)(a)), which you can withdraw below.
Public tools. Calculator and worksheet inputs are processed in your browser and are not submitted to Cosmicalley. The installed-base register can save rows in this browser only if you select “Remember this register in this browser”. You can switch that option off to remove its saved copy. Imported CSV files are read locally, and exported CSV files are saved to your device. Avoid personal or confidential information on a shared device. Your browser or device may retain downloaded files until you delete them.
Fonts. The site hosts its font files alongside its other assets. Loading a typeface does not make a separate request to Google Fonts or set a font-related cookie.
Exclude your own visits
If you regularly review this website, you can exclude this browser from Analytics without changing how the site works. This also disables visit-to-booking measurement for this browser. The preference stays in this browser until you turn it off or clear site storage; set it separately on each browser and device.
JavaScript is required to change this preference. You can also decline Analytics using Privacy choices.
Cookies and browser storage
Optional measurement is off on your first visit. Cloudflare may use strictly necessary cookies for security and traffic management. Declining optional measurement does not prevent you from reading the site, using the tools or following the booking link.
We store your consent choice and its date in browser storage for 180 days, then ask again. This remembers both acceptance and refusal. If you choose to exclude this browser from Analytics, we store that preference locally until you remove it or clear site storage; it is not sent to Google. “Analytics only” keeps advertising consent off; “Accept all” allows analytics and campaign measurement. No optional Google tag is loaded before your choice. The installed-base register uses separate browser storage only when you explicitly ask it to remember your rows.
You can . This withdraws the current choice, removes Google measurement cookies and campaign storage accessible to this site, requests removal of pending booking links, and reopens the notice. Withdrawal stops future measurement; events already sent are not recalled automatically. If tags have already loaded, the page reloads to stop them. Cookies on Google's own domains are controlled by Google and your browser settings.
Who handles the data with us
We use Cloudflare for website hosting and content delivery; Google for business email through Google Workspace, calendar appointments, video calls and — with your consent — Google Analytics and Google Tag Manager; and HubSpot for call scheduling and customer relationship management. These providers process data for the functions described in this policy. HubSpot’s scheduling pages, including the calendar opened inside this site after analytics consent, also have their own privacy and cookie information. The embedded calendar loads only when you choose to book; it does not load on ordinary page visits. Additional campaign providers will be disclosed here before they are enabled. These providers may process data outside the European Economic Area; applicable safeguards are described in their data-processing and privacy documentation. You can contact hello@cosmicalley.io for information about safeguards applicable to your data. Provider privacy information: Cloudflare, Google, HubSpot.
How long we keep it
We keep enquiry correspondence, booking details and CRM records while needed to handle your enquiry or maintain the related business relationship, and afterwards only where retention is necessary to meet legal obligations or establish, exercise or defend legal claims. We assess that need using the status of the enquiry, our last relevant interaction and applicable obligations; information no longer needed should be deleted or anonymised. Technical connection data is handled under Cloudflare’s security and retention practices. Google Analytics is configured to retain user-level and event-level data for 14 months. New activity can restart the user-data retention period; aggregate reports are not subject to that same limit. Your consent choice expires after 180 days. With analytics consent, campaign tags are remembered for up to 30 minutes of inactivity in the browser session, with a maximum of two hours. The temporary booking linkage is removed from our active Cloudflare storage after verification, withdrawal or expiry, and in all cases within two hours; Cloudflare’s recovery backups may retain deleted data for up to 30 days. We retain a hashed booking identifier and delivery status for 90 days to prevent duplicate reporting; these contain no contact details or Analytics identifiers. Any register rows you choose to save remain in this browser until you turn off “Remember this register in this browser”, clear browser storage or remove them yourself.
Your rights
- Ask what personal data we hold about you, and receive a copy.
- Have inaccurate data corrected, or data we no longer need erased.
- Restrict or object to processing based on legitimate interest.
- Receive data you provided in a portable format.
To exercise any of these, email hello@cosmicalley.io — we respond within one month. You can also lodge a complaint with the Portuguese supervisory authority, the CNPD (cnpd.pt).
Changes to this policy
If we change how the site handles data — for example by adding a contact form or another measurement provider — this page will be updated first, with a new date at the top.