Privacy Policy
The Short Version
We collect very little data, and we never sell or share it. If you submit a form on this site — the Data Solutions contact form, an editorial suggestion on the contribute page, or a song guess in the banner — we receive what you typed plus your IP address.
We do measure how the site is used, with two analytics tools, both described below: Cloudflare Web Analytics, a third-party product run by Cloudflare, and our own first-party beacon, which sends a short record to a server we run. Both are cookieless. Neither one identifies you, builds a profile of you, links one visit to another, or follows you to any other website, and we use no advertising or ad-targeting products at all. You can switch our own beacon off with one click further down this page.
What We Collect
Information You Provide Directly
All three forms below submit directly to our own server at api.guapadata.com, where your submission is stored and a notification is delivered to us by email through Resend, our email-delivery provider. We do not use a third-party form-processing service. Each stored submission includes the IP address it was sent from, which we use to prevent spam and abuse. Resend's handling of the notification email in transit is governed by its own privacy policy.
Data Solutions contact form. If you submit the lead form on our Data Solutions page, we collect your name, email address, and any company, phone, and message details you provide.
Contribute page (editorial suggestions). If you suggest a description or icon edit on the contribute page, we collect the artist/album you're editing and the text you suggest. Accepted suggestions are published on the site as part of our editorial content.
Banner song guesses. If you submit a "name this song" guess in the site banner, we collect the guess and the lyric it responds to.
Information Collected Automatically
Contribute passcode session. After you enter the shared passcode, we set a strictly necessary seven-day session cookie so you can open the Contribute page and send suggestions without entering the code each time. It is used only to verify access, not for analytics or advertising. The passcode itself is not stored in the cookie.
Analytics — cookieless, and never sold or shared. We measure how the site is used with two tools: Cloudflare Web Analytics, a third-party product, and our own first-party beacon that sends a short record to a server we run. Neither sets a cookie, identifies you, builds a profile, links one visit to another, or follows you to other sites, and we use no advertising, ad-targeting, or Google/Facebook analytics products. You can switch our beacon off with one click below.
What our beacon records. A random per-tab id (not a cookie; it's discarded when you close the tab and is never linked to any other visit or device), the page you're on, and where you came from — an outside site is reduced to its address only (for example google.com), never the page you were on there. If you followed a link we posted somewhere (say on social media), it also records a short fixed code for where that link was — for example reddit, plus a campaign name if the link carried one — so we can see which of our own posts bring people in; that code comes from the link, not from anything you type. Inside the site it also records when you open an artist and when you click a link out to another site: the artist or album, and which site you went to (for example spotify.com or wikipedia.org). If you send the Solutions inquiry form, it records that a submission happened — so we can tie inquiries back to how people found us — but not what you wrote in the form (that goes through the form itself). If you use the “Ask the catalog” box, it records the question you asked — the words you typed — along with what kind of question it was, so we can see what people look for and what the catalog can’t yet answer. That box is the only place the beacon records something you type. It never stores your IP address with the data — the server uses your IP only to limit abuse, then drops it.
Cloudflare Web Analytics loads a small measurement script on every page (static.cloudflareinsights.com) and reports aggregate traffic. It's cookieless and governed by Cloudflare's own privacy policy; there is no switch on our side, so to stop it, block that script in your browser.
Turning our beacon off
Use the button below (it remembers your choice in this browser and stops the beacon right away), or turn on Do Not Track or Global Privacy Control — we honor both automatically — or block storage for this site. This covers our own beacon; Cloudflare Web Analytics is turned off separately, as described just above.
Cloudflare hosting and security. This site is served through Cloudflare (Cloudflare Pages hosting and Cloudflare's network). Like any host, Cloudflare processes connection data (IP addresses, browser type, referring pages) to deliver the site, and may collect standard server logs and set strictly-necessary cookies for security purposes. This data is governed by Cloudflare's privacy policy.
Cloudflare Turnstile (bot protection). Our public forms are protected by Cloudflare Turnstile, which analyzes connection and browser signals (such as your IP address and interaction data) to distinguish humans from bots. Turnstile does not track you across sites and is governed by Cloudflare's privacy policy.
The Lobby (live presence). The interactive stage in the site's sidebar connects to our own realtime service at lobby.guapadata.com (hosted on Cloudflare) while the page is open, so visitors' figures can appear in each other's stages. The only information shared with the room is ephemeral: a randomly assigned handle, a display color, your figure's position, preset reactions chosen from a fixed list, and — if you put an album on — that album's name. There are no accounts, nothing you type is transmitted, and nothing is stored: when you close the page, your figure and its data are gone. Connection data (including your IP address) is processed transiently to enforce rate and connection limits, as with any web request.
Information Collected by Third Parties Through This Site
When you use this site, your browser may make requests to third-party servers in the normal course of loading page content:
Cover Art Archive (coverartarchive.org / archive.org). Album artwork displayed on the music page is loaded directly from Cover Art Archive servers hosted by the Internet Archive. When these images load, your browser sends a standard HTTP request to their servers, which may include your IP address, browser type, and referring page. Guapa Data does not control or have access to this data. This is governed by the Internet Archive's privacy policy.
Amazon (amazon.com). If you click an affiliate link on this site, you will be directed to Amazon.com. Amazon will process your visit and any subsequent purchases under their own privacy policy. Guapa Data receives only aggregate reporting from Amazon Associates (total clicks, total earnings) and does not receive any personal information about individual purchasers.
Spotify (open.spotify.com). If you click a Spotify link on this site, you will be directed to Spotify's platform. Guapa Data does not receive any data about your Spotify activity.
Wikipedia (wikipedia.org). If you click a Wikipedia link, you will be directed to Wikipedia's site under their own privacy policy.
How We Use Your Information
Information submitted through our forms is used solely to:
- Respond to your inquiry about Guapa Data Solutions products and services
- Follow up with relevant information about consulting engagements, product availability, or service offerings
- Review and apply editorial suggestions and song guesses you submit
- Prevent spam and abuse of our public forms (the stored IP address)
We do not use your information for any other purpose.
Analytics records are separate. They are used only to understand, in aggregate, how the site is used — which pages people read, in what order, which sites they arrived from, and which artists and records they open or click through to. They are never combined with form submissions, never used to contact anyone, and never sold or shared.
What We Don't Do
- We don't sell your personal information to anyone
- We don't share your personal information with third parties for marketing purposes
- We don't use Google Analytics, Facebook Pixel, or any advertising, ad-targeting, or audience-selling product
- We don't set analytics or advertising cookies — the two analytics tools described above are both cookieless, and ours uses per-tab browser storage instead, plus one flag if you opt out
- We don't build user profiles, and nothing we collect links one visit to another, one device to another, or your activity here to any other website
- We don't serve targeted advertising
- We don't use your data to train AI models
Data Storage and Security
Form submissions are received and stored on our own server (api.guapadata.com), and a notification is delivered to us by email through Resend, our email-delivery provider. We do not maintain a separate customer database at this time. Resend's handling of email in transit is governed by its own privacy policy.
Analytics beacon records are stored on that same server of ours — not with a third-party analytics vendor. The data Cloudflare Web Analytics collects is held by Cloudflare under its own privacy policy; we see only the aggregate reports.
Data Retention
We retain form submissions — including the IP address recorded with each one — for as long as necessary to respond to your inquiry, maintain a record of our communications, and keep an audit trail of applied editorial suggestions. If you would like your information deleted, contact us and we will remove it within 30 days.
Analytics records. Beacon records are kept for aggregate analysis of how the site is used. They carry no name, email address, account, or IP address, so ordinarily we have no way to connect one to a person — which also means we usually cannot pick out "your" records unaided. That is a limit of the data, not a refusal: if you want them removed, contact us with whatever detail you can give (roughly when you visited, and which pages), and we will locate and delete every record we can match — purging the store outright if that is the only reliable way to honour the request. Using the opt-out above stops any further records immediately.
Your Rights
Regardless of where you are located, you may:
- Request access to any personal information we hold about you
- Request deletion of your personal information
- Request correction of inaccurate personal information
- Withdraw consent for any future communications
To exercise any of these rights, contact us through the Solutions form or our social channels listed on the site. We will respond within 30 days.
California Residents
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA). Given our minimal data collection practices, the scope of these rights is limited, but you are entitled to know what personal information we collect and to request its deletion. We do not sell personal information as defined by the CCPA.
European Visitors
If you are located in the European Economic Area, your personal data is protected under the General Data Protection Regulation (GDPR). Our lawful basis for processing contact form submissions is your consent, which you provide by voluntarily submitting the form. You may withdraw consent at any time by contacting us.
We do not actively target or market to EU residents, but we respect the rights of any EU visitor who interacts with our site. If you wish to exercise any GDPR rights (access, rectification, erasure, portability, or objection), contact us and we will respond within 30 days.
On our analytics beacon. It stores a per-tab session id on your device, and it currently runs on an opt-out basis rather than asking first. We are not claiming that settles the question: rules on storing anything on a visitor's device (the EU and UK ePrivacy regime) can apply even where the data is anonymous and no cookie is involved, and we are keeping our approach under review. In the meantime, if you are in the EEA or the UK and would rather it not run, use the opt-out above — or turn on Do Not Track or Global Privacy Control, which we honour automatically without you having to ask.
Children's Privacy
This site is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has submitted information through our contact form, please contact us and we will delete it promptly.
Changes to This Policy
We may update this privacy policy from time to time. Changes take effect when posted to this page. The "last updated" date at the top reflects the most recent revision.
Contact
Questions about this privacy policy can be directed to the contact form on the Solutions page or by reaching out through our social channels listed on the site.