Privacy Policy

Last updated: 24 August 2026

1. Who is responsible for your data

The controller of your personal data is:

Nutshell Project S.L. (trading as Nutsh Lab)
Tax ID (CIF): B25916883
Carrer Era de la Vila 4, 17114 Ullastret, Girona, Spain
Email: hello@nutshlab.com

We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 of the GDPR.

2. What data we collect and why

We only collect data you give us or that is generated when you use this website.

Early Access list. When you submit the sign-up form we collect your email address. We use it to send you product updates, information about the Kickstarter campaign and early access offers.

Early Access deposit. If you place the €1 deposit we collect your name, email, billing address and order details. Card details are handled directly by our payment providers and never reach our servers.

Contact. If you write to us we keep your message and contact details in order to answer you.

Browsing data. With your consent we collect information about how you use the site: pages visited, device, approximate location and interaction with our ads.

3. Legal basis

Under Article 6 of the GDPR we rely on:

  • Consent (Art. 6.1.a) for marketing emails and for analytics and advertising cookies. You can withdraw it at any time.
  • Performance of a contract (Art. 6.1.b) to process your deposit and, later, your order.
  • Legal obligation (Art. 6.1.c) to keep accounting and tax records.
  • Legitimate interest (Art. 6.1.f) to keep the site secure and prevent fraud.

4. How long we keep it

  • Early Access list: until you unsubscribe, or after three years without any interaction.
  • Orders and deposits: six years, as required by Spanish commercial law.
  • Contact messages: one year after the matter is closed.
  • Cookies: see our Cookies Policy for each cookie's lifetime.

5. Who we share it with

We do not sell your personal data. We share it only with providers who process it on our behalf under a data processing agreement:

  • Shopify — hosting, store and order management.
  • Payment providers — processing of the deposit and future orders.
  • Google (Analytics) — website analytics, only with your consent.
  • Meta — advertising measurement, only with your consent.

We may also disclose data where required by law or by a competent authority.

6. International transfers

Some of these providers are based outside the European Economic Area, mainly in the United States. Transfers are covered by the European Commission's Standard Contractual Clauses or by the EU–US Data Privacy Framework, together with additional safeguards where required.

7. Your rights

You have the right to access your data, correct it, delete it, restrict or object to its processing, request portability, and withdraw consent at any time.

To exercise any of these rights, email hello@nutshlab.com stating which right you wish to exercise. We may ask you to confirm your identity. We will reply within one month.

You can unsubscribe from our emails at any time using the link at the bottom of every message.

If you believe we have not handled your data correctly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.

8. Security

We apply appropriate technical and organisational measures to protect your data. Our store runs on Shopify, which maintains PCI DSS certification for payment processing. Access to personal data is limited to the people who need it.

9. Children

This website is not directed at children under 14. We do not knowingly collect their data. If you believe a minor has provided us with personal data, please contact us and we will delete it.

10. Changes

We may update this policy as the project develops. The date at the top always reflects the current version. Significant changes affecting your rights will be announced by email.