Privacy notice

Last updated: 27 September 2026.

This notice explains how bomwerk processes personal data on bomwerk.com. Contact: info@bomwerk.com.

The website and the product are separate

This notice covers the website. The bomwerk command-line tool has no telemetry: running it sends nothing about you or your usage to us. What it does contact, and how to turn that off, is described under network use. "No telemetry" is a statement about the product. The website does use the analytics described below.

Enquiries and scan requests

We process your email address, repository link and notes to respond to your inbound business enquiry. The legal basis is our legitimate interest under Article 6(1)(f) GDPR. Do not submit secrets or unnecessary personal data. We do not use enquiry addresses for marketing. We delete submissions and associated correspondence 90 days after the enquiry closes, unless longer retention is required for legal claims.

Formspree processes the form, stores submissions on infrastructure in the United States and may deliver them to our email provider. Formspree states that it uses the European Commission's Standard Contractual Clauses for restricted transfers.

Website analytics and security

Fonts are self-hosted. Loading any page requests the Inter typeface from bomwerk.com itself, never from Google Fonts or any other third-party font service.

We use Plausible Analytics for aggregate measurement. It is configured without cookies or browser storage. It processes IP address and User-Agent transiently to create a daily rotating identifier; raw values are not retained in analytics reports. Plausible states that visitor data is hosted in the EU.

The legal basis is our Article 6(1)(f) GDPR legitimate interest in operating and improving a low-tracking business website. You may object by contacting us. If the deployed configuration uses cookies or equivalent storage, analytics must be disabled until any consent required by Spanish LSSI-CE Article 22 is implemented.

Our hosting provider may process request and security logs under our legitimate interest in reliable and secure operation. Retention should be the shortest operationally necessary period.

Your rights

Subject to applicable conditions, you may request access, rectification, erasure, restriction, objection and portability. You may complain to the Spanish Data Protection Agency (AEPD). Email info@bomwerk.com to exercise a right.

Marketing

The scan request form has one optional, unticked checkbox: "Yes, email me future bomwerk product updates." Ticking it is your consent under Article 6(1)(a) GDPR to be added to a future product-updates list. It does not change the legal basis for the rest of the form, which stays our Article 6(1)(f) legitimate interest in answering your enquiry.

We do not operate an automated mailing list today. Ticking the box only tags your Formspree submission so a person can add you to a list by hand — it does not subscribe you to anything automatically. The tagged submission is still deleted 90 days after the enquiry closes, like any other submission; if you are added to a list before then, that separate record is kept only until you unsubscribe or object, and withdrawal must stay as easy as opting in, per LSSI-CE Article 21. Email info@bomwerk.com to withdraw consent, object, or unsubscribe at any time.

We do not send marketing to anyone who has not ticked this box.

This notice should be read together with the legal notice, which identifies the operator. Some of that page's fields (registered address and registration number) are still marked pending — treat both pages as provisional on that point until they are filled in.