Legal
Data processing terms
An earlier version. These are our data processing terms of 5 November 2026, kept for you to read. They were replaced on 7 November 2026 for new accounts, and on 7 December 2026 for accounts that already existed. The terms that apply now are on the page Data processing terms.
When you use Tsurito, other people's personal data passes through us for you:
- the visitors of your websites: their internet address while we serve them a page, and their name, email address and message when they write to you through the contact form;
- if you use Email, your contacts and the people you send emails to.
Under the GDPR, you are the controller of that data, and we are your processor. These terms, as Article 28 of the GDPR asks, say what we do with it for you.
They are part of our Terms of service. You accept them when you publish a website. You accept their part "If you use Email" when you turn Email on. Their part "If you use the assistant in the Panel" applies from the first time it is given permission to see people's data in your account, by you or by a member you allow. If these terms and the Terms of service say different things about personal data, these terms win.
Who is who
You, the holder of the account, are the controller. You decide what your website asks of its visitors and what you do with what they send you. With Email, you decide who your contacts are, on which basis you write to them, and what you send them: each newsletter, and each direct email with its type.
We, Miguel Angel Avalos Fernandez, self-employed, trading as AVALSYS, at Av. Ernest Lluch 32, TecnoCampus Mataró-Maresme TCM 3, 08302 Mataró, Spain, are the processor. We process this data only to serve your website, to pass its messages to you and, if you use Email, to keep your contacts and send your emails.
With the assistant in the Panel inside Studio, you decide whether it may see people's data in your account: you give or refuse each permission yourself, and you decide for each member of your team whether they may give it. A permission given by you, or by a member you allow, is your instruction to pass that data to the Studio of the person who gave it, for their own Claude or ChatGPT.
What we process for your websites
| Processing | Whose data | Which data | For how long |
|---|---|---|---|
| Serving the pages of your website | Its visitors | Internet address and browser details, while a page is served | Only while the page is served; Cloudflare's network keeps its short address records under its own terms |
| Counting page views, and visitor numbers if you switch them on | Its visitors | The website, the address and path of the page, and the totals; counted without cookies and without keeping who visited | Totals stay with your website |
| Checking that a form is filled in by a person | Its visitors | The check made by Cloudflare's Turnstile | Only while the check runs |
| Passing the messages of your contact form to you | The people who write to you | Their name, email address and message | Only while the message is sent; we keep a monthly count |
We do not process special categories of data for you on purpose. If a visitor writes something of that kind in a message, it goes to you as the rest of the message.
If you use Email
Email keeps your register of contacts and sends your emails to them, from your own domain: the issues of your newsletters to their subscribers, and direct emails to the contacts each type of email allows. This part applies from the day you turn Email on.
| Processing | Whose data | Which data | For how long |
|---|---|---|---|
| Keeping your register of contacts | Your contacts | Name, email address, language, phone if you keep it, the organisation they belong to with their position and its dates, category, tags, each permission to write to them with its purpose and its proof, and the history of what was done with them | While Email is on. Erased 30 days after you turn Email off, or when your account is erased. |
| Sending your newsletters and direct emails | The contacts you send to | Their email address and name, the content of the email, and what happened to it: delivered, bounced or complained about | The email only while it is sent. What happened to it stays in the contact's history, as long as the register. |
| Counting the clicks on the links of your emails | The people who click | Which link was clicked, counted per link. We do not know or keep who clicked it. | The totals stay with the send, as long as the register. |
| Keeping the addresses that must not be written to again | People who unsubscribed, whose address bounced, who complained, or whom you deleted asking never to write to them again | The email address, why and when, and the proof of the permission it ended | While your account exists, until your register of contacts is erased. Used only to never write to them again. |
We do not measure whether an email is opened. For your own privacy page, the clicks fit in one sentence: "We count how often each link is clicked, without knowing who clicked it."
- Where it is kept. Your contacts, emails and sends are kept in a database of your account's own, in the European Union. The emails leave from the European Union too. Each company that does this is named on the page Who helps us run the service.
- Who reaches it. Only the people of your account, each at the level you give them. At Tsurito, we see how many contacts and sends you have, never your contacts.
- No use of our own. We never use your contacts for anything of our own. We count them, and your sends, only to apply your limits and your bill.
If you use the assistant in the Panel
In Studio, the Panel has an assistant that runs on the Claude or ChatGPT of the person using it, on their computer, under that person's own agreement with Anthropic or OpenAI. It reads totals and your account's own things, such as the names of your saved lists, and prepares drafts for that person to review; it never sends, saves or imports anything. It sees people's data only with permission, asked when it first needs it: for only this time, always for one list, or always for all your saved lists.
| Processing | Whose data | Which data | For how long |
|---|---|---|---|
| Passing people's data to the assistant, with permission | The people in a saved list | The first name and whether each person is active. Never the email address, phone, last name, postal address, comments or notes. | Passed only when the assistant asks, on that permission. We keep no copy of what we pass; what the assistant received stays with that person and with Anthropic or OpenAI, under their agreement. |
| Keeping the permissions | You and the members of your team | Who gave each permission, what for, whether for only this time or always, when it was given, used and taken back; and, for each member, whether you let them give permissions | While Email is on; erased with your register of contacts. A permission for only this time serves one read, in the conversation that asked for it, within 10 minutes, and may be deleted a week after it was given. |
| Keeping the drafts | The members of your team who prepare, use or discard them | What each draft is about (an email, a saved list or a filter, the columns of a file), its count, the time proposed, and who prepared, used or discarded it. A draft never holds an email address, a phone number or a postal address of your contacts, and we never put any other of their data in it; a name you write in the conversation yourself can appear in its text. | The latest 200, while Email is on; erased with your register of contacts. |
- Examples from an import. With permission, for only this time, the assistant can see up to three short examples from the columns of a file you are importing whose short values repeat, such as a city, a category or yes and no; never from names, email addresses, phones, last names, postal addresses, notes or other free text, nor values that look like identity or bank numbers, dates of birth, health or links. They go from the file on your computer to the assistant and never reach us; we keep only the permission.
- Who may give a permission. You, the holder, always. A member of your team, only after you allow it for that person in Team; turning it off ends their permissions, and turning it on again does not bring them back. Each permission belongs to the person who gave it, who can take it back at any time in Studio's Account and settings, under Tsurito, Privacy.
- Anthropic and OpenAI. They are not our processors, and we give them nothing. The person who gives a permission has chosen and contracted their own Claude or ChatGPT; what Anthropic or OpenAI may do with what it receives, and their role for that data, is set by that person's agreement with them.
- No use of our own. We never use what we pass, the permissions or the drafts for anything of our own.
Your instructions
We process this data only on your instructions. Your instructions are:
- these terms and the Terms of service;
- what you choose in Tsurito Studio: which contact address receives the messages, whether visitor numbers are on, and whether the website is published at all;
- with Email, what you and your team set in Tsurito Panel: who is a contact, with which permission, what is sent, with which type of email, and to whom;
- with the assistant in the Panel, each permission you or a member you allow gives it, and your choice for each member in Team.
We do not use your visitors' data or your contacts for anything of our own. If we believe an instruction breaks the law, we tell you.
What we promise
- Confidentiality. Everyone who works on the service is bound to keep it confidential.
- Security. We take the measures described on our Security page: everything travels encrypted, accounts and the administration pages are protected, and the data lives with the processors named below under their own safeguards. We may improve these measures, never lower them.
- Help with requests. If a visitor asks you about their data, we help you answer within the limits of what we keep, which is little: their messages are with you, not with us. If one of your contacts asks, you can answer yourself in the Panel: export that person's data, correct it, or delete them. If you need more, we help.
- Breaches. If personal data of your visitors or your contacts is lost, changed or seen by someone who should not, we tell you without undue delay after we learn of it, with what we know and what we are doing.
- Information. We give you the information you reasonably need to show that this processing follows the GDPR, and we answer your questions at hello@tsurito.com. We answer first in writing. If that is not enough for you or your supervisory authority, an inspection is possible once a year, with four weeks' notice, at a time agreed with us and at your cost.
Who helps us
We use other companies to do this work. They are listed, with what they do, which data they see and where, on the page Who helps us run the service, which is part of these terms. Each of them is bound by a contract with the same duties as ours, and transfers outside the European Union rest on the safeguards named there. One of them, Amazon Web Services, works only for accounts that use Email: it sends their emails. Anthropic and OpenAI are not among them, as the part If you use the assistant in the Panel says.
We tell you by email at least 30 days before a processor is added or replaced. If you object to the change, you can take your website off the internet, turn Email off, or cancel a subscription before the change applies, and nothing more is charged.
When it ends
For a website, this processing ends when it goes off the internet, when you delete it, or when your account is erased. At that point the little we keep of your visitors' data goes with the website, as our Privacy policy says, unless the law asks us to keep something.
For Email, it ends when you turn Email off or when your account is erased:
- 30 days after you turn it off, your emails and sends are erased, and so are your contacts, with their history and the addresses not to write to again. We write to you before, with a way to export them.
- If you turn it on again before then, nothing is erased.
- A pause is not turning it off: while Email is paused, nothing is erased.
Until then, and for 30 days after you close your account, you can export each version of your website and its statistics in Studio or Tsurito Panel, and your contacts with their permissions and their history, and the assistant's drafts and permissions, in the Panel, as our Terms of service say. Your visitors' messages are already yours, in your inbox.
Your side
You make sure your website tells its visitors who you are and what you do with what they send you, and that you have a lawful basis for it. How your website tells them is yours to decide; Tsurito does not add or check such pages, and your assistant can write them when you ask. You also make sure that you may give us the data you ask your visitors for.
With Email, you also make sure that:
- you have a lawful basis for each contact you add or import, and for every email you send;
- each basis you declare is true: someone you declare a member or a client is one, and consent you declare was given;
- each direct email goes with the right type of email: a service type, such as Notices, carries no promotion;
- before you send advertising to people who receive it as members or clients, rather than on their consent, you check the advertising exclusion lists where the law asks for it, as it does in Spain;
- your contacts are told who you are and what you do with their data; people you import, who did not sign up with you, at the latest with your first email;
- the people you invite to your account are the ones who should reach your contacts, at the right level, and you remove them when they should no longer reach them. You answer for what they do in your account.
With the assistant in the Panel, you also make sure that:
- you have a lawful basis to let your own Claude or ChatGPT see the first names and the other details it may see, and your privacy page tells your contacts that you may use an AI assistant with their data;
- your agreement and your settings with Anthropic or OpenAI suit this data, for example on whether your conversations may be used to improve their models, and so do those of each member you allow;
- you allow only the members who should give such permissions, and you turn it off when they should no longer give them. You answer for what they do in your account.
These terms are made in English. If a translation of them differs from the English text, the English text applies.
Questions about these terms go to hello@tsurito.com.
Last updated: 5 November 2026. This version applies to new accounts from that day, and from 5 December 2026 to accounts that already existed.