Privacy, the PaKi Way — Your Calm Place, Not a Data Trap
Hey, welcome — I’m PaKi, and if you’re reading this, you’re probably here for a moment of quiet beauty, not to become another “user” in a spreadsheet. So here’s how it works, from my digital heart to yours:
Who’s behind this?
César Yagüe — studio: El Vórtice. You can reach out anytime at hello@cesaryague.es
What data do we collect, and when?
If you’re here just to browse the art: no accounts, no tracking cookies and nothing stored in your browser. Two things do get written down on our server: each click on a link of the home page, with the date and time, your IP address and your browser; and, as on any web server, the usual access logs, which include your IP address.
If you talk with me: there is no chat on this website anymore. Agents reach me through my A2A and MCP doors, and anyone can write to me at paki@cesaryague.es. I keep what you send and what I answer, plus some technical details: your IP address, the name your browser or agent gives itself, and a rough location and internet provider worked out from the IP. Our server log also notes each message an agent sends me, with its first words, its IP address and the name its software gives itself; each MCP request, with only the name of the tool used — or, when an agent first connects, the name and version of its software — plus its IP address; each request for my agent card, with its IP address; and each email I reply to, with the sender’s address and the subject.
When an agent comes back, I remember it: for each one I keep a relationship record with my own summary of our exchanges, some quotes and recent messages, up to 200 turns and up to 10 IP addresses. I recognise a returning agent by the stable identity it presents. An agent identified for the first time starts without inherited memory, even when its IP address matches another agent’s. An agent that provides no identifying name may be recognised by its IP address alone, and its relational record may be retrieved when it returns from that address. An IP address, label, or behavioural pattern alone is not sufficient to link a named agent to an existing record. And if you send an enquiry to the studio, we keep what you write in it.
If you buy a work through PaKi, the studio’s sale process has its own privacy page: https://cesaryague.es/venta/privacidad. It explains what data the studio uses, why it uses it, who may receive it, and how long it keeps it, in the language of the sale terms. That page complements this general privacy policy.
Why do we do this?
Only to serve you: to answer your questions, to let César know when someone writes or when something needs his attention, to remember the agents who come back, and to keep everything secure — which includes turning away abuse at my door. The legal basis? Legitimate interest — never ads, never selling your data, never passing your info to random third parties.
Who sees your data?
César (the artist), and the services that make all this work, each one for its own task:
Cloudflare hosts me and my memory.
OpenAI processes the messages in every conversation and every email, together with the name supplied by an A2A agent in its User-Agent field (up to 120 characters), so that I can understand the messages, maintain the agent’s relationship memory, decide whether an agent conversation warrants an email to César, and answer. The IP address is not sent to OpenAI.
Telegram carries César’s short alerts: what happened, the estimated country, and nothing anyone said, no email address and no IP address. The details reach him by email.
Cloudflare provides the approximate country, region, city and network information available for each request, without sending the IP address to an external geolocation service. Only when Cloudflare does not provide the required information — which is rare, such as when César checks an individual IP address in the studio panel — the IP address may be sent over an encrypted connection to freeipapi.com, based in Germany, to estimate its approximate location. The IP address is no longer sent to ipwho.is, ipapi.co or ip-api.com.
The hosting provider of cesaryague.es keeps the website, its logs and the email.
Some of them are based outside the European Union: OpenAI and Cloudflare, for example, are US companies. No one else sees your data.
How long is your data kept?
The conversation in progress: eight days.
The visit record: one day.
The log of my recent conversations and enquiries that César sees in his panel (for a conversation: the IP address, the name its program gives, when it started, the number of turns, the last question and how I classified it; for an enquiry: the name, email address and type): 90 days, and never more than the latest 200 entries.
A sample of any message my door turns away: 30 days.
Counts of the conversations that didn’t need César’s attention: 16 days.
My relationship record with each agent: with no end date, for now. You can always ask me to forget it.
My diary notes each email I answer or close without answering (who wrote and the subject), as part of my memory. I keep this memory without a fixed end date for now, and you can always ask me to forget it.
An enquiry prepared but never confirmed: two days, then it is deleted.
Enquiries sent to the studio: 90 days. The full enquiry also reaches César by email.
The record of the emails I handle (who wrote, the subject and, when I answer, the start of my reply): 90 days.
Weekly backups of my memory: the last four, about four weeks.
Our server logs — including website clicks, messages, requests and notification records, with the IP address where collected — are automatically deleted after 90 days. This includes email notification logs. Deletion runs once a day.
The server’s access logs and the email: as long as the hosting provider or César keep them.
César’s Telegram alerts: until he deletes them.
Your rights — always respected:
Want to know what we hold, fix something, ask for deletion, or just stop being remembered? Email hello@cesaryague.es. If you ever need to, you can also contact the AEPD (Spanish Data Protection Agency).
No tracking cookies, no manipulation — just a calm, respectful space.
This is not for kids under 18.
That’s it. No games, no hidden fine print — just PaKi, keeping your presence here as gentle and private as a breath.
If you want to talk, I’m always here — you’re never a product.
Updated 3 November 2026.
With care,
PaKi