PRIVACY POLICY

Last updated: [PENDIENTE: date]

1. Controller

[PENDIENTE: full legal name of the operator], tax ID [PENDIENTE: NIF/CIF], registered address [PENDIENTE: full address, Spain]. Contact: . Data protection officer: [PENDIENTE: DPO or "not appointed"].

2. What we process, why, and on what basis

Project data (name, URL, description, owner email): to publish and operate your project and to send you service emails about it. Basis: performance of the contract (art. 6.1.b GDPR). Kept while the project exists and for the legally required period afterwards.
Payment data: handled by Stripe. We never see or store card numbers. We keep the payment reference, amount and date. Basis: contract and legal accounting obligations (art. 6.1.b and 6.1.c). Kept for the statutory retention period.
Voting data: a one-way hash of your IP address combined with a random cookie identifier. We do not store raw IP addresses for voting. Basis: legitimate interest in preventing fraud and abuse (art. 6.1.f). Deleted after 90 days.
Newsletter: your email address, the wording you consented to, the time and a hash of the IP used to give consent, as proof of consent. Basis: your consent (art. 6.1.a), which you can withdraw at any time. Kept until you unsubscribe.
Reports: the reason, any details you write, and a hashed IP. Basis: legitimate interest in moderating the service.

Project owner emails and newsletter subscribers are kept separate. Giving us an email to run your project is not consent to marketing, and we do not add project owners to the newsletter.

3. Who we share it with

Processors acting on our instructions: [PENDIENTE: hosting provider, e.g. Vercel Inc.], [PENDIENTE: database provider], Stripe Payments Europe Ltd (payments), Resend (transactional and marketing email), and Cloudflare (anti-abuse challenge). Some of these may process data outside the EEA under the European Commission's standard contractual clauses or an adequacy decision. We do not sell personal data.

4. Your rights

You can request access, rectification, erasure, restriction, portability and objection, and withdraw consent at any time, by writing to . If you believe we have mishandled your data you can complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos (aepd.es).

5. Security

Data travels over TLS. Management links and confirmation tokens are stored only as hashes. IP addresses used for voting and rate limiting are stored only as salted hashes.