Privacy Policy

1. What we collect and why

• Newsletter — your email address, the source page, the exact consent wording you accepted and the timestamp. Legal basis: your consent (Art. 6.1.a GDPR). Stored until you unsubscribe or ask for deletion.
• Votes and rate limiting — a one-way hash of your IP address plus the user agent. We never store the raw IP. Legal basis: legitimate interest in preventing abuse (Art. 6.1.f). Retention: 12 months.
• Product submissions — the product data you send and, optionally, your email. Legal basis: consent / pre-contractual steps.
• Saved stacks — the tools you select and the store profile you enter. Anonymous unless you sign in. A claim token is kept in your browser.
• Sponsorships — billing email, brand details, payment reference and the timestamp of your acceptance of the terms. Card data is handled by Stripe and never touches our servers. Legal basis: performance of a contract (Art. 6.1.b) and legal accounting obligations (Art. 6.1.c). Invoices are kept for the statutory period (up to 6 years).
• First-party analytics — page path, event name and timestamp, only if you accept analytics in the cookie banner. No third-party trackers, no ad pixels, no cross-site profiling.

2. Who processes data on our behalf

Supabase (database and authentication, EU region), Cloudflare (hosting and delivery), Stripe (payments) and, when enabled, our transactional email provider. Each acts as a data processor under a DPA. Some providers may transfer data outside the EEA under Standard Contractual Clauses.

3. Your rights

You can request access, rectification, erasure, restriction, portability and object to processing, and withdraw consent at any time without affecting prior processing. Write to us through the about page. You may also lodge a complaint with the Spanish supervisory authority (AEPD, www.aepd.es).

4. Security

Data is stored on encrypted managed infrastructure with row-level access rules. Access is limited to the controller. We do not sell or rent personal data to anyone.

5. Children

The service is not directed at people under 16. We do not knowingly collect their data.

6. Changes

We may update this policy. Material changes will be announced on this page with a new revision date. See also the Cookie Policy and the Terms & Conditions.