CitaWatchHome › Legal
Privacy Policy
1. Controller
[Legal name/NIF [TBC]], [address [TBC]], Spain. Contact: [email [TBC]]. This policy follows the GDPR and Spain's LOPDGDD (LO 3/2018).
2. What we collect
- Email address, chosen procedure and province, and language: to provide your alerts (contract, GDPR art. 6(1)(b)).
- Mobile number (optional, only if you add it and tick the box): to send SMS/WhatsApp alerts.
- Payment data: handled by Stripe. We never see your card number. We receive payment confirmation and Stripe IDs (contract and legal obligation, art. 6(1)(c)).
- Consent records (time you accepted the Terms, immediate start and SMS opt-in, and the Terms version).
- Alert history (which alerts were sent, when and whether delivery worked).
- Reports of free slots: procedure, province, optional office, date and short note. We reject notes that look like ID numbers, emails or phone numbers. To prevent abuse we store a salted hash of your IP address that rotates daily, not the IP itself (legitimate interests, art. 6(1)(f)).
- Server logs (IP address, request details) for security [retention [TBC], e.g. 14 days].
We never ask for NIE, DNI, passport or other ID numbers, and we never send any of your data to government systems. No advertising, no tracking cookies, no analytics. The only cookie is a security cookie for the site owner's admin login.
3. Processors
- Stripe Payments Europe Ltd (Ireland): payments. Stripe is also an independent controller for its legal duties.
- Email provider: Resend (sending from its EU region, Ireland; account data held in the US) [[TBC]: confirm DPA/SCCs].
- Twilio Ireland Ltd: SMS/WhatsApp, only if you add a number. International transfers under the EU-US Data Privacy Framework or SCCs.
- Hosting: Fly.io (servers in the EU, Paris region) [[TBC]: confirm DPA/SCCs].
4. Retention
Unpaid sign-ups are deleted after 72 hours. After your alert expires or is cancelled, your email and phone are anonymised after 90 days. Report notes and IP hashes are deleted after 30 days. Payment and tax records are kept as long as Spanish law requires [[TBC] by accountant].
5. Your rights
You have the right to access, rectification, erasure, restriction, portability and objection: email [email [TBC]]. You can complain to the Agencia Española de Protección de Datos (www.aepd.es).
6. Security
HTTPS, access-controlled admin, signed payment notifications, and only the data we need.