1. Introduction
This Privacy Policy explains how personal data is processed when you use Yiropa (the "Service"), available at https://yiropa.org. By using the Service, you confirm that you have read and understood this Policy. If you do not agree, please do not use the Service.
2. Data Controller
Data controller: Trade name: Yiropa Contact email: yiropa.org@gmail.com Place of reference: Zaragoza, Spain Still to be completed by the operator before the identification required by Article 10 of the Spanish LSSI-CE can be treated as published: legal name or company name, tax ID (NIF), and full address. Until then, the contact channel is the email above.
3. Data We Collect
We may process the following categories of data: • Identification and contact data: email address and authentication identifiers (Google OAuth or magic link). • Profile data: birth year, sex, and country, used for aggregated demographic statistics. • Daily votes: stored under a monthly pseudonym derived from your identifier and a key that stays on the server. Anyone who has both can reconstruct the history. • Life-saver votes: the chosen option is stored with your account. It is not added to global or circle aggregates, and it is deleted with the account. • Usage data: streaks, friend connections, push notification preferences, and subscription tokens. • Technical data: IP address, browser type, device information, and security logs. We do not sell your personal data or use it for behavioural advertising.
4. Purposes of Processing
We process your data to: • Manage your registration, access, and use of the Service. • Verify that you are a real person and prevent abuse or fraud. • Calculate aggregate participation statistics. A daily vote is not shown with your name, but the monthly pseudonym is not irreversible anonymity. • Send magic links and, if you opt in, push notifications. • Comply with legal obligations and enforce our Terms of Service.
5. Legal Basis (GDPR and Spanish Law)
Processing is based on: • Performance of a contract (Art. 6(1)(b) GDPR): providing the Service you request. • Legitimate interests (Art. 6(1)(f) GDPR): security, fraud prevention, and service improvement. • Explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR): questions may reveal opinions, including political opinions. By registering you agree that those answers, together with age, sex, and country, are used in aggregate statistics. • Consent (Art. 6(1)(a) GDPR): push notifications, when you turn them on. • Legal obligation (Art. 6(1)(c) GDPR): compliance with applicable law, including the Spanish LSSI-CE.
6. Processors and Third Parties
We may share data with service providers acting as data processors: • Supabase (database and authentication). • Vercel (hosting and deployment). • Google (OAuth authentication, if you choose that option, and push delivery on browsers that use its services). • hCaptcha (abuse check when you request a magic link). • The email provider that sends magic links. • The browser push service (Google, Mozilla, or Apple, depending on the device). Supabase, Vercel, and Google may process data outside the European Economic Area. That processing relies on standard contractual clauses or another Chapter V GDPR safeguard. We do not share your individual votes with third parties for their own purposes.
7. Retention Periods
We retain data while your account is active and for as long as necessary to meet legal obligations. If you delete your account, we remove the profile, authentication data, life-saver votes, friendships, push subscriptions, and vote rows tied to your monthly pseudonyms. Global counts by age, sex, and country do not carry your identifier and are kept. We cannot reliably attribute one of those rows to a single account in order to delete it.
8. Security Measures
We apply appropriate technical and organisational measures: HTTPS encryption, row-level security (RLS) on database tables, rate limiting, structural separation between authentication and vote activity, and restricted access controls. No system is infallible; we cannot guarantee absolute security.
9. Your Rights
You may exercise your rights of access, rectification, erasure, restriction, objection, and portability, and withdraw consent where processing is consent-based. To exercise your rights, email yiropa.org@gmail.com stating which right you wish to exercise and verifying your identity. You may lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.
10. Cookie Policy
This application uses technical and session cookies required to operate (keeping you signed in or remembering your language). The hCaptcha check on the magic link may set technical security cookies. We do not use analytics or advertising cookies. You may configure your browser to block cookies, though this may affect Service functionality.
11. Google Sign-In
If you sign in with Google, we receive the basic information authorised by your account (typically your email address). Google processes your data under its own privacy policy. Yiropa uses this information solely for authentication and abuse prevention; we do not access your vote history or activity from Google.
12. Minors
The Service is aimed at people in Spain who are at least 14 years old. Age is whatever you declare at registration; we do not check an identity document. We do not knowingly collect data from anyone under 14. If we become aware that a minor has provided data, we will delete it. Contact yiropa.org@gmail.com if you believe this has occurred.
13. Changes
We may update this Policy to reflect legal or Service changes. The current version will be published on this page with the updated date. Material changes will be communicated by reasonable means when necessary.
14. Contact
For privacy and data protection enquiries: Yiropa yiropa.org@gmail.com Zaragoza, Spain