1. Introduction
This Privacy Policy explains how personal data is processed when you use Yiropa (the "Service"), available at https://yiropa.org. By using the Service, you confirm that you have read and understood this Policy. If you do not agree, please do not use the Service.
2. Data Controller
Data controller: Trade name: Yiropa Contact email: yiropa.org@gmail.com Address: Zaragoza, Spain
3. Data We Collect
We may process the following categories of data: • Identification and contact data: email address and authentication identifiers (Google OAuth or magic link). • Profile data: birth year, sex, and country, used solely for aggregated demographic statistics. • Usage data: votes, streaks, friend connections, push notification preferences, and subscription tokens. • Technical data: IP address, browser type, device information, and security logs. We do not sell your personal data or use it for behavioural advertising.
4. Purposes of Processing
We process your data to: • Manage your registration, access, and use of the Service. • Verify that you are a real person and prevent abuse or fraud. • Calculate anonymous aggregate participation statistics. • Send magic links and, if you opt in, push notifications. • Comply with legal obligations and enforce our Terms of Service.
5. Legal Basis (GDPR and Spanish Law)
Processing is based on: • Performance of a contract (Art. 6(1)(b) GDPR): providing the Service you request. • Legitimate interests (Art. 6(1)(f) GDPR): security, fraud prevention, and service improvement. • Consent (Art. 6(1)(a) GDPR): push notifications and non-essential cookies, where applicable. • Legal obligation (Art. 6(1)(c) GDPR): compliance with applicable law, including the Spanish LSSI-CE.
6. Processors and Third Parties
We may share data with service providers acting as data processors: • Supabase (database and authentication). • Vercel (hosting and deployment). • Google (OAuth authentication, if you choose that option). • Email providers for magic link delivery. All processors are bound by contractual confidentiality and security obligations. We do not share your individual votes with third parties.
7. Retention Periods
We retain data while your account is active and for as long as necessary to meet legal obligations. If you delete your account, we remove associated profile and authentication data. Votes are stored under rotating monthly pseudonyms, without permanent linkage to your identity, in line with our Privacy by Design model.
8. Security Measures
We apply appropriate technical and organisational measures: HTTPS encryption, row-level security (RLS) on database tables, rate limiting, structural separation between authentication and vote activity, and restricted access controls. No system is infallible; we cannot guarantee absolute security.
9. Your Rights
You may exercise your rights of access, rectification, erasure, restriction, objection, and portability, and withdraw consent where processing is consent-based. To exercise your rights, email yiropa.org@gmail.com stating which right you wish to exercise and verifying your identity. You may lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.
10. Cookie Policy
This application uses only technical and session cookies that are strictly necessary for the operation of the service (such as securely maintaining your logged-in session or remembering your language preference). We do not use third-party analytics, advertising, or tracking cookies; therefore, your prior consent for their installation is not required. You may configure your browser to block cookies, though this may affect Service functionality.
11. Google Sign-In
If you sign in with Google, we receive the basic information authorised by your account (typically your email address). Google processes your data under its own privacy policy. Yiropa uses this information solely for authentication and abuse prevention; we do not access your vote history or activity from Google.
12. Minors
The Service is not directed at users under 14 years of age. We do not knowingly collect data from minors. If we become aware that a minor has provided data, we will delete it. Contact yiropa.org@gmail.com if you believe this has occurred.
13. Changes
We may update this Policy to reflect legal or Service changes. The current version will be published on this page with the updated date. Material changes will be communicated by reasonable means when necessary.
14. Contact
For privacy and data protection enquiries: Yiropa yiropa.org@gmail.com Zaragoza, Spain