Privacy Policy

1. Who We Are (Data Controller)

For all privacy-related requests — access, deletion, objection — email us at bilbaogems@gmail.com. We will respond within 30 days.

2. Data We Collect

a) Account and authentication data

When you create an account or log in, we collect your email address. If you sign in with Google, we also receive your display name and profile picture URL as shared by Google during authentication. We do not store passwords — authentication uses magic links (passwordless email) or Google OAuth.

b) Usage preferences

We store a timestamp of when you accepted these terms (required by law), and your notification channel preference (whether you opted in to receive editorial tips by email).

c) Location data — in-session only, never stored

When you use the Map view, your browser may request GPS access to show your position on the map. When you use Compass Mode, your GPS coordinates and device orientation are processed in real-time in your browser to calculate direction and distance to a point of interest.

Your location data is never transmitted to or stored on our servers. It lives only in your browser for the duration of that session.

d) Analytics data (with your consent only)

If you accept analytics cookies, Google Analytics 4 collects information about how you use the app: pages visited, session duration, approximate geographic location (city/region level, not GPS), device type, and browser type. This data is collected and stored by Google, not by us directly.

e) Technical data automatically processed by infrastructure

When your browser connects to our app, our hosting provider (Vercel) and database provider (Supabase) automatically process your IP address and standard HTTP request metadata for security and operational logging purposes. This is standard web infrastructure behaviour and is retained briefly (typically 30 days) for security reasons.

3. Legal Basis for Processing (GDPR Art. 6)

4. Third-Party Data Processors

We share your data with the following companies who process it on our behalf. Each is bound by a Data Processing Agreement and must comply with GDPR.

For each processor's full privacy policy, follow these links: Supabase · Google · Mapbox · Cloudinary · Vercel

5. International Data Transfers

All third-party processors listed above are based in the United States. Data transfers from the EU to the USA are carried out under one of the following legal mechanisms, as required by GDPR Chapter V:

• →EU–US Data Privacy Framework (DPF): For processors that are DPF-certified, including Google and Mapbox. The DPF was adopted by the European Commission on 10 July 2023 (adequacy decision).
• →Standard Contractual Clauses (SCCs): For processors not covered by the DPF (Supabase, Cloudinary, Vercel), we rely on the EU Commission-approved SCCs (2021/914/EU) included in our data processing agreements with those providers.

You can learn more about international transfers at the AEPD website (aepd.es).

6. Data Retention

7. Your Rights Under GDPR

You have the following rights over your personal data. To exercise any of them, email bilbaogems@gmail.com with the subject line “Data Rights Request”. We will respond within 30 days.

To withdraw cookie consent, click Cookie Settings.

To unsubscribe from email tips, click the unsubscribe link in any email we send you, or email us and we will remove you immediately.

8. Cookie Policy

What are cookies?

Cookies are small text files placed on your device when you use a website or web app. We use them to keep you logged in and, with your consent, to understand how people use the app.

Cookies we use

1. Strictly Necessary — no consent required

These cookies are essential for the app to function. They cannot be switched off while you use the service.

2. Analytics Cookies — consent required

These cookies help us understand how the app is used. They are only placed if you click “Accept all” in the cookie banner. You can withdraw consent at any time.

How to manage cookies

To change your cookie preferences at any time: Cookie Settings.

You can also control all cookies through your browser settings. Note that blocking all cookies will prevent you from staying logged in, as the Supabase session cookie is required for the app to work.

To opt out of Google Analytics specifically, you can install the Google Analytics Opt-out Browser Add-on.

9. Children's Privacy

Bilbao GEMS is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has registered an account, please contact bilbaogems@gmail.com and we will delete the account immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of the page will always reflect the most current version. For material changes that affect your rights, we will notify you by email (if you have opted in to notifications) or by a prominent notice in the app at least 30 days before changes take effect.

11. Contact Us & How to Complain

If you have questions or concerns about how we handle your data, please contact us first:

We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with Spain's data protection supervisory authority: