Privacy Policy

At GurePintxo we take your privacy seriously. This document explains who is responsible for your data, what data we collect, what we use it for and on what legal basis, who we share it with, and what rights you have over it.

• Controller: Sergio San Pedro Alvarez.
• Contact email: contacto@gurepintxo.com.

• Account data: name, email and password (stored encrypted, never in plain text) when you sign up.
• Profile photo (avatar): if you choose to add one. It is shown next to your name on the reviews you publish.
• Location: if you give us permission, we use your device's location to show you the nearest bars, calculate distances and centre the map. Your location is processed only on your device: we do not send it to our server or store it. You can withdraw this permission at any time from your device settings, although some map features will stop working.
• Content you create: your favourites, the routes you create, the reviews you publish (rating, comment and, if you add them, photos) and the bars you suggest.
• Basic technical data needed for the app to work (for example, the session token that keeps you signed in).

Performance of the service you request when signing up (Art. 6(1)(b) GDPR):

• Creating and managing your account and keeping you signed in.
• Verifying your email when you sign up, through an automated email.
• Saving and showing you your favourites, routes and reviews.
• Showing your reviews publicly to other app users, together with your name and profile photo.
• Handling the bars you suggest.

Consent (Art. 6(1)(a) GDPR):

• Location: only if you grant the permission on your device.
• Photos: your profile photo and your review photos, which you upload voluntarily.

You can withdraw your consent at any time by turning off the location permission, deleting the reviews to which you have added photos, or writing to us at contacto@gurepintxo.com to have your profile photo removed, without affecting the lawfulness of prior processing.

Legitimate interest (Art. 6(1)(f) GDPR):

• Keeping the app and its users safe and preventing abuse.
• Moderating content: reviewing reported reviews and suggested bars before they are published.

We do not sell or transfer your personal data to third parties for commercial purposes. To run the app we use the following providers, which process data on our behalf and only to provide their service to us:

• Railway: hosting of the app's server and database.
• Cloudinary: storage of photos (profile photos and review photos).
• Brevo: sending email verification messages.
• Google Maps Platform: displaying maps and searching for bars when you suggest a new one.

Some of these providers are based in the United States or may process data there. In those cases, international transfers are covered by the safeguards provided for in the GDPR: the EU-U.S. Data Privacy Framework, where the provider is certified under it, or the standard contractual clauses approved by the European Commission.

We keep your data while your account is active. If you delete your account:

• Your personal data (name, email, password and profile photo), your routes and your favourites are deleted.
• Your reviews, their photos and the bars you have suggested are kept anonymously: they are no longer linked to you and appear as "Anonymous".
• In the app you can only delete your reviews: if you do not want them kept, delete them before deleting your account. Suggested bars cannot be deleted in the app; to have them removed, write to us at contacto@gurepintxo.com.

All of the above applies unless the law requires us to keep specific data for a certain period.

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability at any time:

• In the app: in your Profile you can edit your data and delete your account.
• By email: by writing to us at contacto@gurepintxo.com.

If you believe we have not handled your data properly, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).

GurePintxo is not intended for children under 14 and we do not knowingly collect data from children under that age. If we detect an account belonging to a child under 14, we will delete it.

We may update this policy from time to time. If we make significant changes, we will notify you within the app.

If you have any questions about this privacy policy, write to us at contacto@gurepintxo.com.