Privacy Policy

1. Controller

Controller: the operator of COMPARIO identified in the Legal notice. Email: privacidad@compario.lat.

COMPARIO is a personal, non-profit project with no advertising or charges. It does not sell personal data, build advertising profiles or use advertising or analytics cookies.

If COMPARIO starts any economic activity, we will update this policy and the Legal notice beforehand.

2. Data we process

Browsing: you can use the site without registering. Our hosting and network providers process technical data (IP address, browser, requests and security events) to serve and protect the site.

Account: if you register with email we process your email, an internal identifier and session data. If you sign in with Google we receive what Google shares under the permissions you accept (usually an identifier, email and basic profile). We never receive your Google password.

Contributions: if you submit prices, receipts or photos we process the product, merchant, price, currency, date, approximate location and the image. A receipt may contain personal data; please cover it before uploading.

Contact, support and volunteering: your email, your message and anything you choose to include.

3. Purposes and legal bases

Providing the service you request (account, contributions, replies): performance of the requested service (Art. 6(1)(b) GDPR).

Security, fraud and abuse prevention, and moderation: legitimate interest in protecting the service and its users (Art. 6(1)(f) GDPR).

Legal obligations, such as handling notices of illegal content or requests from authorities (Art. 6(1)(c) GDPR).

If we ever rely on consent (for example optional communications), you can withdraw it at any time.

4. Receipt review

A person reviews every receipt before any price is published. If we ever use an automated tool to read them, we will name it here before enabling it. We do not make solely automated decisions with legal or similarly significant effects on you.

5. Providers and international transfers

We use these providers, only as needed: Cloudflare (web hosting, network and evidence image storage), OVHcloud (servers and database), Google (sign-in) and Resend (email delivery).

Some may process data outside the European Economic Area, in particular in the United States. Such transfers rely on GDPR mechanisms, such as the EU-US Data Privacy Framework where the provider is certified or the European Commission’s standard contractual clauses.

6. Retention

Account: while active. If you ask us to delete it, we delete or anonymise its data except what we must keep by law or to defend claims, for the necessary period.

Contributions: published prices are kept as price data not publicly linked to your identity. Evidence images are kept only as long as needed to verify the data and handle reviews.

Technical and security logs: as long as reasonably necessary to protect the service.

7. Your rights

You may request access, rectification, erasure, objection, restriction and portability, and withdraw consent where processing relies on it. Write to privacidad@compario.lat. We will only ask for what is needed to verify your identity.

You may complain to the Spanish Data Protection Agency (aepd.es) or to the authority in your country.

8. Minors, security and changes

Registration and contributions are for people aged 18 or over. If we find a minor’s data, we will delete it.

We apply reasonable technical and organisational measures: encrypted connections, restricted access and review of contributions. If we materially change how we process data, we will update this policy before the change applies.