Privacy

1. Controller

The controller is the operator of Quiemtoca.cat.

To exercise rights or ask a privacy question, use the “Report a bug” form on the site (say that it is a privacy request).

2. Data we process

• Group name and, optionally, the creator’s email.
• Participant names and, if provided, their emails.
• Anonymous budget votes, exclusions and the draw result (stored encrypted).
• Private access links (tokens) to manage the group, join it or view the result.
• Basic technical request data needed for security and abuse limits.
• If you send a bug report: title, description, optional email and the public path (never private URL keys).
• If you make a voluntary contribution (“Buy me a coffee?”): Stripe processes the payment; Quiemtoca does not store full card details.

3. Why we use it

To create and run the draw you ask for, send access or result emails when needed, keep private access working, limit abuse and — only with your consent — measure homepage usage with Google Analytics.

4. Providers

Hosting and database: Cloudflare (Workers and D1, with EU jurisdiction when provisioned).

Transactional email: Cloudflare Email Sending in production. Resend may remain as a transition or rollback path.

Voluntary payments: Stripe.

Optional analytics: Google Analytics 4, only after you accept cookies on the homepage.

Some providers may process data outside the EEA with the safeguards required by applicable law.

5. Retention

Groups expire and are deleted after the configured retention period (default 60 days from creation).

Email attempts and events are cleaned periodically so delivery evidence is time-bounded.

Stripe contributions are retained in the payment provider’s records under their obligations.

6. Your rights

You may request access, rectification, erasure, restriction or objection, and withdraw analytics consent at any time (see the cookie policy).

You may also complain to the Spanish Data Protection Agency (aepd.es).