Privacy policy

01Controller

The data controller is Ilia Maquilón Pérez; their full details (tax ID and address) are in the Legal notice. For any privacy question, write to [email protected].

02What data we process

• Account: your email address, which we store encrypted, and a fingerprint of your password (never the password). If you sign in with Google, we only store a fingerprint of your Google ID. We don't ask for your name, address or photo.
• Telegram: your ID and username, when you connect the bot.
• Alerts and preferences: languages, alert types, keywords in your filters, muted stores, alerts with their target price, sets you follow and quiet hours.
• Payment: your plan, dates and invoices. Card details are handled by Stripe; we only see the last four digits.
• Technical use: IP address, browser, and access and error logs.

If you use the bot without a web account, we only store your Telegram ID and your bot preferences. If you only follow the community channel or group, we don't store any of your data.

03What we use it for

You can withdraw your consent to the emails at any time, in Settings → Preferences.

04How long we keep it

As long as you have an account. If you delete it, we erase your data at once, except what the law requires us to keep, such as invoices, for 6 years. Technical logs (access and errors) are deleted after 90 days. Google Analytics data is kept for 14 months.

05Who we share it with

We don't sell your data. We only share it with providers that help us run the service and are bound to protect it:

• OVH, with servers in France, where the website and the bot run.
• Stripe, for payments.
• Brevo, for account emails.
• Cloudflare, which protects the website and sees the IP address of your visits.
• Google (Google Ireland Ltd.), for website analytics and ad measurement, only if you accept those cookies.
• Telegram, to deliver your alerts. Telegram also applies its own privacy policy.

We may also disclose it to the authorities when the law requires it.

06Transfers outside the EU

If a provider processes data outside the European Economic Area, it does so with GDPR safeguards: an adequacy decision of the European Commission or standard contractual clauses. Google may process data in the United States; it does so under the EU-US Data Privacy Framework. Telegram, which delivers the alerts, processes data from the United Arab Emirates under its own privacy policy; using Telegram to receive them is your choice.

07Your rights

You can ask us to access your data, correct it, delete it, take it to another service, restrict its use or object to it. Write to [email protected] saying which right you want to exercise; we'll answer within one month at the latest. You don't need to ask for your copy: Settings → My account → Your data → Download.

If you think we haven't handled your data properly, you can file a complaint with the Spanish Data Protection Agency at www.aepd.es.

08Security

All communication travels encrypted (HTTPS). Your email is stored encrypted (AES-256), passwords with Argon2id and sessions only as a fingerprint. We limit sign-in attempts and make encrypted backups every day.

09Minors

The service is not aimed at children under 14. If we detect an account belonging to someone under that age, we'll delete it.

10Drops (giveaways)

If you enter a Drop we process your Telegram identifier, that you accepted the rules and whether you are still with the bot (without leaving or blocking it), to check the requirements and run the draw. If you win, we also process your name, address and phone number to send you the prize, and we publish your Telegram username (or your display name) with the result, as you accept in the rules. The legal basis is performing the rules you accept when you enter. We keep the list of entries until three months after the draw and shipping data until the prize is delivered, unless the law requires otherwise. Each Drop details its own in its rules.

11Cookies

Cookies are small files the website stores in your browser. We use three kinds:

Technical cookies don't need your consent. Analytics and advertising cookies are only used if you accept them; otherwise nothing is downloaded from Google.

Cookieless statistics: Cloudflare Web Analytics counts visits without storing anything on your device. We do it on the basis of legitimate interest, to have aggregate statistics.

Sign-ups and payments measured from the server: if you accepted analytics, the bot and our server send Google Analytics the start of your trial and your payments, linked to your visit with an identifier that contains no personal data.

You can change or withdraw your consent at any time from the “Cookie settings” link in the footer. When you withdraw it, we delete the Google Analytics cookies.

12Changes to this policy

If we change anything important, we'll tell you by email or through the bot before it applies.