Privacy Policy

This policy explains what personal data BuscoPadel processes, why, for how long and what rights you have over it. It applies to the BuscoPadel app (iOS, Android and the web version at app.buscopadel.com), to the API that powers it (api.buscopadel.com) and to the website buscopadel.com.

We have tried to write it in plain language. If anything is unclear, write to us.

1. Data controller

• Owner: Ángel Carracedo Ureña
• Tax ID (NIF): 53079120L
• Address: Carrer Pompeu Fabra 8, 08390 Montgat (Barcelona)
• Privacy contact email: info@buscopadel.com

We have not appointed a Data Protection Officer because, given the type and volume of processing, the law does not require one. For any privacy matter, use the email above.

2. What data we process

When you create an account with your email

Data	Required	Why
First name and surname	Yes	To identify you within the app
Email address	Yes	To sign you in, verify your account and send you service notices
Password	Yes	To protect your account. We only store an irreversible digest (hash), never the password itself
Date of birth	No	If you provide it, it is stored in your account
Language	Automatic	To write to you in your language (Spanish, Catalan or English)
Date and version of the legal texts you accepted	Automatic	To be able to prove what you accepted and when

When you sign in with Google, Apple or Facebook

If you choose one of these providers, we receive from it your account identifier with that provider, your name and your email address. We use them to create your account or sign you in, just as if you had registered with your email.

• We do not receive or store your provider password or its access credentials.
• Apple lets you hide your real email ("Hide My Email"). In that case we receive a forwarding address created by Apple and never learn your real email.
• The provider processes your data under its own privacy policy: Google, Apple, Meta (Facebook).

While you use the service

• Open sessions: when you sign in, we create an access credential for your device, together with the device name sent by the app (currently just the platform type: iOS, Android or web). The session does not store your IP address or your location.
• Email change: while you confirm a new email address, we store it as "pending" alongside your current one.
• Security: to stop attacks (for example, repeated attempts to guess a password), we use your IP address at the time of the request. It is only stored as an irreversible digest (hash), on its own or combined with the email address, for a maximum of 24 hours.
• Technical logs: the server logs errors and requests, which may include your IP address, in order to fix faults and detect abuse.

What we do not do

• We do not use your data for advertising or build commercial profiles.
• We do not sell or share your data with third parties for their own purposes.
• We do not use analytics or tracking tools, either in the app or on the website.
• We do not access your location, contacts or photos.

3. Purposes and legal basis

Purpose	Legal basis (GDPR)
Creating and managing your account and providing the service	Performance of the contract you accept when registering (Art. 6(1)(b))
Sending you the emails the service needs: account verification, email change confirmation and password recovery	Performance of the contract (Art. 6(1)(b))
Protecting accounts and the service against abuse and attacks	Legitimate interest in keeping the service secure (Art. 6(1)(f))
Keeping proof of which texts you accepted and when	Compliance with legal obligations and legitimate interest in defending ourselves against claims (Art. 6(1)(c) and 6(1)(f))

4. How long we keep it

Data	Period
Account that is never verified	Deleted 7 days after registration
Data of an active account	For as long as you keep it
When you delete your account	Your personal data (name, surname, email, date of birth, password and sessions) is deleted immediately
Anonymised record of the deletion	We keep a record with no identifying personal data (an internal number, the language, the version of the texts accepted and the dates). It serves as proof of consent for as long as claims can be brought
Open sessions	Until you sign out or they are closed for security reasons (see section 8)
Verification, email change and password recovery links	Expire after 60 minutes
Technical logs	14 days
Backups	They are overwritten on a rolling basis: deleted data disappears from them within 30 days at most

5. Who we share data with

Only with the providers we need in order to run the service. They process data on our behalf and following our instructions (data processors):

• Server hosting: IONOS Cloud S.L.U., with servers in the European Union
• Email delivery: IONOS Cloud S.L.U.

In addition:

• Google, Apple and Meta, only if you choose to sign in with them (see section 2).
• Leaked password check: when you choose a password, we check whether it appears in public data breaches using the Have I Been Pwned service. Only the first 5 characters of an irreversible digest (hash) of the password are sent, never the password or any of your data, so the service cannot tell whose it is.
• Authorities, when the law requires it.

International transfers

Your data is hosted on servers located in the European Union, so we do not transfer it outside the EU. Google, Apple and Meta may process data in the United States. These companies participate in the EU-U.S. Data Privacy Framework, which the European Commission considers an adequate safeguard.

6. Minimum age

You must be at least 14 years old to create an account. This is the age from which Spanish law allows you to give consent without authorisation from their legal representatives. If we find out that an account belongs to someone under that age, we will delete it.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time. To do so, write to info@buscopadel.com from your account's email address. We will reply within one month at the latest.

• You can delete your account directly from the app. See Delete your account.
• If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).

8. Security

• Communications are encrypted (HTTPS).
• Passwords are stored using an irreversible hashing algorithm.
• On mobile, the session credential is stored in the system's secure storage (iOS Keychain or Android Keystore).
• Signing out closes the session on that device. Changing your password closes the sessions on your other devices. Resetting your password, confirming an email change or deleting your account closes all of them.

9. Changes to this policy

Each version of this policy is dated and previous versions are kept. New versions are published here with their effective date. If a change significantly affects how we process your data, we will also let you know by email or in the app.