Eatlas

Privacy policy

Last updated: 9 October 2026

This page explains what data we collect on the Eatlas website (geteatlas.app), what we use it for and what your rights are. We wrote it to be easy to read. The Spanish version prevails in case of doubt.

Who is responsible

Ibon Muruamendiaraz, tax ID 58031682Z, of Calle cola y goiti/ Vitoria. You can write to us at [email protected].

What data we collect

  • When you join: your email and the fact that you accepted this policy (with the date).
  • If you fill in the optional step: your name, which phone you use, what you are after, how you heard about us and whether you want news.
  • Automatically: where you came from (the link parameters and the referring site and, if someone shared their link with you, who it was), the page language and an irreversible code derived from your IP address to stop spam. We do not store the IP.
  • If you send feedback: what you write, your rating and, if you let us contact you, your email.
  • Visits: counted in aggregate and without cookies (Cloudflare Web Analytics). They cannot identify you.

What we use it for

  • Managing the waitlist, confirming your email and inviting you to the beta in sign-up order.
  • Writing to you about the beta: the confirmation email, the invitation with instructions and, during the beta, requests for feedback.
  • Sending you product news, only if you ticked the box.
  • Improving the app with your answers and learning which channels work (aggregate statistics).
  • Protecting the forms from abuse and bots.

We do not sell your data or use it for advertising, and we make no automated decisions that affect you.

Legal basis

  • Your consent (Article 6(1)(a) GDPR) for the list, the beta and the news. You can withdraw it at any time; this does not affect what we did before.
  • Our legitimate interest (Article 6(1)(f) GDPR) in keeping the forms secure and in aggregate statistics.

How long we keep it

  • For the duration of the beta and at most 12 months after it ends, unless you ask us to remove you sooner.
  • The IP-derived codes used against abuse are deleted after 2 days.
  • Feedback, for as long as it helps us improve the app. If you ask to be removed, it is deleted too.

Who else processes it

Companies that provide the service and only process the data on our instructions (processors):

  • Supabase: database and server functions. The data is stored in the European Union (Ireland).
  • Resend: sending the emails.
  • Cloudflare: website hosting, bot protection (Turnstile) and cookieless statistics.

These companies are based in the United States, so there may be international data transfers. They rely on the GDPR safeguards: the EU-US Data Privacy Framework where the provider takes part in it, or the European Commission’s standard contractual clauses.

Your rights

You can ask us to access, correct or delete your data, object to or restrict its use, or receive it in a portable format, and you can withdraw your consent. Write to [email protected] from the email you signed up with.

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es) or to your local authority.

Minimum age

If you are under 14, please do not sign up.

Cookies and storage in your browser

We use no advertising or tracking cookies. The site remembers in your browser that you have joined (to show your link when you come back) and, during the visit, where you came from. Cloudflare Turnstile may use the technical storage it needs to check that you are not a bot.

Changes

If we change this policy, we will update the date above and, for important changes, let you know by email.