Last updated: 24 October 2026

At Olvidalacama we only process the data needed for the community to work. We do not sell data, show advertising, use analytics or tracking tools, or send marketing communications. This policy complies with Regulation (EU) 2016/679 (GDPR) and Spain's Organic Law 3/2018 on data protection (LOPDGDD).

1. Data controller

2. What data we process

If you are just browsing

You can browse Olvidalacama without signing up and without us storing any cookie in your browser. To serve you the pages and protect the site, our server and our network provider (Cloudflare) process your IP address and technical connection data, such as your browser or the page requested. We do not use that data to identify you or to build profiles. To count the views of each place without counting the same one twice, we keep an encrypted, irreversible fingerprint of your IP address alongside the place viewed for 24 hours, without cookies.

If you create an account

  • Registration data: username, email address, province and password. Your password is stored encrypted with a one-way algorithm: nobody, not even the team, can read it.
  • Profile data, optional: surname, sex, town or city, date of birth, description and profile photo.
  • What you post: places, photos, comments, ratings and stories. When you upload a photo we remove its metadata (such as its GPS location or the camera model).
  • Your activity: your likes, who you follow, your points and achievements, your notifications and the reports you send.
  • Security data: the IP address and date of sign-ins and sensitive actions, to curb abuse.

What is public. Your username, photo, description, province and public activity (places, comments, stories, ratings, points and achievements) can be seen by anyone. Your email address, password, reports and security data are never shown.

3. Data about your sex life

Because of what the community is about, your participation may reveal information about your sex life, which the GDPR treats as a special category of data. We process it with your explicit consent, which you give us when you sign up (Article 9(2)(a) GDPR), and to the extent that you make it public yourself when you post (Article 9(2)(e)). You can withdraw your consent at any time by asking us to close your account. We recommend that you use a nickname and do not post details that could identify you.

4. What we use your data for and on what legal basis

  • Managing your account and providing the service (posting, commenting, rating, following other members, receiving notifications on the website): performance of the contract you accept when you sign up (Article 6(1)(b) GDPR) and your explicit consent for the data in the previous section.
  • Sending you necessary emails to verify your address, recover your password and tell you about changes to your account or to the terms: performance of the contract.
  • Keeping the site secure, preventing spam and fraud, and moderating content: legitimate interest in protecting the community (Article 6(1)(f)) and legal obligations as a provider of digital services (Article 6(1)(c)).
  • Handling requests from authorities and complaints: compliance with legal obligations (Article 6(1)(c)).

We do not take automated decisions that produce legal effects on you, and we do not build commercial profiles.

5. How long we keep it

  • Account data and content: for as long as your account is active. When you ask to close it, we will delete or anonymise your data within 30 days at most. We will only keep, blocked, the data needed to deal with any legal liability, for the applicable limitation periods.
  • Technical and security logs: 30 days at most, unless they are needed to investigate a specific incident.
  • Backups: renewed automatically and deleted after 30 days at most.

6. Who else processes your data

We do not pass your data on to third parties unless required by law. To provide the service we rely on these providers, who act as data processors under a contract that requires them to protect your data and to use it only on our instructions:

  • IONOS SE (European Union): hosting of the server and the database.
  • Cloudflare, Inc.: content delivery network, protection against attacks, and storage of photos and backups.
  • Resend (Plus Five Five, Inc.): sending the account emails.

Cloudflare and Resend are based in the United States, so some data may be transferred outside the European Economic Area. Those transfers are covered by the EU-US Data Privacy Framework or by the standard contractual clauses approved by the European Commission.

In addition, some features make your browser connect directly to third-party services, which receive your IP address: the maps are loaded from OpenFreeMap; address search uses Photon (komoot, Germany); and when you add a place you may see street-level photos from Mapillary (Meta) and Panoramax. None of them sets cookies from Olvidalacama.

We will disclose data to judges, courts, law enforcement or other authorities when the law requires us to.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time, and withdraw your consent without affecting any processing carried out before. You can change much of your data yourself from your profile. For anything else, write to [email protected] from your account's email address, saying which right you wish to exercise. We will reply within one month at most.

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD).

8. Minors

Olvidalacama is for over-18s only. We do not knowingly process data of minors. If we find that an account belongs to a minor, we will close it and delete its data. If you become aware of this, please let us know.

9. Security

We apply technical and organisational measures appropriate to the risk: encrypted connections (HTTPS), encrypted passwords, restricted access to the administration with two-factor authentication, backups in private storage and regular security updates. If a security breach occurred that posed a risk to you, we would inform you and the Spanish Data Protection Agency.

10. Changes to this policy

We may update this policy to reflect legal changes or changes to the service. The version in force is always the one published on this page. If the change is significant, we will let you know by email.