Privacy policy

Summary

• You do not need to sign up to use Indalo Today.
• We only ask for personal data if you send us a plan (your name and how to reach you), sign up for the newsletter (your email) or report a problem.
• Your saved plans and chosen theme stay in your browser; they never reach us. If you switch language, we remember it with a cookie that only says “es” or “en”.
• We do not sell data or use tracking cookies. We count visits with our own tool, which uses no cookies and does not identify you.

Data controller

Pablo Manzano Vázquez. For any question about your data: indalotoday@gmail.com.

What data we process and why

When you send us a plan

Your name, email, phone (if you give it), organisation, type of sender and any message you leave, together with the details of the plan.

• Why: to review the plan, ask you for details if needed, confirm we have received it and let you know when a repeating plan is about to stop showing on the website. The email confirming it carries a private link where you see whether it is published and how many people open it and click its links: only those counts, nothing about anyone. The link stops working when we delete your data.
• Legal basis: your own request that we publish the plan (article 6.1.b of the GDPR). If you write on behalf of a business, an association or a town hall, also our legitimate interest in contacting whoever organises the plan (article 19 of the Spanish LOPDGDD). You can ask us to delete your data at any time: the plan can stay published without it.
• How long: up to 12 months after the last date of the published plan, or from when it stops showing on the website if that is earlier. If it is a place without dates (a bar, a museum), while it stays published and 12 months more. If it is never published, 6 months from when you sent it. We delete it automatically when the period ends.

If you sign up for the newsletter

Your email, the language of the page you signed up from, where on the website you did it, when you confirmed and which version of this notice you accepted, to be able to prove your consent. Your IP address is used for an hour at most to limit attempts and prevent abuse; it is not stored.

• Why: to send you, once a week, plans for the weekend in Almería. Some may be sponsored by whoever organises them; when they are, we always say so.
• Legal basis: your consent (article 6.1.a GDPR and article 21 of the Spanish LSSI-CE). We ask you to confirm it with a link sent to your email, so nobody can sign you up without you knowing. You can withdraw it at any time with the unsubscribe link in every email. If you are under 14, the consent must be given by a parent or guardian (article 7 of the Spanish LOPDGDD).
• How long: while you stay subscribed. When you unsubscribe we delete your email straight away. If you never confirm, we delete it after 30 days.

If you ask for the QR for your accommodation

The name of the accommodation, its area, how many guests it takes and your email. We keep them for the QR pilot: to send you the QR and write to you about the pilot. We keep nothing about your guests: we only count how many times your page and your routes are opened each day. Your IP address is used for a day at most, so the same visit is not counted twice and requests are not sent in bulk; it is not stored.

• Legal basis: your request to join the pilot (article 6.1.b GDPR).
• How long: while your accommodation is in the pilot. If it leaves, or does not join, we delete its data and its counts.

If you ask for a weather alert for a route

Your email, the route, the day and how you are going (with whom, at what pace). We use them only to write to you the evening before if the weather calls for plan B, and to send you the link to confirm the alert first. Your IP address is used for an hour at most, so alerts are not asked for in bulk; it is not stored.

• Legal basis: your consent, given when you ask for the alert and confirm it (article 6.1.a GDPR). You can remove it with the link in each email.
• How long: until the day of the route has passed; an alert you do not confirm is deleted after two days.

If you report a problem

The page, what is wrong, your explanation and, if you give them, your name and email. We do not store it on the website: it reaches us by email. Your IP address is used for an hour at most to limit reports and prevent abuse; it is not stored.

• Why: to review the report, act on the content and tell you what we decided. We do not tell whoever published the content who reported it, unless it is essential (for example, to settle a copyright claim), and then we ask you first. If the report points to a crime, we may pass it on to the police or the courts.
• Legal basis: a legal obligation (article 6.1.c GDPR): article 16 of the EU Digital Services Act requires us to receive and handle these reports.
• How long: in our mailbox, up to 12 months after we close the report, to be able to show how we handled it.

When you search for plans

What you type in the search box and the filters you choose (town, day, who with, budget). We do not link it to any person or account. Your IP address is used, for an hour at most, to limit the number of searches and prevent abuse; it is not stored with the search. The website does not ask for your location; if a search carries one, we only keep it rounded to about 1 km, enough for statistics but not to find anyone.

• Why: to give you results and, with aggregated data, to improve which plans we show and to prepare reports for town halls and associations on what people look for and do not find. Those reports only carry counts, never anything that identifies you.
• Legal basis: our legitimate interest in the search working well, not being abused, and in knowing, with aggregated data, what people look for in the province.
• How long: 12 months; after that they are deleted automatically.

To understand written searches we send the text to an artificial intelligence model. Please do not type personal data in the search box.

When you visit the website (statistics)

We count visits with Umami, installed on our own servers. It uses no cookies and stores nothing in your browser. It records the page you view (of what comes after the “?” in the address, only the campaign tags such as utm_source, which say whether you came from the newsletter or an ad), which website you came from, your type of browser, system and device, your language and your approximate country or city, which it works out from your IP address without storing it. It also counts actions such as searching, saving a plan or opening its website, never what you type. If your browser sends “Do Not Track”, it counts nothing.

On the routes we also count, by ourselves and only as numbers, how many times each one is opened, its “Take me there” is used and it is saved for offline use. Each device counts once a day: your IP address is used for that, for a day at most, and is not stored. If your browser sends “Do Not Track”, it counts nothing either.

Apart from that, we count how many times each plan’s page is opened and its links are followed, so whoever organises it can see it: only the number per day. Your IP address is used for half an hour so the same visit is not counted twice, and it is not stored.

• Why: to know which parts of the website are used and improve them.
• Legal basis: our legitimate interest in knowing how the website is used, with data that identifies no one.
• How long: 25 months; after that, we delete them.

Plans we take from public listings and Instagram

Some plans come from public listings (websites of town halls and other bodies) and from professional Instagram accounts that have given us permission. They may include the name of whoever organises them, photos and, in videos, what is said in them, which we transcribe with artificial intelligence to extract the date, place and price.

• Why: to share plans and activities open to the public.
• Legal basis: our legitimate interest in sharing activities that have already been made public (article 6.1.f of the GDPR).
• Where they come from: the listing or account where the plan was published.
• How long: while the plan is on the website and up to 12 months after its last day; then we delete the plan and what we took from its source. Videos are not stored: they are processed and discarded.

If you appear in one of these plans and would rather not, write to us at indalotoday@gmail.com and we will remove or correct it.

Editorial team accounts

The people who review and publish plans sign in with an account. We keep their email and the changes they make to each plan, to know who published what. Legal basis: the relationship with the team. It is kept while the person is part of it and, to know who made each change, for 24 months after they leave; then their email and identifier are removed from the history (what was done stays).

Who we share data with

We do not share data with third parties unless required by law. We do use providers that process it on our behalf:

• Hosting of the website and the database: Hetzner Online (Germany; servers in the EU).
• Sending emails: Brevo (France; servers in the EU).
• OpenAI, to interpret the text of searches, suggest itineraries, tidy up the texts of listings and Instagram, including the transcription of videos, and translate plans between Spanish and English. We ask it not to store what we send. Our contract (data processing agreement) is with OpenAI Ireland Ltd.; the data may be processed in the United States, with the European Commission's standard contractual clauses as the safeguard.

Statistics, fonts and icons are on our own servers: they do not go through any third party. The weather is requested by our server from the Spanish State Meteorological Agency (AEMET), with no data about you. In addition, your browser directly requests some photos (Wikimedia Commons and official websites) and, on the page of a route, the tiles of its map (OpenStreetMap); like any website, those services receive your IP address in order to send you the content. The stops are located on the map by our server with OpenStreetMap (Nominatim), with no data about you.

Your rights

You can ask to access your data, correct it, delete it, object to its use, restrict it, take it to another service or withdraw your consent. Write to us at indalotoday@gmail.com saying what you need; we may ask you to confirm it is you. You can write in English.

If you believe we have not handled your request properly, you can complain to the Spanish Data Protection Agency (aepd.es).

Other things you should know

• We make no automated decisions with effects on you: artificial intelligence only suggests plans.
• The form to send plans is not intended for children under 14, and they need a parent or guardian's consent to join the newsletter.
• If we change this policy, you will see it in the date above.