Legal
Privacy Policy
This policy distinguishes between this website and the PayPlea mobile app, which run on separate systems. We do not sell personal information.
- Last reviewed:
Operational draft
This document is a high-quality operational draft prepared before launch. It is not legal advice and has not yet completed professional legal review. Website policy version 2026-11-06.
Controller
Information pending: Data controller legal name, identifier and postal address
Website processing
| Data | Purpose | Retention |
|---|---|---|
| Waitlist email (encrypted), language, consent timestamps | Confirm and manage early access | Unconfirmed: 30 days. Confirmed: until invitations end or you unsubscribe |
| Limited campaign attribution (source, UTM fields, path) | Understand which channels work | Same as the entry |
| Contact and notice form content | Answer you; handle notices | Emailed to the team, not stored by the website |
| Anti-spam sum answer | Block automated abuse | Checked on our server, not stored |
| Hashed rate-limit fingerprints (no raw IP) | Security | Minutes to hours |
Mobile-app processing
The app processes account and profile data, requester details, public posts and comments, private documents, payment-link configuration, declarations, receipts, conversations, moderation records, achievements, store purchase records, device and push data, and support records.
Automated receipt assessment
Where configured, private receipts may be assessed automatically to extract or evaluate signals such as amount, currency, provider, recipient and apparent consistency. Low-confidence evidence goes to human review. This is not a cryptographic confirmation from the provider and does not determine legal rights by itself.
Legal bases
Candidate bases are consent (waitlist, optional updates), contract (providing the app), legitimate interests (security, fraud prevention, moderation) and legal obligation. These require final legal review.
Processors
Vercel (hosting), Neon (waitlist database), Resend (email), Supabase (app backend), OpenAI (private receipt assessment where configured), Apple and Google (app stores and purchases). Independent payment providers process data when you choose to use them, under their own policies.
International transfers
Information pending: International transfer safeguards (to be completed with legal review)
Your rights
You can request access, correction, deletion, restriction, objection and portability, and withdraw consent at any time. You can complain to your supervisory authority — in Spain, the Agencia Española de Protección de Datos. Contact us through the contact page.
Security
We use encryption, keyed hashing, access controls and minimisation. No system is perfectly secure, and we do not claim absolute security.
Adults only
PayPlea is not intended for anyone under 18.
Changes
We will update the date above and give notice of material changes.