Privacy notice
Draft · what data exists today
A working draft of the privacy notice, written to save a lawyer time. It is not legal advice, it has not been reviewed by a lawyer, and it does not claim that Vale complies with any law. Text like [PLACEHOLDER: this] is unknown or undecided. Boxes marked "Drafting note" are for the owner and the lawyer.
Vale has no accounts, no analytics, no advertising, no cookies and sends no emails. Your plan stays in your browser and Vale's owner does not receive it. One thing leaves your device when you open the page: your browser asks the hosting service for the page (the typefaces are served by Vale itself). When you open My day, your browser also asks OpenFreeMap for map tiles to draw the 3D street map (unless you chose “Use the simple map”); OpenFreeMap sees your IP address and the map area, not your stop names, times or plan. If test payments are switched on and you use them, some order details go to a small payments service and to Stripe. Details below.
1. Who is responsible
The person responsible for the data described here (the "controller") is [PLACEHOLDER: full legal name], [PLACEHOLDER: postal address in Spain], [PLACEHOLDER: privacy contact email]. Today this is the owner personally, not a company.
Data protection officer: none appointed. Lawyer [PLACEHOLDER: confirm that none is required]
2. What data exists, why, and for how long
| Data | Where it goes | Purpose and basis (candidates) | How long |
|---|---|---|---|
| Your plans and settings: day, group size, budget, interests, the text you type to the agent, item choices, example booking references, activity log, language | Stays in your browser (localStorage). Vale does not receive it. | So that you keep your plan. Vale has no access to it. Lawyer [PLACEHOLDER: whether any legal basis is needed for data that never reaches the controller] | Until you clear it (Start over, or your browser's site data). |
| Technical request data: IP address, time, page requested, browser type | The hosting service that serves the site: [PLACEHOLDER: host not chosen yet, for example Cloudflare Pages]. | Deliver the page and keep it secure. Candidate basis: legitimate interest. Lawyer | Set by the host: [PLACEHOLDER: retention of the host]. |
| 3D street map (on My day, unless you chose “Use the simple map”): map area and your IP address | OpenFreeMap receives the tile requests needed to draw the streets and buildings. Vale does not send your stop names, times or plan. Lawyer | Show the interactive street map on My day. You can switch to the simple map, which makes no requests, at any time; the choice is remembered in this browser. Lawyer [PLACEHOLDER: confirm legal basis and OpenFreeMap processor/controller role] | Set by OpenFreeMap: [PLACEHOLDER: confirm retention]. |
| Weather forecast (on a planned day, Real data only): the plan's date and the fixed point of Puerta del Sol, plus your IP address | Open-Meteo receives one request per planned date. Vale does not send your position, stop names, times or plan. No cookies, no referrer. Lawyer | Warn you when rain, a storm or strong heat is likely during an outdoor stop. Lawyer [PLACEHOLDER: confirm legal basis and Open-Meteo's role; Open-Meteo's free plan is for non-commercial use] | Set by Open-Meteo: [PLACEHOLDER: confirm retention]. |
| Test orders (only if you use the Payments page): order number, chosen items, group size, whether you split, date, language, status | Saved in your browser. In test mode also sent to a small payments service run by the owner ([PLACEHOLDER: provider and country]) and to Stripe. | Run a test payment you asked for. Candidate basis: performing what you requested. Lawyer | Browser: until you clear it. Service and Stripe: [PLACEHOLDER: retention]. |
| Emails you send to Vale | The owner's mailbox: [PLACEHOLDER: mail provider]. | Answer you. Candidate basis: legitimate interest or your request. Lawyer | [PLACEHOLDER: retention] |
Card details are never typed into Vale. In test mode they go only to Stripe's own page, and only test cards work.
3. What Vale does not do today
- No cookies, no advertising or analytics tools, no tracking across sites, no profile of you.
- No accounts, no email lists, no push notifications.
- No selling or sharing of data with partners. Partners in the demo are made up.
- No decision about you is taken by software in a way that has legal or similarly significant effects. The planner only proposes; you approve each item.
4. Transfers outside the EU
The future host and Stripe are, or may be, US companies. Lawyer [PLACEHOLDER: transfer mechanism for each, for example the EU-US Data Privacy Framework or standard clauses, and whether it still stands]
5. Your rights
You can ask for access to your data, correction, deletion, restriction, objection and portability, and you can withdraw any consent you gave. Write to [PLACEHOLDER: privacy contact email]. Because Vale does not hold your plans, the fastest way to delete them is your browser's site data. You can complain to the Spanish data protection authority, the AEPD (aepd.es).
6. Children
Vale is not aimed at children and has no age check. It collects nothing that identifies a person. Lawyer [PLACEHOLDER: minimum age, if any. In Spain a person aged 14 or more can consent for themselves to data processing; younger children need a parent]
7. Security
The site is served over HTTPS and loads no scripts from other sites. It has not been security-tested by an outside party.
If personal data that Vale is responsible for were breached in a way that risks people, the controller must tell the AEPD within 72 hours and sometimes the people affected. Vale holds almost no data today. [PLACEHOLDER: a written breach procedure before accounts exist]
8. What is not active and will need this notice rewritten first
- Accounts and email addresses.
- Any analytics, even privacy-friendly ones, and any counting of link clicks.
- Links to partners with affiliate tracking, and any data sharing with partners.
- Live payments and real orders.
- A real AI model reading what you type.
- A second country.
9. Changes
Last drafted: 1 October 2026. [PLACEHOLDER: how changes are announced]
Facts behind this page: no accounts, no analytics, no cookies, local storage only, no third-party request on the page (fonts are self-hosted since 2 Oct 2026) and an optional test-payments flow. Open points for the lawyer include: hosting provider and its terms, whether on-device storage that never reaches Vale needs any basis, the controller identity, and the transfer mechanisms. Full detail: legal/06-data-and-processors.md.