Privacy policy

Controller

The provider of the Holgura service. Privacy contact: privacidad@holgura.dev.

Data, purposes and legal bases

• Account (email, name, language, password hashed with argon2id): to provide the contracted service (GDPR Art. 6.1.b).
• Billing (payment provider customer id, plan, status): performance of the contract and tax obligations (Art. 6.1.b and c).
• Alerts and monthly summary: performance of the contract; you can unsubscribe from the summary with one click.
• Sales enquiries: consent with double confirmation (Art. 6.1.a).
• Security log (account actions, without email addresses): legitimate interest in the security of the service (Art. 6.1.f).

Retention

• Unconfirmed accounts: 14 days. Privacy links: 1 hour.
• Alert delivery log: 90 days. Audit log: 365 days.
• Backups: 30 days (and 90 days in the immutable archive).
• Billing data: as long as tax law requires.
• Visit measurement: 90 days (events without persistent identifiers).

Processors

Hetzner Online GmbH (hosting, Germany and Finland) and the payment provider Stripe (with standard contractual clauses). Email is sent and received by our own mail server on that same hosting: there is no third-party email provider. We do not sell or share data.

Your rights

You can access, rectify, export, restrict, object to or delete your data from the console or from the privacy centre without signing in. You may complain to the Spanish Data Protection Agency (aepd.es).

Analytics

We measure visits in aggregate, without cookies and without storing anything on your device (consent-exempt audience measurement; legitimate interest, GDPR Art. 6.1.f): the page visited (without parameters), the referring site (its domain only), campaign tags (utm) if any, screen size, language, browser and OS family, and the country derived from your time zone, never from your IP. Your IP address and user agent are used only on the fly to compute a visitor identifier that changes every day and is discarded at midnight (UTC): they are not stored.

The data is processed on our own servers in Germany (Hetzner), kept for 90 days and never shared with third parties. We respect Global Privacy Control, and you can object right here: your choice is stored in this browser only.