Atalaia.gal

Privacy

Atalaia runs first-party analytics on our own infrastructure, never third-party. No Google Analytics, no ad tech, nothing sold to anyone. We record searches and interactions to improve the guide; we record a hashed IP for 30 days to fight abuse. This page says exactly what we store and for how long.

What we collect

Friends of Atalaia: your email, your name (if given), the language, and a Friend number if one applies. Emails are stored in cleartext because that's the only way we can send you the updates you signed up for.

A Marea: if you answer the 3 personalisation questions we save those answers (beach, level, preference) keyed to an anonymous visitor id, so A Marea opens on your beach and adapts what it highlights. Never name, email or account.

O Parte da Costa: the morning briefing is published on a WhatsApp broadcast channel, we store nothing. No email, no number, no name. WhatsApp shows a follower count; we have no access to the follower list or to your identity. To leave, unfollow the channel in your WhatsApp and you're out.

Contributions and forms: if you send a message through the public form we store the topic, the message (max 280 characters), and optionally your name and email if you fill them. Nothing here is shared publicly.

First-party analytics: when you visit Atalaia we store a random id in localStorage (vid), a session id in sessionStorage (sid), and, if you arrived via a card or QR with '?f=', the acquisition source. These values don't identify you; they let us count returning visits and see which cards work.

Searches and interactions: searches (the sanitised text + whether it returned results) and some clicks (beach selected, day chosen, outbound link) are logged next to those ids so we can improve the guide and the recommendations. Nothing leaves our servers.

IP: we store a hash of your IP (with a daily-rotated salt) for up to 30 days for the single purpose of fighting abuse, form spam, scraping, and applying per-hour rate limits. We never store the plain IP.

Where the entry data comes from

Atalaia is a hand-written editorial guide. We use no crawlers, robots, scrapers or automatic data import of any kind. Every entry cites its source ("Source: …").

Own knowledge: we live this coast. We write about the places we visit, see, or try, the way any local chronicler or blogger would.

Public observation: names and locations seen in the real world (signs, walking past, eating there), noted by hand.

Public registries: data from municipal and administrative sources, transcribed by hand under Ley 37/2007 (public-sector information re-use).

Contributions: information sent by people or by the businesses themselves (profile), citing the contributor and with their consent.

When something isn't verified we say so. We don't reproduce third-party databases; we link out to each business's official page for their contact details.

Legal basis for the recommendations

The recommendations are hand-written editorial content, protected by the freedom of expression and information (art. 85 LOPDGDD).

Some entries may contain data identifying individuals (e.g. sole traders); we handle these on that editorial basis and, secondarily, on legitimate interest (art. 6.1.f GDPR), keeping an honest public guide of the coast.

We don't publish special-category data, phone numbers or postal addresses in entries: only name, category, approximate location, and a link to the official page. If you're the business and want to add your data, do it yourself by creating a profile (art. 6.1.a, consent basis).

Why

To send you what we promised when you signed up (monthly Friends updates, replies to your message).

To produce the diagnostic report we share with local administrations. It's an aggregate calculation; nobody in the municipality sees individual data.

To detect abuse, scripted form spam, brute-force, without having to store IPs.

How long

Friends: while you're subscribed. If you unsubscribe we keep the row for 30 days as an audit trail that we honoured the request, then it's erased.

Contributions: 12 months from the last contact. If you asked for a reply, we delete once resolved.

Anonymous signals (events): 24 months. Because the hash rotates every day, records from different days can't be linked to each other.

Your rights

You can exercise at any time the rights of access (art. 15), rectification (art. 16), erasure (art. 17), objection (art. 21), restriction and portability (arts. 18, 20). The fastest route is the takedown form (one minute, no account). As a GDPR alternative, write to hello@atalaia.gal.

Fast listing removal: if you're the business or the person affected, use the takedown form (one minute, no account) or write to us. We handle it as soon as we can, without questions and without argument: an unwanted listing gets removed, full stop, within the one-month window the GDPR requires.

You can unsubscribe from Friends via the button in every email or by visiting /amigos/unsubscribe.

You can also file a complaint with the Spanish Data Protection Agency (AEPD) if you think we haven't handled your request.

What we don't do

We don't sell or share data with any administration, company, or third party.

We don't use analytics services (Google Analytics, Meta Pixel, TikTok Pixel, Hotjar, etc.). The municipality we work with does use them; we deliberately don't.

No third-party cookies. The only cookies you may see are the vendor dashboard session cookie (only when you're signed in) and admin or pre-launch cookies when they apply.

Write to us

Any question or request: hello@atalaia.gal. Replies in Galician, Spanish or English.