Contents
- 1. Controller
- 2. What data we process and why
- 3. Legal bases
- 4. Recipients and processors
- 5. International transfers
- 6. How long we keep data
- 7. Your rights and how to exercise them
- 8. Complaints to the AEPD
- 9. Minors
- 10. Security and ballot secrecy
- 11. Automated decisions and AI
- 12. Cookies and local storage
- 13. Changes to this policy
1. Data controller
- Owner: LA GARRIDA EMOTIONS S.L. · Spanish Tax ID (NIF) B09776816
- Address: C/ Ortega y Gasset 34, 28006 Madrid (Spain)
- Service: Sfera Civitas (sferacivitas.org, app.sferacivitas.org and iOS/Android apps)
- Data protection contact: hola@sferacivitas.org (subject «Protección de datos» / «Data protection»)
- Data Protection Officer (DPO): we have not appointed a DPO because it is not mandatory at our scale. We will review this if processing grows. In the meantime, write to the address above.
2. What data we process and why
2.1 Account
To create your account and sign in we process your email address and your password. The password is never stored in plain text: it is stored transformed with scrypt, an algorithm that does not allow it to be recovered. We also keep an internal user ID and a record of what you accepted when signing up (terms, consent and age declaration) with its date. Purpose: to give you access and provide the service.
2.2 Participation (data that may reveal political opinions)
When you take part in an issue we process your supports, arguments, proposals, the documents or links you upload and your vote. This information may reveal your political opinions, a special category of data (Art. 9 GDPR). We therefore only process it with your explicit consent (Art. 9(2)(a) GDPR), which you give when signing up by ticking a specific box.
- The arguments, proposals and documents you publish are visible to other participants and remain associated with your account while it exists.
- For voting, the system keeps the fact that you voted in a given vote (so nobody votes twice) and, separately, the encrypted ballot without your identity. See section 10.
- You can withdraw consent at any time by deleting your account or writing to hola@sferacivitas.org. Withdrawal does not affect prior processing, but without consent you cannot take part.
2.3 Identity verification with a digital certificate or Spanish eID (DNIe)
If you choose to verify your identity with a digital certificate or DNIe, we check the certificate and keep only an encrypted fingerprint (HMAC) of your NIF, used to prevent duplicate accounts. We do not store your NIF, your name or the certificate. Verification is optional and based on your explicit consent.
2.4 Organisations and invitations
An organisation (association, residents' community, school, etc.) can create a private space and invite people. For this we process the invited person's email, provided by the organisation, and their membership and role in that space. If you were invited and do not accept, the invitation is deleted 30 days after it expires.
2.5 Payments
If an organisation buys a private space, payment is handled by a payment provider acting as seller (merchant of record: Lemon Squeezy or Paddle), which is an independent controller of that payment. We receive the transaction data (amount, date, description and payment identifiers) and keep it to meet commercial and tax obligations. We do not see or store your card details.
2.6 Support
If you write to hola@sferacivitas.org or open a request from the app, we process your email and what you tell us in order to reply.
2.7 Moderation and reports
If you report content or block a user, we process the report (who reports, which content and why) and the moderation decisions taken. Purpose: keeping the platform free of illegal or abusive content and complying with the Digital Services Act (DSA).
2.8 Public expert profiles
If you appear as a verified expert on a subject, we process your expert profile data: display name, specialty, credentials and organisation and, if provided, a contact email. The name, specialty, credentials and organisation are published with a verified-expert badge, because their purpose is precisely to inform the public debate. You can ask us to correct or remove your profile by writing to hola@sferacivitas.org.
2.9 Notifications
We send you notices inside the app and, where relevant, by email (for example verification codes or notices about your account).
2.10 Technical data and security
When you use the service, our hosting providers log technical data such as your IP address and the time of the request. We use it for security, rate-limiting sign-in attempts and preventing abuse.
2.11 Website analytics (only with your consent)
On sferacivitas.org we use Google Analytics 4 and Metricool to measure visits in aggregate, only if you accept them in the cookie notice. If you do not, they are not loaded. You can change your mind in Cookie preferences. More detail in the Cookie Policy.
What we don't do: we do not sell your data, use it for advertising, collect your precise location or build commercial profiles.
Do you have to give us your data? Email and password are needed to have an account. Consent to process your participation is needed to take part. Certificate verification and website analytics are optional.
3. Legal bases
| Processing | Legal basis |
|---|---|
| Account and use of the service | Performance of the contract: the Terms of Use (Art. 6(1)(b) GDPR) |
| Participation (supports, arguments, proposals, votes), which may reveal political opinions | Explicit consent (Art. 9(2)(a) GDPR), collected at sign-up with a specific box and withdrawable at any time |
| Identity verification with a digital certificate or DNIe | Explicit consent (Art. 6(1)(a) and, where applicable, 9(2)(a) GDPR) |
| Security, abuse prevention, moderation and rate limits | Legitimate interest (Art. 6(1)(f) GDPR) and Digital Services Act (DSA) obligations |
| Payments and invoicing | Performance of the contract and legal obligation (Art. 6(1)(b) and 6(1)(c) GDPR) |
| Support | Legitimate interest in assisting you and performance of the contract |
| Website analytics (Google Analytics 4, Metricool) | Consent (Art. 6(1)(a) GDPR and Art. 22.2 of the Spanish LSSI), withdrawable in «Cookie preferences» |
4. Recipients and processors
We do not disclose your data to third parties except where required by law (for example, a court order). To provide the service we use these providers, under a data processing agreement (DPA) or acting as independent controllers:
| Provider | Role | Data location | Safeguards |
|---|---|---|---|
| Supabase | Database | EU (Ireland) | Supabase Inc. (USA): DPA + Standard Contractual Clauses (SCC) / EU-US Data Privacy Framework (DPF) |
| Render | API server | EU (Frankfurt) | Render Services Inc. (USA): DPA + SCC / DPF |
| Netlify | Web hosting and forwarding requests to the API (sees your IP) | Global network (CDN) | Netlify Inc. (USA): DPA + SCC / DPF |
| Zoho Corporation (Zoho Mail EU) | Account and support email | EU (Zoho EU data centres) | Zoho Corp. B.V. / India: DPA + SCC |
| Google (Google Analytics 4) | Website analytics, only with consent | USA / EU | Google Ireland Ltd. / Google LLC: DPF |
| Metricool | Website measurement, only with consent | EU (Spain) | Metricool Software S.L. |
| Lemon Squeezy / Paddle | Payment for private spaces (if purchased) | USA / United Kingdom | Independent controller of the payment; SCC / DPF |
| Apple / Google | App stores | — | Independent controllers of their stores |
The list of municipalities is served from our own domain, without third-party networks. What you publish in an issue (arguments, proposals, documents) is visible to other participants; your vote is not.
5. International transfers
Platform data is stored in the EU. However, some providers have their parent company outside the European Economic Area (USA, India or United Kingdom) and might access data in specific cases (for example technical support), and Netlify and Google may process data outside the EU. In those cases the transfer relies on the EU-US Data Privacy Framework (DPF), where the company is certified, or on the Standard Contractual Clauses (SCC) approved by the European Commission. You can ask us for more information at hola@sferacivitas.org.
6. How long we keep data
| Data | Period |
|---|---|
| Account and contributions | While the account is active. When you delete it, your identity is erased and the content becomes anonymous (immediately). |
| Encrypted ballots and voting bulletin board | Permanent, without identity: needed so anyone can verify the result. |
| Record that you voted | Until the vote closes + 90 days; then aggregated or anonymised. |
| Notifications | 180 days |
| Verification codes and certificate challenges | 24 hours |
| Unaccepted invitations | 30 days after expiry |
| Support requests | 12 months after closing |
| Payments | 6 years (commercial and tax obligation, Art. 30 Spanish Commercial Code). The full data sent by the payment provider is minimised after 30 days. |
| Moderation reports | 12 months after resolution |
| Provider backups | Purged within 90 days at most |
| Platform technical logs (IP) | Those of the provider, 30 days at most |
| Website analytics | According to Google Analytics and Metricool settings; only exists if you accepted it |
7. Your rights and how to exercise them
You have the right of access, rectification, erasure, objection, restriction of processing and portability, and to withdraw your consent at any time without affecting prior processing.
- In the app: «Tu sesión / Your session» → Download my data (a JSON file with your data) and «Tu sesión / Your session» → Delete my account (immediate effect). More detail in Delete your account.
- By email: write to hola@sferacivitas.org with the subject «Protección de datos» / «Data protection», from your account email. If we cannot tell it is you, we will ask for the minimum needed to check.
- We reply within 1 month at most.
Please note we cannot give you or delete «your vote», because the ballot is not linked to your identity: we do not know which one it is.
8. Complaints to the AEPD
If you think we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. We would appreciate it if you wrote to us first so we can try to solve it.
9. Minors
To create an account you must be at least 14 years old (Art. 7 of the Spanish LOPDGDD), and you declare this at sign-up. If you are younger, you cannot use the platform. If we learn that someone under 14 has registered, we will delete the account.
10. Security and ballot secrecy
- All communications are encrypted in transit (HTTPS).
- Passwords are stored with scrypt, never in plain text.
- We limit sign-in attempts and restrict internal access to data to what is strictly necessary.
- If a security breach affected your data, we would notify the AEPD and, where the law requires, you.
11. Automated decisions and artificial intelligence
We do not take decisions based solely on automated processing that produce legal effects on you or similarly affect you, and we do not profile you. The only automatic rule is a safety one: content reported by several people is temporarily hidden until a human moderator reviews it.
Sfera Civitas does not use artificial intelligence systems to process your data or within the platform.
12. Cookies and local storage
The app stores on your device what it needs to work (your session, language, theme and your vote receipts). On the website we only use analytics cookies if you accept them. Full detail in the Cookie Policy.
13. Changes to this policy
If we change this policy, we will publish the new version on this page with its number and date. If the change is significant (for example a new use of your data or a relevant new provider), we will tell you in the app or by email and, if needed, ask for your consent again.