Privacy Policy

The short version

We ask for your first name and email so we can send you the beta invite, launch news and the Tastelines newsletter — a few places to eat, every couple of weeks. We store them in the European Union, we never sell or share them, and you can have them deleted at any time by replying to any email or writing to us. That is the whole arrangement.

Who is responsible

The data controller is Carlos Rivera, the individual behind Tastelines. For anything in this policy — including exercising your rights — write to hello@tastelines.app.

What we collect

Only what the form asks for, plus the record that proves you agreed:

• First name — so the invite does not open "Dear user".
• Email address — the only way to send you the invite and the newsletter.
• Language preference — so we write to you in English or Spanish.
• Consent record — the date, which version of the consent wording you accepted, and the confirmation you give by clicking the link in the first email (double opt-in): nothing is sent until you do.

We do not ask for your address, your phone number, or anything else. There is no tracking pixel in our emails and no profiling.

Why we may do this

Our legal basis is your consent (Article 6(1)(a) GDPR), given by ticking the box on the form — which is also what Spanish law on commercial email (LSSI-CE, Article 21) requires. Giving us your details is entirely voluntary; the consequence of not giving them is simply that we cannot send you an invite. You may withdraw consent at any time, and withdrawing it does not affect anything we did before you withdrew it.

Where your data lives

Signups are stored in Google Cloud Firestore in the European Union (multi-region eur3: Belgium and the Netherlands). Google acts as our processor under the Google Cloud Data Processing Addendum. The list is configured so that it can be written to but not read from the website — nobody can retrieve the addresses through the page. The emails themselves go out through MailerLite (Vilnius, Lithuania — inside the EU), which holds your address and name as our processor for sending, and nothing else. Every email carries a one-click unsubscribe.

How long we keep it

Until you ask us to delete it, or until you unsubscribe. If Tastelines never launches, we delete the whole list within 24 months of your signup. We do not keep data "just in case".

Your rights

Under the GDPR you may ask us to: give you a copy of your data, correct it, delete it, restrict or object to how we use it, send it to you in a portable format, or withdraw your consent. Write to hello@tastelines.app and we will act within one month — in practice, far sooner.

If you think we have handled your data badly, you can complain to your national data protection authority. In Spain that is the Agencia Española de Protección de Datos (AEPD). We would rather you told us first, so we can fix it.

Analytics

The Tastelines home page uses Google Analytics with IP anonymisation to count visits. This policy page carries no analytics at all. It sets no advertising cookies and we do not build profiles. You can opt out with the Google Analytics opt-out add-on. Analytics data may be processed outside the EU by Google under the EU–US Data Privacy Framework; your signup details are not.

Changes

If this policy changes in a way that matters, we will say so in the email we send you rather than quietly editing this page.