Privacy policy
Last updated: 2 October 2026
This translation is provided for convenience. If it differs from the Spanish version, the Spanish version prevails.
1. Who the controller is
For the data of people who visit this website, join the waiting list, contact us or subscribe to Vecinar on behalf of a community, the data controller is [NOMBRE Y APELLIDOS O RAZÓN SOCIAL], with NIF/CIF (Spanish tax ID) [NIF/CIF] and registered address at [DOMICILIO COMPLETO]. Privacy contact: hola@vecinarapp.com.
Data inside each community: the data that residents and admins enter in the app (units, incidents, photos, documents, bookings, surveys) is the responsibility of the community of owners, which acts as data controller. Vecinar processes it only as a data processor, following the community's instructions and in accordance with Article 28 of the GDPR (RGPD). If you are a resident and want to exercise your rights over that data, contact your community or property manager first; you can also write to us and we will help you sort it out.
2. What data we process, why and on what legal basis
| Purpose | Data | Legal basis (GDPR art. 6) |
|---|---|---|
| Waiting list: telling you when we launch | Consent (1.a) | |
| Handling demo requests and enquiries | Name, email, role, number of units, message | Pre-contractual measures / legitimate interest (1.b, 1.f) |
| Creating and maintaining your account, signing in with an emailed code | Email, name, session, access log | Performance of the contract (1.b) |
| Providing the service to the community (as processor) | Data the community enters: units, incidents, documents, bookings | Data processing agreement with the community; the controller's (the community's) legal basis |
| Invoicing and collecting the subscription | Billing details; payment is processed by Stripe (we never see your card) | Contract and legal obligation (1.b, 1.c) |
| Security and abuse prevention | IP address, technical logs | Legitimate interest (1.f) |
We do not make automated decisions or build profiles with legal effects. We do not sell data or use advertising. Only if you accept analytics cookies do we use Google Analytics to understand, in aggregate, how the site is used; you can withdraw that consent at any time. Your choice is stored in a cookie in your browser; we do not keep our own record of consents.
3. How long we keep data
- Waiting list: until launch or until you unsubscribe.
- Contact requests: as long as needed to handle them and, at most, 12 months unless you enter into a contract with us.
- Account: as long as it is needed for the service. When you delete it, your personal data is anonymised; the community's records (e.g. the incident history) are kept without identifying you.
- Community data: for the duration of the contract and, after that, whatever the community tells us. When it ends, we return it or delete it.
- Invoicing: the period required by tax and commercial law (up to 6 years).
4. Recipients and processors
We do not share your data with third parties unless required by law. We use providers that process it on our behalf, under a data processing agreement:
- Cloudflare, Inc.: hosting, database and file storage.
- Stripe Payments Europe, Ltd.: subscription payments.
- Resend (Plus Five Five, Inc.): sending emails with the sign-in code and notifications.
- Google LLC (YouTube): only if you press play on an embedded video.
- Google Ireland Ltd. (Google Analytics): only if you accept analytics cookies. It is loaded through Cloudflare Zaraz, which hides your full IP address.
Some providers are based in the United States. International transfers rely on the EU-U.S. Data Privacy Framework or, failing that, on the European Commission's standard contractual clauses.
5. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent at any time, by writing to hola@vecinarapp.com and stating which right you are exercising. We may ask you to prove your identity. We will reply within one month at most.
If you think we have not handled your data correctly, you can lodge a complaint with the Agencia Española de Protección de Datos (AEPD, the Spanish Data Protection Agency) (www.aepd.es).
6. Security and minors
We apply reasonable technical and organisational measures: encrypted connections, sign-in with a one-time code, separation of each community's data and role-based permissions. The service is intended for adults; we do not knowingly collect data from children under 14.
7. Changes
If we change this policy in a significant way, we will say so on this page and, where appropriate, by email.