1. Data controller
The data controller for the personal data collected through getenvilo.app is Envilo (hereinafter, "we" or "the company"). For any privacy-related query you can contact us through our contact form.
2. Data we collect
We collect the following types of personal data:
- Account data: email address and password (or OAuth provider) when you register as a creator.
- Participant data: email address entered voluntarily when starting a public adventure (lead capture).
- Usage data: play sessions, completed steps, duration, ratings and reports.
- Payment data: processed entirely by Stripe. Envilo does not store card data.
- Technical data: IP address, browser and device type, through server logs.
3. Purpose and legal basis
- Provision of the service — performance of a contract (art. 6(1)(b) GDPR).
- Account communications — legitimate interest (art. 6(1)(f) GDPR).
- Lead capture in public adventures — the participant's explicit consent (art. 6(1)(a) GDPR).
- Service improvement and analysis — legitimate interest (art. 6(1)(f) GDPR).
- Compliance with legal obligations — legal obligation (art. 6(1)(c) GDPR).
4. Providers and international transfers
We use the following sub-processors:
- Supabase Inc. — authentication and database (servers in the EU).
- Cloudflare Inc. — file storage on R2 and CDN.
- Stripe Inc. — payment processing (with Standard Contractual Clauses).
All providers offer appropriate safeguards in accordance with the GDPR. We do not sell or disclose your data to third parties for commercial purposes.
5. Data retention
Account data is retained for as long as you keep your account active. Play session data and leads are retained for a maximum of 3 years from the time they are collected. You can request early deletion at any time from Dashboard → My profile → Delete account or by contacting us.
6. Your rights
You have the right to:
- Access: obtain confirmation as to whether we process your data and a copy of it.
- Rectification: request the correction of inaccurate data.
- Erasure: request the deletion of your data (the "right to be forgotten").
- Data portability: receive your data in a structured format.
- Objection and restriction: object to the processing or request its restriction in certain cases.
- Withdrawal of consent: where the processing is based on consent, you may withdraw it at any time.
You can exercise these rights through our contact form. You also have the right to lodge a complaint with the Agencia Española de Protección de Datos (AEPD, the Spanish Data Protection Agency), the supervisory authority, at www.aepd.es.
7. Security
We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or alteration, including encryption in transit (TLS) and at rest.
8. Changes to this policy
We may update this privacy policy from time to time. We will notify you of material changes by email or through a prominent notice on the platform.
This translation is provided for convenience only. The Spanish version of this Privacy Policy is the only legally binding one and, in the event of any discrepancy between the two versions, the Spanish text prevails.