post

Privacy Policy

Last update: July 25, 2026

At convocando we care about your data. This policy explains, in detail, what we collect, why we use it, who we share it with, and how you can control it.

Data controller

Cristian Eslava Suárez, as the owner of convocando. For any privacy question or to exercise your rights, write to hola@convocando.ceslava.com.

What data we collect

  • • Account data: email, name and password (if not signing in with Google), or your public Google profile data (name, photo, email) if you use that sign-in method.
  • • Profile: bio, phone number (optional, only shown to whoever you choose), city, country, and approximate location if you enable "near me".
  • • App activity: events you create or edit, invitations you send or receive, RSVP confirmations, waitlist.
  • • Relationships: friend requests and lists, friend groups, contacts you save by email (people without an account yet).
  • • Communications: messages you send us through the contact form (name, email and message content).
  • • Notifications: your email preferences, and the encrypted push subscription identifier if you enable browser alerts.
  • • Aggregated technical data: site visits and performance via Vercel Analytics/Speed Insights — cookieless, without identifying you individually (see "Cookies" below).

Why we use your data

  • • Create and manage your account and session.
  • • Show you your events, invitations, confirmations, friends, and related updates.
  • • Send transactional emails: invitations, event changes, confirmations, friend notices.
  • • Send push notifications if you enable them yourself.
  • • Reply to messages you send through the contact form.
  • • Prevent abuse and spam, and keep the platform secure.
  • • Analyze aggregated site usage (never at an individual level) to improve it.
  • • Send optional emails (updates) only if you enable them in Settings.

Legal basis for each processing activity

  • • Performance of the service you request: creating your account, publishing events, managing invitations and confirmations.
  • • Your explicit consent: enabling push notifications, sharing your location for "near me", and optional/update emails.
  • • Legitimate interest: security, abuse prevention, and aggregated site analytics.
  • • When you write to us via the contact form: to reply to you, based on your own request.

Who we share data with

We never sell your data. We only share it with the providers we need to run the service, under their own data protection agreements:

  • • Supabase — database, authentication, and file storage.
  • • Resend — sending the platform's emails.
  • • Vercel — website hosting and aggregated analytics (Vercel Analytics / Speed Insights).
  • • Google — only if you choose to sign in with your Google account.

International transfers

Supabase, Resend, Vercel, and Google may process data outside the European Economic Area (e.g. in the United States). Where that happens, they rely on standard contractual clauses or other adequacy mechanisms recognized under EU law.

Retention

We keep your data while your account is active. If you delete your account (available in Settings), we remove your personal data except what we must keep for legal obligations. Contact messages are kept for as long as needed to handle them.

Your rights

Over your own data, at any time you can:

  • • Access the data we hold about you.
  • • Rectify inaccurate or incomplete data.
  • • Request erasure of your data (or delete your account yourself from Settings).
  • • Request restriction of a specific processing activity.
  • • Request portability of your data to another service.
  • • Object to processing based on legitimate interest.
  • • Withdraw your consent at any time (e.g. by disabling notifications or optional emails), without affecting prior processing.

To exercise any of these rights, write to hola@convocando.ceslava.com. Many of them (emails, notifications, deleting your account) you can also manage yourself in Settings, without waiting for a reply.

If you believe we haven't handled your data correctly, you have the right to file a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) or your local supervisory authority.

Cookies and similar technologies

  • • Session (Supabase Auth): browser local storage, strictly necessary to keep you signed in. Doesn't require a cookie notice.
  • • Preferences (light/dark theme, language): browser local storage, strictly functional.
  • • Vercel Analytics and Speed Insights: no cookies and no persistent identifier that tells you apart across visits — only aggregated, anonymous metrics. That's why we don't show a cookie banner: none of the above requires prior consent under current regulation.
  • • If we ever added non-essential cookies (e.g. advertising), we'd ask for your explicit consent before enabling them.

Minors

This service is not directed at anyone under 14, and we do not allow account registration below that age.

Changes to this policy

If we make a material update to this policy, we'll note it on this same page along with the last-updated date.

Related documents

View Terms and Conditions

This document describes in good faith how convocando works today. It doesn't replace professional legal advice.