PRIVACY POLICY

Last updated: 10 September 2026

1. Controller

Marc Sala, tax ID 47734938W, registered address Gondomar, Pontevedra, Spain. Contact: contact@mofoburn.com. Data protection officer: not appointed — none is required for processing of this kind.

2. What we process, why, and on what basis

• Project data (name, URL, description, owner email): to publish and operate your project and to send you service emails about it. Basis: performance of the contract (art. 6.1.b GDPR). Kept while the project exists and for the legally required period afterwards.
• Payment data: handled by Stripe. We never see or store card numbers. We keep the payment reference, amount and date. Basis: contract and legal accounting obligations (art. 6.1.b and 6.1.c). Kept for the statutory retention period.
• Voting data: a one-way hash of your IP address combined with a random cookie identifier. We do not store raw IP addresses for voting. Basis: legitimate interest in preventing fraud and abuse (art. 6.1.f). Deleted after 90 days.
• Newsletter: your email address, the wording you consented to, the time and a hash of the IP used to give consent, as proof of consent. Basis: your consent (art. 6.1.a), which you can withdraw at any time. Kept until you unsubscribe.
• Online counter: to show how many people have the site open we keep, for about a minute, a random identifier your browser generates for the page you are on and holds in memory only, together with a hashed IP address used to stop the figure being inflated. No identifier is stored on your device and neither value identifies you. Basis: legitimate interest in showing the state of the site (art. 6.1.f). Rows are deleted within the hour.
• Reports: the reason, any details you write, and a hashed IP. Basis: legitimate interest in moderating the service.

Project owner emails and newsletter subscribers are kept separate. Giving us an email to run your project is not consent to marketing, and we do not add project owners to the newsletter.

3. Who we share it with

Processors acting on our instructions: Vercel Inc. (hosting and analytics), Neon Inc. (database, contracted through Vercel), Stripe Payments Europe Ltd (payments), Resend (transactional and marketing email), and Cloudflare (anti-abuse challenge). Some of these may process data outside the EEA under the European Commission's standard contractual clauses or an adequacy decision. We do not sell personal data.

4. Your rights

You can request access, rectification, erasure, restriction, portability and objection, and withdraw consent at any time, by writing to contact@mofoburn.com. If you believe we have mishandled your data you can complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos (aepd.es).

5. Security

Data travels over TLS. Management links and confirmation tokens are stored only as hashes. IP addresses used for voting and rate limiting are stored only as salted hashes.

See also Terms and Cookies.