Privacy Policy

1. Data Controller

Victor Díaz Nombela, operator of Veltor Agenda (veltoragenda.com), is the data controller for your personal data. Contact us at legal@veltoragenda.com.

2. Data We Collect

Account data

Name, email address, and password (stored hashed with bcrypt; never in plain text).

Agenda data

Entries (tasks, notes, ideas, reminders), weekly objectives, day opening/closing rituals, weekly reviews, and personal settings (language, timezone, date format).

Morning reminder emails

If you enable morning reminders (during registration or in Settings → Notifications), we store your preference ("daily reminder enabled"), the date of the last email sent, and your timezone to determine the correct delivery time. Reminders are sent at 09:00 in your local timezone. You can disable reminders at any time from Settings → Notifications without contacting us. The application works fully regardless of whether you enable this feature.

Technical data

IP address (temporarily stored for security and rate-limiting), browser language, and timezone.

3. Legal Basis for Processing (GDPR)

• Contract performance (Art. 6.1.b GDPR): account creation and service delivery.
• Consent (Art. 6.1.a GDPR): sending morning reminder emails (voluntary opt-in, revocable at any time).
• Legitimate interest (Art. 6.1.f GDPR): platform security, fraud prevention, and rate-limiting.

4. Data Retention

• Account and agenda data: retained while your account is active; purged within 30 days of account deletion.
• IP logs: maximum 90 days.
• Backups: purged within 30 days of deletion.

5. Data Recipients and Processors

We do not sell or share your data with third parties for commercial purposes. Your data may be accessed by:

• Web hosting provider: hosts the service infrastructure within the EU/EEA.
• Payment processor (Stripe): if you subscribe to Veltor Premium, payment is processed by Stripe Payments Europe, Ltd., acting as an independent controller under its own privacy policy (stripe.com/privacy). In our systems we only store your Stripe customer and subscription identifiers, plan status and renewal date. We never store card details.
• Competent authorities: when required by law or court order.

6. International Transfers

All data is stored and processed entirely within the European Economic Area (EEA). We do not transfer data to third countries without adequate GDPR safeguards.

7. Your Rights

As a data subject, you have the right to:

• Access: request a copy of your personal data.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion of your data ("right to be forgotten").
• Restriction: request suspension of processing in certain circumstances.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interest.
• Withdrawal of consent: where processing is consent-based.
• Lodge a complaint: with the Spanish Data Protection Authority (AEPD): www.aepd.es.

To exercise any of these rights, email legal@veltoragenda.com. We will respond within 30 days.

8. Security

We apply appropriate technical and organisational measures: bcrypt-hashed passwords, HTTPS/TLS encryption, CSRF protection, and rate-limiting. In the event of a data breach, we will notify you as required by GDPR.

9. Children and Minors

Veltor Agenda is not intended for users under 16 years of age. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us for deletion.

10. Changes to This Policy

We may update this policy as needed. Material changes will be communicated to registered users by email at least 15 days before taking effect.

11. Contact

Victor Díaz Nombela -legal@veltoragenda.com