Privacy Policy

1. Who we are

ExpatConnect Valencia (“we”) is the data controller for information collected through expatconnectvalencia.com. Contact: hello@expatconnectvalencia.com.

2. What we collect

• Local-only state:a settling-in “passport” you fill in (name, arrival stage, preferred vibe, neighbourhood), your saved items, your chat history with Lola Admin Pro, and an anonymous payment ID — all stored in your browser’s localStorage. We never see this content unless you choose to send it to us in a message.
• Interest in proposed activities: when you register interest in a proposed activity while signed in, we store that selection against your account so we can remember your interest and show it in your account. Registering interest is not a booking and does not guarantee that the activity will take place. You can remove a registration at any time from your hub. These registrations are not public, and we do not share them with organisers or partners.
• Payment data: processed by Stripe. We do not see or store full card details. Stripe shares the buyer email, country and last-4 digits with us for receipts and customer support.
• Chat input to Lola Admin Pro: the messages you send are forwarded to our AI provider (Anthropic) to generate replies. We retain conversation history in your browser; we do not retain server-side logs of message content beyond what is needed for abuse detection.
• Listing submissions: if you submit an event or partner listing, the contact and content you provide are sent to our review inbox and retained for moderation and contact.
• Newsletter signup:if you subscribe (directly, or via starting a checkout you don’t complete), we store your email and, for checkout-derived signups, which plan you were looking at, solely to send the newsletter or a single follow-up about that checkout. Every email includes a one-click unsubscribe; unsubscribing stops all future sends immediately.
• Referral clicks on partner listings:when you use a “Book or enquire”, WhatsApp or website button on a partner’s listing, we record that the click happened before sending you on: which listing, which of the three buttons, the time, which ExpatConnect page you came from, a broad device type (mobile/tablet/desktop) and whether you were signed in. We do notrecord your IP address, your account or user ID, or anything you go on to do on the partner’s own site. These counts are shown to that partner as click totals only — never as confirmed bookings or customers. We also addutm_source=expatconnect to the destination link so partners can recognise traffic we sent them in their own analytics.
• Technical logs: standard web server access logs (IP, user-agent, timestamp, URL) retained for security and operational purposes for up to 30 days.

3. Processors we use

• Stripe — payment processing (PCI-DSS Level 1) and the sole source of billing/subscription state.
• Anthropic — Lola Admin Pro language model.
• Railway — application hosting and database.
• Resend — transactional and newsletter email (when active).
• Plausible — cookie-free, aggregate-only website analytics (when active). See our Cookie Policy.

Each processor is bound by their own data processing terms. Some are located outside the European Economic Area; we rely on Standard Contractual Clauses for those transfers.

4. Lawful bases

We process personal data on the bases of: contract performance (paid plans), legitimate interest (security, abuse prevention), and consent (marketing emails if you opt in).

5. Your rights — deletion & export

Under GDPR you have the right to access, correct, delete, port, restrict or object to processing of your personal data.

Delete your account yourself: go to your profile→ “Delete my account”. This permanently deletes your account, all sign-in sessions and tokens on every device, and your stored access, and anonymises the contact details on any event listings you submitted. It takes effect immediately and cannot be undone.

Export your data: email hello@expatconnectvalencia.com and we’ll provide a copy of the personal data we hold about you within 30 days. The same address handles any deletion request you’d rather not do in-app.

One exception applies to both: anonymised records and financial records processed by Stripe (payments, invoices, refunds) are retained for as long as Spanish tax, accounting, fraud-prevention and chargeback rules require — after account deletion, nothing in our own systems links those records to you. Data held by our processors — Stripe, Resend, Anthropic and Railway — is deleted according to their retention terms. You also have the right to lodge a complaint with the Spanish data protection authority (AEPD).

6. Retention

Local-only state is retained until you clear it from your browser. Listing submissions are retained for as long as the listing is active and for two years after. Newsletter subscriber records are deleted two years after you unsubscribe (or immediately if you delete your account). Payment records are retained as required by Spanish tax law (currently six years).

7. Children

The Service is not directed to people under 16 and we do not knowingly collect data about children. Parents using the Service to plan family logistics are welcome.

8. Changes

Material changes will be announced on the Service. Continued use after a change constitutes acceptance of the updated policy.