Privacy policy
Last updated: 30 September 2026
ByteGuard S.L. (“we” or “the Controller”), based in Spain, is responsible for processing the personal data collected through the Soplo mobile application and the soplo.me website. This privacy policy explains what data we collect, why we process it, who we share it with and what rights you have under the General Data Protection Regulation (GDPR) and Organic Law 3/2018 on Personal Data Protection (LOPDGDD).
1. Data controller
Company: ByteGuard S.L.
Country: Spain
Email: [email protected]
ByteGuard S.L. is not required to appoint a Data Protection Officer (DPO) because it does not carry out large-scale processing of special categories of data. You can nevertheless send privacy questions to [email protected].
2. Data we collect
Account data: If you choose to sign in with Apple, we collect the name and email address provided by Apple Sign In. We do not store OAuth provider passwords.
Location data: We collect your geographic location to show nearby alerts and let you report events at your current position. Location is used only in the foreground; we do not track your location in the background.
Device identifier: We generate a unique device UUID sent in the X-Device-Id header. It is used solely to prevent duplicate votes on alerts and to link anonymous alerts. It is not shared with other users.
Push notification token: If you enable notifications, we store the Expo Push Notifications token to send nearby alert warnings.
Preferences: Alert radius (in km), enabled notification types, anonymous reporting preference and map theme.
Usage data: We record interactions with the App (alerts created, confirmations and last activity) to improve the service. On soplo.me we use Google Analytics 4 (GA4) only if you accept analytics cookies in the consent banner.
3. Legal basis for processing (GDPR Art. 6)
| Processing | Legal basis | GDPR article |
|---|---|---|
| Account registration and management | Performance of contract | Art. 6.1.b |
| Geolocation for alerts | Explicit consent | Art. 6.1.a |
| Push notifications | Consent | Art. 6.1.a |
| Device identifier | Legitimate interest | Art. 6.1.f |
| Web analytics (Google Analytics 4) | Consent | Art. 6.1.f |
| Security and fraud prevention | Legitimate interest | Art. 6.1.f |
| Service communications | Performance of contract | Art. 6.1.b |
When the legal basis is consent, you may withdraw it at any time: for geolocation, deny the operating system's location permission; for notifications, disable them in Settings > Notifications; for web analytics, reject cookies on soplo.me or delete browser cookies.
4. How we use your information
- Show traffic alerts near your location.
- Let you report and confirm alerts for the community.
- Send push notifications about new alerts in your area.
- Manage your account and preferences.
- Improve service quality and user experience.
- Detect and prevent fraudulent or abusive use.
5. Data sharing
Soplo does not sell your personal data. We do not share your personal information with third parties except in the following cases:
Apple Sign In: Authentication. We receive only the information you authorise (email and name).
Expo Push Notifications: Push notification delivery service. It receives the device token to deliver notifications.
Google Analytics 4: Aggregated measurement of visits and interactions on soplo.me (page views, download clicks and article reading). It is activated only with your consent. Cookies: _ga, _ga_* . You can reject them in the banner or use Google's opt-out tool. Google Ireland Limited / Google LLC (US).
MongoDB Atlas: Database storage. Data is encrypted at rest.
6. International data transfers
Some third-party services mentioned are based in the United States, outside the European Economic Area (EEA). To provide appropriate protection under GDPR (Art. 46), these transfers use the following safeguards:
| Provider | Country | Safeguard |
|---|---|---|
| Expo (Push Notifications) | US | Standard Contractual Clauses (SCCs) |
| Google Analytics 4 | US | Standard Contractual Clauses (SCCs) / DPF where applicable |
| Apple (Sign In) | US | Standard Contractual Clauses (SCCs) |
| MongoDB Atlas | US/EU | EU-US Data Privacy Framework (DPF) |
7. Storage and security
Your data is stored on secure servers. Communications between the App and our servers are encrypted using HTTPS/TLS. The device identifier is stored securely on the device using the operating system's secure storage (Keychain on iOS, Keystore on Android). The App does not use user accounts or passwords.
8. Data retention
| Data type | Retention period |
|---|---|
| Account data (email, name) | While the account is active. Deleted immediately when the account is deleted. |
| Created alerts | 24 hours (automatic TTL). Confirmed alerts are extended by another 24-hour period. |
| Location data | Real-time use. The user's location stored in their profile is updated with each sync and deleted when the account is deleted. |
| Authentication tokens | 30 days (automatic renewal). Deleted on sign-out or account deletion. |
| Push tokens | While the account or device is active. Deleted when the account is deleted. |
| System error logs | 30 days (automatic deletion). |
| Web analytics data (Google Analytics 4) | According to GA4 settings (typically 14 months for _ga cookies). You may withdraw consent at any time. |
When you delete your account in Settings > Account > Delete account, the following are irreversibly deleted in cascade: your account, associated alerts, preferences, session tokens and device tokens for notifications.
9. Your rights (GDPR)
Under the GDPR and LOPDGDD, you have the following rights over your personal data:
- Access: View your data in the App (settings and preferences) or request a complete copy.
- Rectification: Update your name and preferences in Settings.
- Erasure: Delete your account and all your data in Settings > Account > Delete account.
- Portability: Request a copy of your data in a structured format.
- Objection: Object to processing based on legitimate interest.
- Restriction: Request restriction of processing in certain circumstances.
To exercise any of these rights, contact us at [email protected]. We will respond within a maximum of 30 days.
Right to complain: If you believe that processing does not comply with the rules, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.
10. Cookies and similar technologies
The soplo.me website uses the following cookies and local storage technologies:
| Cookie / technology | Purpose | Type |
|---|---|---|
| soplo_cookie_consent (localStorage) | Remember your analytics-cookie decision | Necessary |
| Google Analytics (_ga, _ga_*) | Aggregated measurement of site use (with consent only) | Analytics |
11. Children
Soplo is not intended for anyone under 17. We do not intentionally collect data from minors. If we detect that a minor has created an account, we will delete it together with all associated data.
12. Changes to this policy
We may update this policy periodically. Significant changes will be notified through the App or by email. Continued use of Soplo after changes means you accept the updated policy. The last-updated date appears at the beginning of this document.
13. Contact
If you have questions about this privacy policy or want to exercise your rights, contact us at [email protected].
Data controller: ByteGuard S.L. — Spain
Supervisory authority: Spanish Data Protection Agency (AEPD) — www.aepd.es
© 2026 ByteGuard S.L.