Privacy

This policy describes how the personal data of Simple Wave Search users is processed, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and guarantee of digital rights (LOPDGDD).

1. Data controllers

Joint controllers: Adrián Fernández Álvarez and Miguel de Orueta Rionda, co-founders of the project

Contact point: mdeoruetasws@gmail.com

Website: https://simplewavesearch.com

Both co-founders jointly determine the purposes and means of the processing and are therefore joint controllers under article 26 GDPR. The address given is the single point of contact: users may exercise their rights against either of the joint controllers by writing to it.

2. Data processed, purpose and legal basis

Data	Purpose	Legal basis	Retention
User account: email address, username and password (stored hashed, never in the clear)	Creating and managing the account, signing in and attributing ratings	Performance of the requested service (art. 6.1.b GDPR)	While the account remains active
Surf session ratings, comments and beaches marked as favourites	Providing the service and improving the surf quality prediction models	Performance of the service (art. 6.1.b GDPR) and legitimate interest in developing the models (art. 6.1.f GDPR)	While the account is active; after deletion they are kept dissociated from the user's identity
Browsing data: IP address, user agent, page visited, date and time, approximate country and, if arriving by scanning a poster QR code, the identifier of that poster	Own usage statistics, error diagnosis and service security	Legitimate interest (art. 6.1.f GDPR)	12 months; after that the IP address and user agent are deleted
Messages sent to the conversational assistant and, where applicable, the approximate location shared voluntarily	Generating the assistant's answer, recommending the nearest beaches, controlling the number of free queries and improving the service by analysing what is asked	Performance of the service (art. 6.1.b GDPR), legitimate interest in improving the assistant (art. 6.1.f GDPR) and consent for the location (art. 6.1.a GDPR)	Conversations are kept on the server together with the IP address they were sent from; after 12 months the IP address is deleted and the content is left dissociated from any identifiable person. If the account is deleted, its conversations are dissociated immediately

About location

Location is only obtained if the user expressly presses the corresponding button and authorises it in their browser. Before being sent to the server it is rounded, so an approximate position is transmitted rather than the exact location of the device. The user may revoke this permission at any time from their browser settings and delete the stored location by clearing the site data.

3. Recipients and providers

Personal data is not sold or transferred to third parties for commercial or advertising purposes, nor are profiles built for that purpose. The site may be financed through advertising and partnership agreements, but this does not involve transferring users' data: if advertising systems that process personal data are added in the future, this policy will be updated in advance and consent will be requested where required. The following providers are involved in delivering the service:

Provider	Function	Data accessed
Oracle Cloud (data centre in Spain)	Hosting of the server and the database	All stored data
Cloudflare	DNS service and domain registration	Connection data
Anthropic (United States)	Language model that generates the assistant's answers	Content of the messages sent to the assistant and, if shared, the approximate location
OpenStreetMap	Mapping for the beach map	IP address when loading the map images
Google (Google Fonts)	Site typefaces	IP address when loading the fonts
rtsp.me and the camera owners	Live camera streaming	IP address, only if the user presses play on a camera: until then no external content is loaded

International transfers

Using the conversational assistant involves a transfer of data to Anthropic, PBC, based in the United States, covered by the standard contractual clauses approved by the European Commission. The user can avoid this transfer entirely by not using the assistant: the rest of the site works normally without it. We recommend not including personal data or sensitive information in messages to the assistant, which are also logged on the server as indicated in the table above.

4. Browser storage and cookies

This site does not use advertising, tracking or third-party analytics cookies. Visit statistics are produced on our own server. Only information strictly necessary for the service to work, or which the user expressly requests, is stored in the browser:

Item	Purpose
sws.session	Keeping the registered user signed in
adroko.userLocation	Remembering the location the user shared voluntarily, so it does not have to be requested again
rating_password, surf_password	Remembering the password for the internal session logging forms

All this information is stored locally on the user's device and can be deleted at any time by clearing the site data from the browser settings. When a live camera is played, the external provider may store its own cookies; that load only happens if the user requests it by pressing play.

The moment the site adds advertising or any other tool that installs non-essential cookies, the user's consent will be requested beforehand through the corresponding management system, with the option to accept, reject or configure them, and this policy will be updated.

5. User rights

Users may exercise their rights of access, rectification, erasure, objection, restriction of processing and portability of their data, as well as withdraw the consent given, by writing to mdeoruetasws@gmail.com.

Registered users can exercise the right of erasure directly by deleting their account from the My account page. Doing so deletes the email address, username and password, as well as favourite beaches. The ratings contributed are kept dissociated from the user's identity, having been incorporated into the datasets used to train the prediction models.

Users also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if they consider that the processing does not comply with the applicable rules.

6. Minors

Registration is permitted from the age of 14, in accordance with article 7 of the LOPDGDD. Anyone below that age requires the consent of their parents or guardians. If an account is found not to meet this condition, it will be deleted.

7. Data security

Communications with the site are encrypted using HTTPS. Passwords are stored using a salted hash function, so they are neither readable nor recoverable. Periodic backups of the database are made and administrative access to the server is restricted by key-based authentication.

Despite these measures, no system is completely invulnerable, so absolute security cannot be guaranteed.

8. Changes to this policy

This policy may be updated to adapt to regulatory changes or changes in the service itself. The date shown at the top indicates the last revision. Periodic review is recommended.