Privacy

Who is responsible

Mercedes Teresa Delgado Hernández, tax id Z2442136R, Avenida de Cervantes, 4, BJ-A, 10005 Cáceres, is the controller of the personal data Same Streets handles. For anything about your data, write to [email protected].

What we keep

• Your email address, when you buy or sign in. It is your account.
• What you bought: the experience, the price, the date, the language you bought in, and the references Stripe gives the payment, so we can show your library, write to you in your language, answer questions and refund you.
• Gifts: when you buy one, its code and whether and when it was opened. When you open one, the experience joins your account like a purchase; the buyer is not told your address.
• Sign-in records: when a sign-in link was sent and used, and the devices that are signed in. We store a scrambled form of each link and session, never the link itself.
• When you ask us to send you an experience for your trip: which experience, when, in which language, and whether you also asked for news. Your address is kept only in a scrambled form that cannot be turned back into it: enough to send no more than three a day to the same address and to count the requests, never enough to write to you again.
• If you ask for news: your email address, your language, and when you asked, confirmed and, if you do, left. You are on the list only once you confirm from the email we send.
• If you came from one of our ads and said yes: the ad’s click reference and your browser type, kept with your order, so we can tell that network the ad led to a purchase (below).
• Server logs: our hosting provider records the requests made to the site, with the IP address, to keep it running and secure.

What we don’t

We do not see your card details: Stripe takes the payment and tells us only that it went through, with your email, your name and your country. We do not track your location: we read the country your connection comes from only to show prices in your currency, and do not keep it. We count visits to our pages on our own servers, without cookies: which page was seen, and which site or campaign link led there, but never who you are, your IP address or your device. We use no outside analytics, no advertising scripts and no tracking cookies, and we never sell your data. We tell an ad network about a purchase only if you came from its ad and said yes. We write to you with news only if you asked for it and confirmed.

Why, and on what basis

• To sell you an experience, give you access to it and send the emails that go with it (the purchase email and sign-in links): this is needed to fulfil our contract with you.
• To send you an experience you asked us to email you: needed to do what you asked.
• To send you news of new stories and offers: your consent, which you can withdraw at any time from the link in every news email.
• To tell Meta or Google that their ad led to a purchase, so we can see which ads work: your consent, asked only when you arrive from their ad. Saying no, or not answering, changes nothing else.
• To keep invoices and payment records for as long as tax and accounting law requires: a legal obligation.
• To keep the site secure and stop abuse, such as too many sign-in requests: our legitimate interest in running a safe service.
• To ask you, once, a week after you buy, how the walk went: our legitimate interest in knowing whether what we make works. It has no offers, and if you tell us not to, we won’t. If you reply and say we may, we quote a line of it on the site with your first name and country only.

Who else handles it

We use a few providers, each only for its part of the service:

• Stripe takes payments, and handles your card details under its own privacy policy.
• Railway hosts the site and the database, in the United States.
• Resend sends our emails, from the European Union.
• Cloudflare runs our domain and stores the nightly backups of our database.
• Meta (Meta Platforms Ireland) and Google (Google Ireland), only if you came from one of their ads and said yes: that network gets the ad’s click reference, your browser type, the price and the time of the purchase, under its own privacy policy. Never your name or email.
• OpenFreeMap serves the map’s background. Your browser asks it for map tiles directly, so it sees your IP address, but not who you are.

Where data leaves the European Economic Area, the transfer is covered by the EU–US Data Privacy Framework or by the European Commission’s standard contractual clauses.

How long

• Your account and library: until you ask us to delete them.
• A sign-in link: it stops working after 15 minutes, or once used.
• A signed-in device: one year, or until you sign out.
• The news list: until you leave it. An address that asked for news but never confirmed is deleted after 30 days.
• The scrambled record of an experience sent for your trip: until you ask us to delete it.
• A gift’s code: as long as the order’s payment record. Deleting the account that opened it removes the link between the two.
• An ad’s click reference and browser type: deleted from the order 91 days after you started the checkout. Meta is sent them once; Google can read them for 90 days after the purchase.
• Payment records: as long as tax law requires, even after an account is deleted.
• Backups: each nightly copy of the database is deleted after 30 days.

Cookies

Same Streets sets two cookies. Both are needed for the service to work, so they do not need your consent:

• ss_session, when you sign in. It keeps you signed in for up to a year.
• lang, when you press buy. It remembers the language you were reading in for a day, so that you come back from the checkout page to the site in it.

Stripe’s checkout page sets its own cookies, to take the payment and prevent fraud.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to send it to you in a portable form, or to restrict or object to how we use it. Write to [email protected] from the address of your account; we answer within a month.

If you think we have not handled your data properly, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos, or to the authority in the country where you live.

Children

Same Streets is not meant for children under 14, and we do not knowingly keep their data. If you think a child has given us their email, tell us and we will delete it.

Changes

When we change this policy, we update the date at the top. If a change affects how we use data you have already given us, we will tell you by email first.