LOVEO Data · Legal
Privacy policy
This policy explains what personal data LOVEO Data processes, why, for how long and how you can exercise your rights. It covers two groups of people: those who use the website and the API, and the stores whose catalogue data appears in the service.
Last updated:
01Who is responsible
The data controller is TracknTake SLU, Spanish tax ID B56357072, registered at Camino de Son Llagosta 26, 07015 Palma de Mallorca, Illes Balears, España. LOVEO Data is a service of TracknTake SLU.
For any privacy question, write to hola@loveoo.app or by post to the address above.
02What data we process and why
| When | Data | Purpose | Legal basis |
|---|---|---|---|
| You request access, a brand report or the removal of a store | Name, email, company or project, tax ID (optional), profile, the message you write and a hash of your IP address | Review the request, reply, prepare the report or remove the store, and prevent abuse | Pre-contractual steps at your request (Art. 6(1)(b) GDPR) and legitimate interest in preventing abuse (Art. 6(1)(f)) |
| You are an API customer | Contact name, email, company, tax ID, plan, API keys (we only store their hash) and a call log: time, endpoint, parameters, result and a hash of the IP | Provide the service, enforce plan limits, invoice, support you and detect unauthorised use | Performance of the contract (Art. 6(1)(b)) and legal invoicing obligations (Art. 6(1)(c)) |
| You sign in to your account | Email, a single-use sign-in link (we store its hash) and a session cookie | Identify you without passwords | Performance of the contract (Art. 6(1)(b)) |
| You use the demo search | A hash of your IP and a daily search counter; when enabled, Cloudflare Turnstile's bot check | Apply the demo's daily limit and slow down automated use | Legitimate interest in protecting the service (Art. 6(1)(f)) |
| You visit the website | Page viewed (on the search page, also the search text), referring site, campaign parameters (utm), language, device type and an anonymous identifier that changes every day. We never store your IP for this | Learn which pages and campaigns work, without cookies and without following anyone from one day to the next | Legitimate interest in measuring and improving the website (Art. 6(1)(f)) |
We do not sell users' or customers' personal data, we do not use it for third-party advertising, and we make no automated decisions with legal effects on anyone.
03Store data
LOVEO Data gathers public information about stores in Madrid: trade name, address and location, website, category, product catalogue, prices and published availability, with the date we read them and a link to the source page.
This is mostly business data. When a store belongs to a sole trader, its trade name or address may identify them, and the GDPR then applies. The data comes from the store's own website and from what the store publishes on TracknTake's LOVEO platform (Art. 14 GDPR).
The purpose is to provide market information about local retail to companies, brands and developers. The legal basis is our and our customers' legitimate interest in that information, which is limited to commercial data the store itself makes public (Art. 6(1)(f)).
Any store can ask to be removed at Remove my store. We remove it within 7 days and stop reading its catalogue for this service. We keep the request so that the removal lasts.
04Who we share data with
We do not disclose personal data to third parties unless the law requires it. We use these providers, who process data on our behalf under a data processing agreement:
- Hetzner Online GmbH (Germany): hosting of the website, the API and the database.
- Resend (USA): the service's emails (API keys, sign-in links, alerts).
- Slack (USA): internal alerts to the team when a request arrives.
- Cloudflare (USA): Turnstile bot check on the demo search, when enabled.
- OpenFreeMap: the maps. Your browser downloads map tiles directly from their servers, which see your IP address.
Transfers to the USA rely on the EU-US Data Privacy Framework where the provider is certified or, otherwise, on the European Commission's standard contractual clauses (Art. 46 GDPR).
05How long we keep it
- Requests that do not become customers: 24 months.
- Customer data: for the length of the relationship and then the legal periods (6 years for accounting and invoicing records).
- API call log: 12 months.
- Demo counters and sign-in links: 30 days.
- Visit statistics: 24 months; the daily identifier cannot recognise anyone the next day.
- Store removal requests: for as long as the store stays removed.
07Your rights
You can ask for access to your data, its rectification or erasure, restriction of processing and portability, and object to processing based on legitimate interest. Write to hola@loveoo.app saying which right you are exercising; if we cannot identify you from the address you write from, we will ask for the minimum needed. We reply within one month.
If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es) or your local authority.
08Security
API keys and sign-in links are stored only as hashes, IP addresses are stored as hashes, all traffic is encrypted (HTTPS) and access to the systems is restricted to the team that runs them.
09Changes to this policy
If we change this policy, we will publish the new version here with its date. If the change is significant and you are a customer, we will email you before it applies.