Privacy Policy

Last updated: 2026-06-01

1. Data controller

Marcos Pascual, residing in Spain. Contact: hello@elcano.tax.

2. Data we collect

• Email address: only if you create an account. Used to authenticate you and sync data across devices.
• Travel entries (date and country): stored in your browser (localStorage) if you have no account, or in our Supabase database if signed in.
• Evidence documents (PDFs or images you choose to upload): stored in Supabase Storage only if signed in.
• Preferences (language, theme): stored in your browser.

3. Purpose

To provide the service: count days per country, evaluate residency risk, show alerts, and generate exports.

4. Legal basis

Article 6(1)(b) GDPR: performance of the contract implied by your use of the service.

5. Processors

• Vercel Inc. — web hosting. Vercel is certified under the EU-US Data Privacy Framework (DPF) and operates with Standard Contractual Clauses (SCC) by default.
• Supabase Inc. — database, authentication, and file storage. Data is stored on servers located in the European Union (Frankfurt).

6. International transfers

Vercel operates from the United States; this transfer is covered by the Data Privacy Framework and Standard Contractual Clauses.

For Supabase: data is stored within the European Union, with no international transfer for storage.

7. Automated decision-making

No automated decision-making or profiling is performed (GDPR Art. 13(2)(f)).

8. Voluntary nature of the data

Providing data is voluntary. The only consequence of not providing it is being unable to use the service, or certain features (for example, you cannot sync across devices without an email).

9. Retention

While your account is active. You may request account deletion by writing to the contact email. After receiving your request, your data is deleted within a reasonable timeframe.

10. Your rights

You may exercise the rights of access, rectification, erasure, objection, portability, and restriction of processing (GDPR Arts. 15-22) by writing to hello@elcano.tax.

If you believe the processing does not comply with applicable law, you may file a complaint with the Spanish Data Protection Agency (AEPD) or your local supervisory authority.

11. We do not sell or share your data

We do not sell your data. We do not share it with third parties other than the processors named above.

12. Changes to this policy

Material changes will be reflected by updating this page and its "last updated" date. We recommend reviewing the policy periodically.