Privacy Policy

Last updated: August 6, 2026

Volcanic Labs SLU is the controller of the personal data described in this policy. This policy explains how AltCatalog processes personal data when you use altcatalog.com and the related Services.

1. Data we collect

• Account and profile data: name or username, email, hashed password, OAuth account details and profile image where supplied, consent records, and information used to verify a vendor claim.
• Billing data: plan, subscription, transaction, and invoice metadata. Stripe processes card details; we do not store full card numbers.
• Contributions: proposals, sources, reasons, flags, edits, and moderation history. A username and contribution may appear publicly; email addresses are not published.
• First-party analytics: page views, referring and outbound links, and interactions. We use a salted hash of IP address and user agent that rotates daily. We do not retain the raw IP address in analytics events.
• Interaction identifiers: for anonymous vote and flag deduplication, we store a keyed hash derived from IP address and user agent for up to 12 months. We do not store the raw values in those records.
• API and security logs: request metadata used for security, abuse prevention, troubleshooting, and rate limits, normally retained for 90 days.
• Communications: support, rights, moderation, and other messages you send us.
• Public and professional sources: business contact and product information from public sources where needed to operate and verify the directory. We do not use it for unsolicited marketing.

2. Why we process data and our legal bases

• Contract: to create and manage accounts, provide requested paid Services, process transactions, and respond to service requests.
• Legitimate interests: to operate, secure, measure, improve, and moderate AltCatalog; prevent duplicate or abusive activity; maintain public factual history; and establish or defend legal claims. We balance these interests against your rights.
• Legal obligations: for accounting, tax, fraud prevention, and lawful requests.
• Consent: to send optional product news where you opt in. You may withdraw consent at any time.

3. Cookies and similar technologies

AltCatalog does not use Google Analytics, Google Tag Manager, advertising cookies, or other optional browser tracking. We use only cookies and local browser storage needed for functions you request, such as sessions, authentication, security, language, and CSRF protection. Our first-party audience analytics are cookieless. Signup forms may use Google reCAPTCHA to prevent automated abuse; Google's privacy terms apply to that service.

4. How we share data

We do not sell personal data. We disclose data when necessary to service providers acting for us, including DigitalOcean for hosting, Cloudflare R2 for object storage, Stripe for payments, Brevo for email, Sentry for error monitoring, and Google reCAPTCHA for signup abuse prevention. We may also disclose data to professional advisers, in a corporate transaction, to comply with law, or to protect rights and security.

5. International transfers

Some providers process data outside the European Economic Area. Where required, we rely on an adequacy decision, Standard Contractual Clauses, or another lawful transfer safeguard. Contact us to request information about the applicable safeguard.

6. Retention

• Account data is kept while the account is active and then deleted or anonymized within a reasonable period, unless required for another lawful purpose.
• Invoices and accounting records may be retained for up to six years as required by Spanish law.
• Public factual Contributions may remain in the directory and change history. We will disassociate personal identifiers where appropriate.
• Raw first-party analytics events and API request logs are normally deleted after roughly 90 days.
• Stable anonymous vote and flag hashes are deleted after 12 months.
• Aggregated or de-identified data that no longer identifies a person may be retained without a fixed period.

7. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent without affecting earlier lawful processing. Email [email protected] to exercise a right. We normally respond within one month and may ask for information needed to verify your identity.

You may complain to your local supervisory authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD).

8. Marketing

We send optional AltCatalog product updates only where you have opted in. You can unsubscribe through the message or change your account preference. Service and account messages are not marketing.

9. Automated decisions

AltCatalog uses automated processing to help research, rank software, and detect abuse. We do not make decisions about people that produce legal or similarly significant effects solely by automated means.

10. Children

The Services are not directed to people under 18, and we do not knowingly collect their personal data.

11. Changes

We may update this policy and will post the revised version and effective date here.

12. Controller and contact

Volcanic Labs SLU · NIF B75399162
Plaza de Galicia, Local 7, El Médano, 38612 Granadilla de Abona,
Santa Cruz de Tenerife, Spain
Mercantile Registry of Santa Cruz de Tenerife, Section 8, Sheet TF-73201, Entry 1
Email: [email protected]