Privacy policy

Who is responsible

The data controller is Daniel Marín Bocanegra, tax ID (NIF) 49364636N. You can write to us at [email protected] about anything to do with your data.

What data we keep

• Your account: your email address, the name you choose and, if you sign in with Google or Apple, the profile photo they give us and that account's identifier.
• Your lists: the items, quantities and notes you add, who adds them and who checks them off, the shop where each item is usually bought, and the shopping you finish (date, items, total if you enter it, shop and who paid).
• Recipes and profile, if you use them: what you publish, who you follow and who follows you. Your profile is private unless you make it public.
• lalista Plus, if you subscribe: the plan, the store, the subscription dates and the price charged. Payment is handled by Apple or Google; we never see your card details.
• Your devices: your open sessions (phone model and system, IP address when signing in), your language and, if you turn on notifications, the identifier that lets us send them to your phone.
• Moderation: the reports you make or receive and the people you block.

When you dictate a list, your voice is turned into text by your own phone or by Apple's or Google's speech service. Only the text reaches us; we keep no audio.

What we use it for, and on what basis

• To provide the service: keeping and syncing your lists, sharing them with the people you invite, sending you sign-in codes, the notifications you turn on and the service emails (welcome, security changes, Plus and the monthly summary, which you can turn off). Basis: the contract you accept when you create your account.
• To protect the service: preventing abuse, handling reports and blocking accounts that break the terms. Basis: our legitimate interest in keeping lalista safe.
• To improve lalista with aggregated usage statistics we calculate on our own servers, without third-party tools. Basis: our legitimate interest; you can object by writing to us.

We make no automated decisions about you and build no marketing profiles.

Who else can see it

The people on each list see what is added and bought on it, and your name and colour. What you publish on a public profile can be seen by anyone.

These providers also process data on our behalf, only to provide the service:

• Hetzner Online GmbH: hosting the servers and the database, in Germany.
• Resend: sending emails.
• Expo: sending notifications to your phone, through Apple (APNs) and Google (FCM).
• RevenueCat: managing lalista Plus subscriptions.
• Apple and Google: signing in with their accounts, app stores and payments.

Some of them are in the United States. These transfers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. lalista's servers and database are in Germany, inside the European Union.

How long we keep it

• For as long as you have an account. What you delete from a list is gone for good after 30 days.
• If you delete your account, we delete your data, your sign-in methods, your profile and your recipes. On lists you shared, what you added and the shopping you did stay for the other members, under the name “Deleted user”.
• Backups are kept for 14 days and then deleted.

Your rights

You can access, correct and delete your data, object to or ask us to restrict its processing, and take it with you. In the app, Settings → Export my data gives you a file with everything, and Settings → Delete account deletes it.

For anything else write to us at [email protected]. If you think we have not handled your rights properly, you can complain to the Spanish Data Protection Agency (https://www.aepd.es).

Minimum age

You must be at least 14 to create an account, the age from which Spanish law lets you give consent yourself.

Cookies

This website uses no cookies and stores nothing in your browser. The server's invitation and sign-in pages use only a technical session cookie, which is needed to sign in.

Security

Everything travels encrypted (HTTPS). On your phone, your session is kept in the system's secure storage. We limit sign-in attempts and review abuse reports.

Changes

If we change anything important in this policy, we will tell you in the app or by email before it applies.