Privacy Policy

Last updated: October 16, 2026

Volcanic Labs SLU is the controller of the personal data described in this policy. This policy explains how AltCatalog processes personal data when you use altcatalog.com and the related Services. We determine how the directory is researched, published, ranked and moderated. We do not process directory Contributions solely on a vendor’s instructions.

1. Data we collect

• Account: name/username, email, hashed password, supplied OAuth profile/image, consent records and vendor-claim verification.
• Billing: plan, transaction, subscription and invoice metadata. Stripe handles card details. We do not store full card numbers.
• Contributions: proposals, sources, reasons, flags, edits and moderation history. Usernames and contributions may be public. Your account email is not published.
• Audience measurement: page views, referrers, outbound links and interactions. Events use a daily-rotating salted IP/user-agent hash, not the raw IP address.
• Interaction identifiers: keyed IP/user-agent hashes for vote and flag deduplication, kept up to 12 months without the raw values.
• API/security logs: request metadata for abuse prevention, security, troubleshooting and rate limits, normally kept 90 days.
• Communications: support, rights, moderation and other messages.
• Public/professional sources: business contacts and product information for directory verification, not unsolicited marketing.

Sources are you, service usage, login/payment providers, public product websites and professional sources. Hashes that distinguish a person or device are personal data, even without a directly identifying name.

2. Why we process data and our legal bases

• Contract: accounts, requested paid Services, transactions and support where you personally contract with us. Account/billing details are necessary for those services.
• Legitimate interests: operating, securing and moderating the directory, organisational contacts, abuse prevention, public factual history, legally permitted limited audience measurement and legal claims. We balance these interests against your rights.
• Legal duties: accounting, tax and lawful requests.
• Consent: optional product news and any analytics or similar technology requiring it. These are optional and consent can be withdrawn.

3. Cookies and similar technologies

We do not use Google Analytics, Google Tag Manager or advertising cookies. Cookies and browser storage support requested session, login, security, language and CSRF functions. Cookieless audience measurement includes self-hosted Umami at analytics.techdocs.studio, respecting Do Not Track and excluding query strings and fragments.

Measurement is limited to this site’s statistics, without advertising profiles or cross-site tracking. Where consent is required, processing starts only after consent and withdrawal is available through the same controls. Cookieless operation alone does not establish an exemption. Signup may use Google reCAPTCHA for abuse prevention, limited to that purpose with consent where required. Google’s privacy terms explain its processing.

4. How we share data

We do not sell personal data. We disclose data when necessary to service providers acting for us, including DigitalOcean and Netlify for hosting, Cloudflare R2 for object storage, Stripe for payments, Brevo for email, Sentry for error monitoring, and Google reCAPTCHA for signup abuse prevention. We may also disclose data to professional advisers, a successor in a corporate transaction, to comply with law, or to protect rights and security.

5. International transfers

Some providers process data outside the European Economic Area. Where required, we rely on an adequacy decision, Standard Contractual Clauses, or another lawful transfer safeguard, with supplementary measures where needed. Contact us to request information or a copy of the applicable safeguards. Confidential information and other people’s data may be redacted.

6. Retention

• Account data remains while needed for service and requests. Later retention is limited to legal obligations or claims with restricted use.
• Accounting records generally remain six years from the last entry, longer where law or an unresolved claim requires.
• Public facts/history may remain for accuracy and accountability, not unlimited personal-data retention. We assess correction, deletion and objection requests and remove or disassociate identifiers where appropriate.
• Raw audience events and API logs are normally deleted after roughly 90 days. Vote/flag hashes are deleted after 12 months and treated as pseudonymous data.
• Only genuinely anonymised statistics may remain indefinitely. Backups stay isolated and protected until rotation removes them. Disaster recovery must reapply deletion instructions.

7. Your rights

Depending on processing and law, request access, correction, deletion, restriction or portability. Object to legitimate-interest processing for reasons relating to your situation, and to direct marketing at any time. Withdraw consent without affecting earlier lawful processing. Email [email protected]. We may request necessary identity evidence where reasonably in doubt.

We respond without undue delay and within one month. Where complexity or request volume requires up to two additional months, we explain within the first month. Requests are normally free. Any legally permitted fee or refusal for manifestly unfounded or excessive requests will be explained. You may complain to the Spanish Data Protection Agency (AEPD) or your local supervisory authority.

8. Marketing

We send optional AltCatalog product updates only where you have opted in. You can unsubscribe through the message or change your account preference. Service and account messages are not marketing.

9. Automated decisions

AltCatalog uses automated processing to help research, rank software, and detect abuse. We do not make decisions about people that produce legal or similarly significant effects solely by automated means.

10. Children

The Services are not directed to people under 18, and we do not knowingly collect their personal data.

11. Changes

We post updates with a last-updated date and give additional notice of material changes where required, before new processing starts where necessary. A policy update does not replace required consent.

12. Controller and contact

Volcanic Labs SLU · NIF B75399162
Plaza de Galicia, Local 7, El Médano, 38612 Granadilla de Abona,
Santa Cruz de Tenerife, Spain
Mercantile Registry of Santa Cruz de Tenerife, Section 8, Sheet TF-73201, Entry 1
Email: [email protected]