Skip to content

Privacy policy

Last updated: 30 October 2026

Data controller

The controller of your personal data is ALGORENTA, S.L., the company that owns the Nalucam service. Its commercial registry details and contact email address are published in the legal notice on this same website, and that address is also the channel for anything related to this policy.

ALGORENTA, S.L. has not appointed a data protection officer, because it carries out no large-scale processing, no systematic monitoring and no processing of special categories of data. This is stated here because an absence is information too.

What data we collect and where from

All the personal data we process is given to us directly by you when you sign up to Nalucam. We do not buy it, we do not obtain it from third parties and we do not combine it with any other source.

Only the email address is required: without it we cannot confirm your sign-up. You may leave every other field blank, the town included, and your sign-up remains valid, although the town is what helps us most to decide where to start.

If instead of typing your email you choose “Continue with Google”, it is Google that, at your request, tells us your email address and that you have verified it. We do not receive your name, photo, contacts or any other data from your Google account, and we do not store any identifier of that account.

Even if you do not accept cookies, we measure without cookies, with our own measurement software, how the site is used: pages viewed, where the visit came from —including the campaign you came from—, time on the page, how far you read and whether the form is used, with approximate device details and the IP address anonymised. Nothing is stored on your device and neither your email address nor any ad identifier is collected. If you accept audience measurement, three first-party cookies are also used to recognise your browser between visits, and we record where you click, how you move the mouse and how far down each page you scroll, to draw heatmaps of the site. What you type is not recorded and no sessions are recorded. If, with measurement accepted, you open the webcams page from the personal link in your welcome email, measurement also links your visits to a pseudonymous identifier of your sign-up —it is not your email address and is not derived from it— to know whether you come back.

The webcams page links to third-party cameras. Opening one takes you off our site to its owner’s website, which applies its own privacy policy; we send it none of your data. The wave and wind forecast is requested by our server from Open-Meteo using the cameras’ coordinates, never any data about you.

If you accept advertising, we also process your IP address, your browser identifier and the pages you view on this site, and that data is shared with Meta Platforms Ireland Limited and with Google Ireland Limited to measure our ads. If you also sign up, we send Meta —and only Meta— your email address in hashed form and a pseudonymous identifier of your sign-up as well, as explained in the section on Meta. We do not share your email address in plain text, your name, your town or your comment with Meta or with Google. If you do not accept it, none of this is collected or sent.

Purpose and legal basis

Your sign-up data is processed to let you know when the service opens in your town and to decide the order in which cameras are installed. The legal basis is your consent under article 6.1.a of the Regulation, which you give by confirming your sign-up from the message we send you by email or, if you choose “Continue with Google”, by doing so with the consent box ticked: Google has already verified your email and your sign-up is confirmed without that message. When you confirm, we also send you a single welcome email with a personal link to the webcams page, which is your access to it without a password. If two days after confirming you have not told us your municipality, we write to you once, and only once, to ask for it.

Audience measurement data is processed to understand which parts of the site are used and to improve it. Measurement without cookies is based on our legitimate interest in knowing whether the site works (Article 6(1)(f) of the Regulation): it leaves nothing on your device, does not identify you and you can object by writing to us. The measurement cookies are based on your consent, the one you give in the cookie notice: until you give it, none is set.

Advertising data is processed to find out which of our ads bring sign-ups, so we do not spend on the ones that do not. Its legal basis is your consent, given separately in the cookie notice: until you give it, neither the Meta pixel nor the Google tag is loaded and nothing is sent to either of them, neither from your browser nor from our server.

Where your sign-up came from —the tags of the link you arrived through— is processed for the same purpose, but its legal basis is NOT cookie consent: it travels inside the form itself, alongside your email address and your town, and relies on the same consent you give when signing up. That is why it is stored whether you accept cookies or reject them, and why it never leaves our server. The one exception is the Google click identifier, and only if you have accepted advertising: it is explained in the section on Google.

Accepting this privacy policy and accepting the cookie notice are separate decisions and are asked for separately: accepting one does not accept the other. You can withdraw either of them whenever you want, and withdrawing is as easy as giving it was. Withdrawing consent does not affect the lawfulness of processing carried out before.

No automated decisions producing legal effects on you or similarly significantly affecting you are taken. We carry out no profiling with your data. If you accept advertising, Meta can associate your visit with your Facebook or Instagram account, and Google with your Google account, and use it to profile the ads you see: that is their decision, not ours, and it is exactly what you stop authorising if you reject that category.

Data processors

To run the service we rely on providers who access the data on our behalf and only under our instructions, under the processing agreement required by article 28 of the Regulation. None of them processes your data for their own purposes.

Server hosting is provided by Hetzner Online GmbH, in data centres located in Germany. The confirmation and welcome messages are sent by Scaleway SAS, in data centres located in France.

If you choose “Continue with Google”, signing in to your account is handled by Google Ireland Limited as an independent controller, under its own privacy policy. Our page loads nothing from Google until you press that button, and we send it none of your data: we only ask it to confirm your email.

Audience measurement runs on software installed on our own server, so no third party is involved in it.

Sharing with Meta and international transfers

Meta Platforms Ireland Limited is not a processor of ours: it is an independent controller that also processes the data it receives for its own purposes. That is why it gets its own section rather than a line in the list above — the difference is not cosmetic: a processor may only do what we tell it to, and Meta may not be told.

This sharing only happens if you accept the advertising category in the cookie notice, and it stops the moment you withdraw it. What is shared is your IP address, your browser identifier, your browser type and the pages you view on this site, plus the fact that you signed up or confirmed your sign-up.

Together with that fact we also send your email address as a SHA-256 hash —an encrypted fingerprint that does not contain the address in plain text, but which Meta compares with its users’ addresses to find out whether your sign-up came from one of our ads— and a pseudonymous identifier of your sign-up, also encrypted, that contains none of your data. Your email address in plain text, your name, your town and your comment are not shared.

Meta may process that data outside the European Economic Area, in particular in the United States. That transfer relies on the European Commission’s adequacy decision on the EU-US Data Privacy Framework, to which Meta is certified, and on the standard contractual clauses Meta incorporates into its terms. If you reject advertising, no international transfer to Meta takes place.

Sharing with Google and international transfers

Google Ireland Limited, of Gordon House, Barrow Street, Dublin 4 (Ireland), is not a processor of ours either: for Google Ads conversion measurement it acts as an independent controller that also processes the data it receives for its own purposes, under its Google Ads terms. That is why, like Meta, it gets its own section rather than a line in the list of processors.

The purpose is to measure which of Nalucam’s ads on Google bring sign-ups, and the legal basis is your consent. This sharing only happens if you accept the advertising category in the cookie notice, and it stops the moment you withdraw it: until you accept it, nothing from Google is loaded in your browser. What is shared is your IP address, your browser type, the pages you view on this site, the click identifier you arrived with from a Google ad and the fact that you signed up or confirmed your sign-up, together with a random conversion identifier that does not contain your email address and cannot be used to work it out.

If you arrived from a Google ad, the click identifier Google adds to the address is stored alongside your sign-up, with the other source tags, whether or not you accept cookies. But it is only used to tell Google that the click ended in a sign-up, and only if you have accepted advertising: in that case we send Google the click identifier, the name of the conversion and the time, and nothing else. If you have not accepted it, that identifier never leaves our server.

We never send Google your email address or any phone number, whether in plain text or hashed, nor your name, your town or your comment. We do not use Google Analytics or Google Tag Manager.

Google may process that data outside the European Economic Area, in particular in the United States, through Google LLC. That transfer relies on the European Commission’s adequacy decision on the EU-US Data Privacy Framework, to which Google LLC is certified, and on the standard contractual clauses Google incorporates into its terms. If you reject advertising, no international transfer takes place, neither to Meta nor to Google: all the rest of the processing happens within the European Economic Area.

Retention periods

Your sign-up data is kept until you ask to be removed or for it to be deleted. If you never confirm your sign-up, it is kept all the same, but we send you no communications.

Audience measurement data is kept for a maximum of 25 months, and the identifier that measurement stores in your browser expires after 13 months. These are the periods set by the Spanish Data Protection Agency in its audience measurement guidance, and we apply them even though our processing does not rely on the exemption that guidance covers.

The record of your cookie decision is stored in your own browser for 24 months. Once that period is over you are asked again, because an expired decision is neither acceptance nor refusal: it is the absence of a decision.

ARSULIPO rights and how to exercise them

The Regulation grants you six rights over your personal data, usually summarised in Spain with the initials ARSULIPO:

To exercise any of them, write to the email address given in the legal notice, saying which right you are exercising. We will reply within one month of receiving your request. Exercising them is free of charge.

To leave Nalucam you do not even need that: every message we send you includes an unsubscribe link that does it in a single step.

Complaints to the AEPD

If you believe that the processing of your data does not comply with the rules, you can lodge a complaint with the Spanish Data Protection Agency (AEPD), the supervisory authority with jurisdiction in Spain, through its electronic office at www.aepd.es.

Before going that far you can write to us: we would rather sort it out directly, and we answer any request within one month.

Changes to this policy

This policy may change if the processing, the providers or the applicable rules change. The date of the last update appears at the top of the document, and that is what lets you check at a glance which version you are reading.

Where a change affects the purposes of the processing we will ask you again rather than assume your consent. Changes do not apply retroactively: processing already carried out is governed by the policy published at that time.