Privacy policy

The controller for the processing described in this policy is the entity that operates WaToDo. Full registration details will be published here before commercial launch. In the meantime, hello@watodo.live is the binding contact channel for any personal-data request and is answered by the controller.

• Preferences, events you like or save, filters and language: stored in your own browser, not on our servers.
• Search queries and basic technical data may be stored to improve search, security and debugging. Query text is stored as typed, up to 300 characters — please don't type personal details into the search box.
• Voice search: the recording is sent to our transcription provider to turn it into text. Only the resulting text is kept, under the same retention as any other query.
• If you give us an email address to get in touch or propose an event, we use it only for that.

• To match and rank events against your search and preferences.
• To prevent abuse, measure performance and fix faults.
• To improve classification, source quality and how we interpret search phrasing.

Where consent is required — for example email updates — you can withdraw it at any time. Processing needed to run the site, secure it, prevent abuse and improve performance relies on our legitimate interest in providing a working, useful service, subject to your rights (GDPR Art. 6(1)(f)).

We do not sell personal data. These providers process it on our behalf, only to operate the service:

• Vercel Inc. — application hosting, CDN and request logs (United States / EU regions).
• Supabase Inc. — managed PostgreSQL database holding the event catalog, source configuration and search telemetry.
• OpenAI, L.L.C. — natural-language search parsing, event text translation and voice-search transcription. Voice search uploads the recorded audio clip to OpenAI for transcription; nothing else is sent, and the clip is not stored by us afterwards.
• Resend (Plus Five Five, Inc.) — transactional and operational email (inbound event submissions, admin alerts).
• Firecrawl — assisted fetching of publicly reachable event pages during scraping. It never receives visitor data.

Some of those providers operate outside the European Economic Area and outside Israel. Where they do, the transfer relies on the European Commission's Standard Contractual Clauses or an adequacy decision, together with the provider's own supplementary measures.

• Search telemetry (the query text, the filters applied and the returned event ids): 90 days, then deleted automatically by the daily maintenance job.
• Event submissions sent through the form or by email: kept while the proposed source is under review, and for up to 12 months after a decision so the same rejected source is not re-reviewed.
• Operational request logs held by our hosting provider: retained under that provider's own retention window, currently up to 30 days.
• Likes, saves, filters, language and preference settings: stored in your own browser only, until you clear your browser storage. We never receive them.

You can request access, rectification, erasure, restriction, objection and portability, and withdraw consent. Write to hello@watodo.live; we answer within one month and may ask for reasonable information to verify your identity. You can also complain to the Spanish data protection authority (AEPD), your local supervisory authority, or the Israeli Privacy Protection Authority.

We use your search, filters and preferences to classify and rank events. This personalisation does not produce decisions with legal or similarly significant effects for you.

The service is intended for adults and does not ask children for personal data. We may update this policy as the service changes; the update date is shown above.