privacy policy

This policy describes how Flagra collects and handles personal data from people who visit the site and from people who contact us. It's written in plain language; when technical terms come up, we explain them.

Who is the data controller

The controller of personal data collected on Flagra is:

Grind Software, Lda.
NIPC 517157160
Rua António Alves da Silva, 133 3E
4480-086 Vila do Conde, Portugal
hello@flagra.pt

What data we collect

When you fill in the contact or suggestions form. We collect your name, email, and the content of your message (suggestion, correction, photo description, etc.). If you send a photo, we also collect the attribution and the terms of the licence you give us. The legal basis for this processing is your consent, given when you submit the form.

When you save a custom route on the map (/mapa/). We ask for your name and email so you can receive the permanent link to the route you built. The name (and the description, if you fill it in) gets stored alongside the route in our database and is visible to anyone who opens the link. Your email is NOT stored on our side: it's used once to send you the link, and discarded straight after. For that delivery, your address passes through Resend's infrastructure (see "Sharing with third parties"). Legal basis: consent.

When you leave your email at our "anti-newsletter". We don't have an active newsletter. We collect your email purely as a signal of interest: if we ever reach critical mass to justify sending one, we'll decide at that point and come back to confirm with you. Until then, the email just sits there, unused. It's not shared with third parties. You can ask for removal at any time. Legal basis: consent.

When you browse the site. Even without filling anything in, the server automatically logs technical data such as your IP address, browser type, page visited, and date/time of access. This data is used to keep the site running, prevent abuse, and diagnose problems. The legal basis is our legitimate interest in operating the service securely.

Cookies and third-party technologies. As described further down, Flagra uses its own cookies and third-party cookies (Google Analytics, Google AdSense, OpenFreeMap). These can collect additional data, as detailed in the sections below.

We do not collect sensitive data (health, political opinions, religion, etc.). Flagra has no user accounts, so there's no collection of passwords or login data.

What we use the data for

We use data strictly for the following purposes:

  • Replying to contacts and suggestions: when you fill in the form, we use your email to get back to you and, where relevant, to clarify questions about photos you've shared.
  • Publishing contributions: when you agree to licence a photo or send a suggestion for publication, that data (and any credit you specify) may appear on the site.
  • Sending the link to a route you built on /mapa/: single use of your email, no storage afterwards.
  • Operating and improving the site: we look at aggregated traffic data to understand which content works and where there are problems.
  • Meeting legal obligations: when required by law or competent authority.
  • Showing advertising: through Google AdSense, as described further down.

We don't sell your personal data. We don't use it to build behavioural profiles, and we don't share it for marketing purposes outside the services listed in this policy.

Cookies, local storage, and consent management

Cookies are small text files that a site saves in your browser so it can recognise you on a later visit. Flagra uses three types of cookies:

Essential cookies. Needed for the site's basic operation (keeping session preferences, recording your cookie choice). No consent required.

Analytics cookies. Let us see, in aggregate, how the site is used. Require your consent.

Advertising cookies. Used by Google AdSense to show relevant ads and measure how they perform. Require your consent.

How consent is managed. Consent for non-essential cookies is managed by Google Funding Choices (Google's CMP, Consent Management Platform), which appears automatically on your first visit and lets you accept, reject, or customise the use of analytics and advertising cookies. You can review your choices at any time through the "Manage cookie preferences" link in the site footer.

You can also block or delete cookies directly in your browser (Chrome, Firefox, Safari, and Edge all have settings for this). Bear in mind that blocking all cookies can limit how some parts of the site work.

Local storage (localStorage). Beyond cookies, Flagra uses your browser's local storage to keep usage preferences: for example, the route you're building on /mapa/ and your preferred transport mode. This data lives only in your browser, is never sent to our server, and you can delete it any time in your browser settings.

External resources (fonts and icons). To render the site, your browser makes requests to external CDN services (Google Fonts for typography, Cloudflare for Font Awesome icons). These requests share your IP address with those providers. See their policies for more detail.

Advertising (Google AdSense)

Flagra uses Google AdSense to show advertising. This means Google, as a third-party provider, may use cookies to show ads based on your visits to this and other sites on the internet.

Specifically:

  • Google may use the DoubleClick DART cookie and similar identifiers to personalise ads.
  • Data such as your IP address, device identifiers, and browsing history on Google partner sites may be collected.
  • Ads may be personalised (based on your inferred interests) or non-personalised (generic), depending on the consent you've given.

You can manage your Google ad preferences at google.com/settings/ads and turn off personalised advertising from various networks at youradchoices.com (US) or youronlinechoices.eu (Europe).

For more on how Google uses data when you visit its partners, see policies.google.com/technologies/partner-sites.

Statistics (Google Analytics)

Flagra uses Google Analytics 4 (GA4) to understand, in aggregate, how the site is used: most-visited pages, devices, traffic sources, average time on page, etc.

GA4 collects data such as your IP address (which is truncated/anonymised by Google before storage in the European Union), device identifiers, and site interaction events. We don't use GA4 to identify individual users.

Data is processed by Google and stored on its servers, which may involve transfers outside the European Economic Area, under the safeguards provided by GDPR (the European Commission's standard contractual clauses).

You can opt out of being tracked by Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

Maps (OpenFreeMap and Mapbox)

Flagra's interactive map (/mapa/) uses OpenFreeMap as its vector tile provider (a community-hosted, open source, ad-free service). When you load a page with a map, your browser talks directly to OpenFreeMap's servers (tiles.openfreemap.org), which receive your IP address and the tile request to serve the map.

For static map images on individual pages and for the automatic calculation of route paths, we use Mapbox only on the server side: those calls leave from our server, are cached, and don't expose your IP or device identifiers to Mapbox.

Sharing with third parties

We don't sell or rent personal data. Your data may be shared, strictly when necessary, with:

  • Technical providers running the site's infrastructure (hosting, database, image CDN).
  • Resend (transactional email provider, USA): when we send you a contact confirmation, a reply from us, or the link to a UGC route, your email passes through Resend's infrastructure for delivery. Transfer to the USA under the European Commission's standard contractual clauses.
  • Google, in the context of AdSense and Analytics, as described above.
  • OpenFreeMap, when you load the interactive map.
  • Competent authorities, when legally required.

All subprocessors are bound by confidentiality and data protection obligations equivalent to our own.

Data retention

We keep data only for as long as needed for the purposes it was collected:

  • Contact messages and suggestions: up to 2 years after the last contact, or until you ask us to delete them.
  • Licensed photos and their credits: while the related content is published on the site.
  • UGC routes (name, description, and stops): while the route is accessible via its unique link. You can ask us to remove it at any time. The email used to create the route is not stored (see "What data we collect").
  • "Anti-newsletter" emails: until you ask us to delete or until we decide to discontinue the collection.
  • Server technical logs: up to 6 months, unless a longer period is needed for security or legal reasons.
  • Google Analytics data: as set in the GA4 account settings (14 months by default).

Your rights

Under the General Data Protection Regulation (GDPR), you have the right to:

  • Access the personal data we hold about you;
  • Rectify incorrect or outdated data;
  • Erase the data ("right to be forgotten"), where applicable;
  • Restrict or object to processing, in certain circumstances;
  • Portability of the data you've given us, in a structured format;
  • Withdraw consent at any time, without affecting the lawfulness of earlier processing;
  • File a complaint with the supervisory authority: in Portugal, the Comissão Nacional de Protecção de Dados (CNPD).

To exercise these rights, just email privacy@flagra.pt. We'll reply within one month at the latest.

Minors

Flagra isn't specifically aimed at minors and doesn't knowingly collect data from people under 16. If you're under 16, ask a responsible adult to fill in the form on your behalf or to check this policy with you. If we find out we've collected data from someone under 16 without their legal representatives' consent, we'll delete it as quickly as possible.

Changes to this policy

This policy may be updated to reflect changes to the site, new services, or legal changes. When there are material changes, we'll flag them visibly on the site. The version in force is always the one published on this page, with the last-updated date shown in the footer.

Contact

For any question about this policy or about how your personal data is handled, get in touch.