Privacy policy

Status: draft, written 2026-09-23 (Stage 16). DO NOT PUBLISH. The processor inventory in §6 has cells that are not filled (study S-31), and the lawful basis in §5 for Telegram identifiers is S-31's too. `legal:seed` loads this text as a draft; `--publish` must not be run until no "S-31" cell is left.

The Spanish text (`privacy.es.md`) is the binding one; this is a translation for information.

1. Who the controller is

The controller is Yatoday, the operator of the Notimia service (`app.notimia.es`). Its full identification details are in Yatoday's legal notice: https://yatoday.es/en/legal/notice/. The contact address for exercising rights is dev@yatoday.es. — S-31 must settle whether a data protection officer is required.

2. What is stored about an account

A name, an email address where one was given, the chosen interface language, and the sign-in identities connected (`user_identities`). A Telegram sign-in gives a Telegram user id and no email address. Passwords are stored hashed; passkeys are stored as public key material.

Configuration activity on a project is recorded in `audit_log` with the request's IP address and user agent.

3. What is stored about a project

The topics followed, the sources added, the items generated and their versions, approvals, publications and their outcome, service usage and balance. Articles and stories are shared between projects and belong to none of them.

4. For how long

The windows live in `config/retention.php` and are measured in study S-05:

| Data | Window | | :-- | :-- | | article body (`article_bodies`) | 30 days | | compressed source-body copy beside an item | 90 days | | articles | 18 months (30 days for sources with a shorter contractual limit) | | API request log (with IP and user agent) | 30 days | | webhook deliveries | 90 days | | model usage log | 12 months, then aggregated without identifiers | | engagement metrics | 180 days | | data export archives | 7 days | | audio episodes | 90 days | | `audit_log` | never purged |

5. Subscribers without an account

The events agenda and the own channels can reach people who never created an account. What is held about them is a Telegram identity without an account (an agenda subscription, D-86) or an HMAC of the Telegram user id (a channel join, which does not allow the id to be recovered but does allow the same person to be distinguished).

The lawful basis for that processing is settled by study S-31 — legitimate interest for join counting, consent for the subscription — and this page will name it once S-31 has established it. Until then this page is not published.

Both can ask for access and erasure from the chat itself (`/privacy` in the bot) or by mail with proof of control of the chat. Erasure deletes the subscription and the Telegram identity it was held under, and replaces the join identifier with a marker that corresponds to nobody, so the person is no longer identifiable and that day's join count does not change: a count is not personal data, and rewriting an already-reported historical figure is not what the right to erasure asks for.

5a. Measurement of our own channels and pages

On our own Telegram channels we record that somebody joined or left, so that a departure can be matched to the join it cancels and a figure is not counted twice. We do not store a Telegram user id, username or name: what is kept is an irreversible keyed hash of the user id and nothing else, for 180 days, after which the individual records are deleted and only anonymous daily counts remain. On our public pages we set one first-party cookie holding a random identifier, and record the page you arrived on, the marketing parameters in the link and the site that referred you — no IP address, no device fingerprint, no third-party script and no identifier shared with anyone else, also for 180 days. The lawful basis for the channel identifier and the assessment behind it are still being completed; this page will state them before it is in force, and until then you may ask us to delete your records at any time.

6. Processors

Vendors that process personal data or article text on the controller's behalf. "S-31" in a cell is a hole, not an entry: a vendor appears on the published page only with its three cells filled.

| Processor | What it receives | DPA held | Processing location | Retention at the vendor | | :-- | :-- | :-- | :-- | :-- | | Anthropic | prompts with article text, story facts, customer instructions | S-31 | S-31 | S-31 | | Voyage AI (D-46) | `embed_input`: titles and leads | S-31 — before any article text is sent | S-31 | S-31 | | OpenAI | TTS scripts and transcription audio (Stage 12); embeddings only if the D-46 fallback is used | S-31 | S-31 | S-31 | | TypeSafe AI (D-41, only while a decision driver is `typesafe`) | decision states: titles, leads, facts, never a body | not published; a mail to `privacy@typesafe.ai` (`docs/access.md`), which also offers zero data retention on request | same mail | same mail | | Stripe | customer identity, invoices, payment | S-31 | S-31 | S-31 | | Postmark | outbound mail and inbound newsletter forwarding (S-18) | S-31 | S-31 | S-31 | | ScrapeCreators (D-59) | article URLs for metered collectors, never catalogue-wide | S-31 | S-31 | S-31 | | Telegram | channel posts, member events, the Telegram identities of subscribers without an account | platform, not a processor in the usual sense — S-31 says how to describe it | — | — | | Cloudflare | DNS and the short-link domain's traffic | S-31 | S-31 | S-31 | | The captcha vendor on the takedown form | the requester's IP | not chosen: no vendor is contracted and the form runs today on a rate limit alone | — | — | | The cluster host | everything at rest | S-31 | the cluster's region | — | | Only when opened: Azure (Valencian TTS, D-54), ElevenLabs (premium voice), AssemblyAI (EU-resident transcription, D-55) | audio and scripts | on opening | on opening | on opening |

7. Rights

Access, rectification, erasure, restriction, objection and portability. From `/settings/privacy` a person with an account can download everything the service holds about them, and delete their account or a project they own. Every request is answered within 30 days (GDPR art. 12(3)); in practice the archive is produced in minutes and the download link expires after 7 days together with the archive itself.

Erasing an account is anonymisation where a row is evidence: the rows that say who approved a published item are kept without personal fields, because they are the record of who held editorial responsibility under article 50(4) of Regulation (EU) 2024/1689.

A complaint may also be made to the Spanish data protection authority (AEPD).

8. International transfers

No data-residency commitment is made. Article text, prompts and audio may be processed by vendors outside the European Union; vendors are chosen on cost and quality, and the processing location of each one is the one stated in §6 (D-82). Where a vendor processes outside the EU, the transfer mechanism it relies on (standard contractual clauses, an adequacy decision or the EU–US Data Privacy Framework) is named beside it — S-31: those cells, and the mechanism per vendor, are not filled yet.