Privacy policy

1. Controller

Affinisy (https://affinisy.com) is a service of BlancPac Technologies, S.L., tax ID B93857100, registered in 41001 Sevilla (Spain), entered in the Registro Mercantil de Sevilla. Contact: affinisy@affinisy.com.

We have no data protection officer; for any privacy matter, write to that address.

2. What data we process

What you write to search: what you are looking for or the options you compare, your answers to the questionnaire, the instructions you add, and the result. Without an account, we do not keep it linked to you.

If you create an account: your email address and, if you have one, your password (encrypted; we never see it), and the history of your decisions (searches, answers and results).

If you pay: your plan, the queries you have used and your Stripe customer ID. Card details are handled by Stripe; we never see them.

If you write to us (contact form, deal alert or where-to-buy request): name, email, phone and message, whatever you give us.

If you share a result: the result is published at its own address, visible to anyone who has it.

If you invite friends or sign up through an invitation: your invitation code and which account invited which, to give you the searches you earn.

Products you propose: if you type the name of a product you found on your own, we keep the name the system recognises (brand and model) with a pseudonymous code derived from your account, which only we can relate to you, to count how many different people proposed it. It is shown to others, as a suggestion to check, only once at least three accounts proposed it or we reviewed it; that code is deleted with your account and, in any case, after 180 days.

Usage data: which steps you take in the app (for example, what kind of search you run, which result you pick or whether you press Buy), with a random identifier not linked to your account, the country you visit from, and the text of your search, shortened and without emails, phone numbers or links. We do not keep your IP address in analytics.

To count free searches: without an account, a random identifier kept in your browser and an encrypted digest of your IP address (a hash that changes every day, from which the IP cannot be recovered); with an account, how many you have used.

Technical data: like any web server, our hosting provider logs the IP address and request details for a limited time, for security.

3. Why, and on what legal basis

Providing the service (generating questions and results, keeping your history, charging for plans): performance of the contract you accept by using it.

Answering your messages and requests: your request and our legitimate interest in handling it.

Measuring and improving the product with the analytics described: legitimate interest, with minimised data and no cookies.

Market studies: we use aggregated, anonymous statistics for market studies, fully anonymised. They cover which products appear, win or are chosen in each category and on which criteria, never account data or text people wrote: only brands and models the system recognises, categories and criteria from a fixed list; and no figure is published for a group so small that anyone could be identified. Being anonymous, they are no longer personal data. Legal basis for producing them: legitimate interest.

Reusing results: when someone gives exactly the same answers to the same questions as another person, with no free text and on a non-sensitive topic, we show them the result already calculated; it holds no account data and no text written by anyone. Legal basis: legitimate interest.

Security, abuse prevention and the free-search limit: legitimate interest.

Keeping invoices and payment records: legal obligation (tax and commercial law).

We make no automated decisions with legal effects on you: results are an informational recommendation that you decide whether to follow.

4. Who we share it with

Only with the providers we need to run the service, who process the data on our behalf and under contract:

Anthropic (USA): the artificial intelligence model that writes the questions and the result; it receives what you write to search.

Vercel (USA): web hosting.

Supabase (servers in Frankfurt, Germany): database for accounts, history and shared results.

PostHog (servers in the EU): usage analytics, without cookies.

Stripe (Ireland and USA): payments.

Resend (USA): delivering the messages you send us to our inbox.

Google (USA): product image search, with the product name only; and, if you choose ‘Continue with Google’, signing in (the sign-in page loads its button).

When you follow a link to Amazon or another shop, you leave Affinisy: that shop processes your data under its own policy, and Amazon may use cookies to credit the purchase to us as an affiliate.

Where a provider is outside the European Economic Area, the transfer relies on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses.

We do not sell your data to anyone.

5. How long we keep it

Account and history: while you have the account; deleting it removes them.

Searches in progress (to recover a result if the tab closes): 7 days.

Product and category catalogue: rows without identifiers (pseudonymised) for 24 months; the aggregated statistics we produce are anonymous and kept without time limit.

Reusable results: 7 days.

Log of administration actions: 2 years.

Free-search counters: the IP one, one day; the browser one, until you clear your browser's data.

Shared results: until you ask us to take them down.

Messages and requests: as long as needed to handle them and, after that, one year at most.

Deal alerts: up to 6 months, or until you unsubscribe with the link in each email. Where-to-buy requests: up to one year after we handle them. We keep them to manage them and, if you have an account with the same email, they are exported and deleted with it.

Billing data: for the periods the law requires (up to six years).

Analytics: usage data is kept in aggregate to follow how the product evolves.

6. Cookies and storage in your browser

We use no advertising or analytics cookies. We only use those needed for the site to work: the language one (remembers your choice, one year) and, if you sign in, your session ones. In your browser's local storage we briefly keep the search in progress, so it is not lost if the page reloads; a random identifier for the free-search limit; and, if you press ‘Save to my history’ without an account, that decision until you sign up (one day at most); and, if you arrive through a friend's link, their invitation code until you sign up (one week at most). As they are strictly necessary, they do not require your consent.

7. Your rights

You can ask for access to your data, its rectification or erasure, restriction of or objection to its processing, and its portability, by writing to the contact address. We will answer within one month.

From “Your account” you can download your data and delete your account yourself, at any time.

If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es).

8. Children

Affinisy is not aimed at children under 14, and we do not knowingly process their data.

9. Changes

If we change this policy significantly, we will say so on this page and, if you have an account, let you know.