Legal
Privacy policy
We keep very little: just enough for you to have an account. No passwords, no email, no ads and no trackers.
The basics
- Controller
- Ismael Arenzana. Contact: [email protected].
- What we keep
- If you have an account: the name you choose, your province if you give it, your alerts, your passkeys and what you follow. If you do not: nothing in your browser; only technical logs with your IP address and a fingerprint that changes every day to count visitors.
- What for
- To give you your account and Tu Pleno, and to keep the site secure.
- Legal basis
- Contract (the account you ask for), your explicit permission (what you follow, which may reveal political opinions) and legitimate interest (security).
- Who else
- Nobody buys or receives your data. Cloudflare, Oracle and Backblaze (United States, under the EU-U.S. Data Privacy Framework) and Hetzner (Germany) store it on our behalf.
- Your rights
- See, download, correct and delete your data from Account, withdraw your permission at any time, and complain to the Spanish Data Protection Agency (AEPD).
1. Who the controller is
- Controller
- Ismael Arenzana, who runs El Pleno as a personal, nonprofit project
- Privacy contact
- [email protected]
There is no data protection officer because one is not required for a project of this size. Write to the address above about anything related to your data.
2. What data we process
| Data | Where it comes from | What for |
|---|---|---|
| Name you choose | You give it when you create the account | To greet you and help you recognize your account |
| Province (optional) | You give it in Account | To show you your deputies and senators |
| Alert preference | You choose it in Account | To know whether you want alerts and how often |
| Passkey: public key, the name you give it, dates, whether it syncs and the authenticator model | Your device, when you create the passkey | To check that it is you when you sign in |
| Sessions: start and expiry dates, and a fingerprint of your cookie code | Created when you sign in | To keep you signed in |
| What you follow: bills, people and topics | You, when you press Follow | Tu Pleno and your alerts |
| Permission history: which text you accepted, in which language and when | Created when you sign up and when you give or withdraw permissions | To prove you gave us permission |
| IP address, page requested, browser and time | Your browser, on every visit | Security and technical operation |
| Daily fingerprint of IP address and browser, referring domain, country, autonomous community and device type | Computed on each visit | Audience statistics, as daily totals only |
| Whatever you write to us by email | You, if you write | To answer you |
We do not ask for your email, phone number, password, date of birth, ID number or location. We do not store what you search for either.
3. Your account and Tu Pleno
To give you an account we use your name, your province if you give it, your alert preference, your passkeys and your sessions.
- Legal basis
- Performance of the contract you accept when you create the account (Article 6(1)(b) of the General Data Protection Regulation, GDPR).
- How long
- As long as you have the account. Sessions last 30 days and their record is deleted 30 days after they expire. If you delete your account, we delete everything right away.
4. What you follow
What you follow (bills, deputies, senators, topics) may reveal your political opinions, which Article 9 of the GDPR specially protects. That is why we only store it with your explicit permission, given separately and with no pre-checked boxes, the first time you press Follow. We record which version of the text you accepted and when.
We use it only for Tu Pleno and your alerts. We do not use it for statistics, profiling or ads. We do not share it with anyone and we never send it to artificial intelligence services.
You can withdraw your permission at any time in Account: we immediately delete everything you follow. Withdrawing does not affect what was done before.
- Legal basis
- Your explicit consent (Articles 6(1)(a) and 9(2)(a) of the GDPR).
- How long
- Until you stop following something, withdraw your permission or delete your account.
5. Your age and terms statement
When you create an account you state that you are 14 or older and that you have read the terms and this policy. We record which version you accepted, in which language and when.
- Legal basis
- Complying with the law and being able to prove it (Article 7 of Spanish Organic Law 3/2018, LOPDGDD, and Article 6(1)(c) of the GDPR).
- How long
- As long as you have the account. It is deleted with it.
6. Site security
To protect El Pleno from abuse and attacks, our providers and servers log the IP address, the page requested, the browser and the time of each visit. We also limit sign-in attempts per IP address, in server memory and without storing them.
Cloudflare may set a security cookie to tell people from bots (see the cookie policy).
- Legal basis
- Our legitimate interest in keeping the site secure and working (Article 6(1)(f) of the GDPR). You can object by writing to us.
- How long
- 30 days.
7. If you write to us
If you write to [email protected], we use your address and your message only to answer you.
- Legal basis
- Your consent when you write to us and our legitimate interest in answering you (Article 6(1)(a) and (f) of the GDPR).
- How long
- As long as needed to answer you, and one year at most. If your message is a request to use your rights, we keep it for three years to be able to prove we handled it.
8. Question search
When available, question search (account holders only) will use artificial intelligence to understand your question. The text of the question will be sent to the provider of that service without your name or your identifier, and we will not store the text: only how many questions you ask, to apply usage limits. Before turning it on, we will add the provider’s name and where it processes data here.
Do not include personal data about yourself or anyone else in a question.
- Legal basis
- Performance of the contract (the search you ask for, Article 6(1)(b) of the GDPR).
- How long
- The text, not at all. The number of questions, one day.
9. Audience statistics
We count visits, page views and loading speed in aggregate, with no cookies and nothing stored in your browser.
To know how many different people visit each day, on each visit the server computes a fingerprint (a hash) of your IP address and your browser, mixed with a secret key that changes every day and is destroyed at the end of the day. This lets us count visitors within the same day without storing your IP address and without being able to recognize you on another day. From the page you came from, we keep only the domain (for example, “google.com”). Country and autonomous community come from what Cloudflare reports based on the IP address, and the device type (phone, tablet or computer) from the browser.
We only keep daily totals (for example, “1,200 visitors from Andalusia on phones”). Fingerprints are deleted at the end of the day, along with the key that made them possible.
- Legal basis
- Our legitimate interest in knowing how many people use El Pleno and how they arrive, in the least invasive way possible (Article 6(1)(f) of the GDPR). You can object by writing to us.
- How long
- Fingerprints and the key, one day at most. Daily totals, no limit, because they do not identify anyone.
10. Data about deputies and senators
We show the name, photo, position, group, constituency and votes of deputies and senators, current and since 1977, as published by the Congress and the Senate. We do not infer personal traits or publish anything that is not official.
If you are or were a representative and something is wrong, or you want to object, write to us at [email protected] and we will review it.
- Legal basis
- Our legitimate interest and the right to information about public activity (Articles 6(1)(f) and 85 of the GDPR).
- How long
- As long as it is part of the public record of the Cortes.
11. Who we share data with
Nobody buys or receives your data for their own purposes. These providers process it only on our behalf, under a data processing agreement:
| Provider | What it does | What data | Where |
|---|---|---|---|
| Cloudflare, Inc. | Network that delivers and protects the site, DNS and forwarding of email sent to [email protected] | IP address, page requested, browser; messages you send us | Worldwide network; company in the U.S. |
| Hetzner Online GmbH | Servers that receive visits behind Cloudflare | IP address, page requested, browser | Germany (EU) |
| Oracle America, Inc. | Server and database | All account data | Ashburn (Virginia, U.S.) |
| Backblaze, Inc. | Backups, encrypted before they leave our server | Encrypted copies of the database | U.S. |
Technical logs and metrics are also kept on a server owned by the controller, not by a third party.
Automatic summaries and translations are made with artificial intelligence services from public official texts. We never send user data to those services.
We would only give data to an authority if a law requires it.
12. Data outside the European Union
Cloudflare, Oracle and Backblaze are U.S. companies and process data there. All three participate in the EU-U.S. Data Privacy Framework, which the European Commission recognizes as providing an adequate level of protection (Implementing Decision of July 10, 2023). We checked this on the official list, dataprivacyframework.gov, on November 11, 2026.
If any of them left the Framework, the European Commission’s standard contractual clauses included in their data processing agreements would apply. You can ask us for a copy of these safeguards.
13. How long we keep each thing
| Data | Period |
|---|---|
| Account, province, alerts and passkeys | Until you delete the account or the passkey |
| Sessions | Valid for 30 days; the record is deleted 30 days after expiry |
| What you follow | Until you stop following, withdraw your permission or delete the account |
| Permission history | As long as you have the account |
| Technical logs with IP addresses | 30 days |
| Fingerprints for counting visitors, and their key | One day at most; only daily totals remain |
| Emails you send us | As long as needed to answer, one year at most; requests to use your rights, three years |
| Encrypted backups | Daily for 14 days, weekly for 8 weeks and monthly for 12 months. A deleted account disappears from all of them within 12 months at most. Backups are only used to restore the service after a failure; if we ever restore one, we delete the deleted accounts again before putting it back online. |
14. Your rights
At any time you can ask for:
- Access: to know what data of yours we have. In Account you can download all of it.
- Rectification: to correct it. Your name and province can be changed in Account.
- Erasure: to delete it. In Account you can delete your account right away.
- Portability: to receive it in an open format (JSON), with the same download button.
- Objection and restriction: for us to stop processing it, or to keep it without using it, in the cases the law provides.
- Withdrawal of your permission for what you follow, in Account, without affecting what was done before.
For anything you cannot do from Account, ask at [email protected]. We answer within one month at most. We may ask you to sign in with your passkey to check that the account is yours.
If you think we have not handled your data properly, you can file a complaint with the Spanish Data Protection Agency (aepd.es, calle Jorge Juan 6, 28001 Madrid, Spain). It would help if you wrote to us first.
15. Minors
Accounts are for people aged 14 or older (Article 7 of the LOPDGDD). We do not check this with documents. If we learn that an account belongs to someone under 14, we delete it. You do not need an account to read El Pleno.
16. How we protect your data
- You sign in with passkeys: there are no passwords to steal.
- The whole connection is encrypted (HTTPS).
- We keep only a fingerprint of your session code, not the code itself.
- Backups are encrypted before they leave our server.
- The database cannot be reached from the internet, and only the controller can administer it.
If a security breach put your data at risk, we would notify the AEPD within 72 hours and, if the risk were high, you as well.
17. Automated decisions
We do not make automated decisions about you with legal effects, and we do not profile you.
18. Changes to this policy
If we change something important, we will say so on the site before it applies and, if it affects a permission you gave us, we will ask you again. Current version: 2026-11-11. Sign-up text: version 2026-11-11. Follow permission text: version 2026-11-11.