Privacy policy
2026-07-27
This policy describes what personal data Placa processes, why, and what rights you have under the GDPR. The short version: we run the service on as little data as it needs, and visitors of publisher sites are never tracked.
Controller
Controller: [[Titular pendiente: nombre o razón social]], [[Domicilio pendiente]]. Contact: hello@placa.dev.
Visitors of sites that use Placa
The Placa snippet sets no cookies, stores no identifiers and builds no profiles. To count an impression once, an ephemeral hash of connection data is kept in volatile memory for less than 24 hours and is never written to any database. What is stored are hourly aggregates (a number of impressions and clicks per slot), which contain nothing that can identify a person.
Because of this, sites using Placa do not need a consent banner on our account.
Publisher accounts
When you create an account we process your email address and the data you add (site domains, slots, prices, sponsor contact emails). Legal basis: performance of the contract (art. 6.1.b GDPR). Kept while the account exists; on deletion, accounting records are retained for the legally required period.
Sponsors
Publishers register the contact email of their sponsors to manage sponsorships. Placa processes this data as part of the service provided to the publisher. Payment data is processed by Stripe on the publisher’s own account; it never reaches Placa.
Processors and hosting
Data is hosted in the European Union: Supabase (database, Frankfurt), Cloudflare (serving and storage, EU jurisdiction), Resend (email). Stripe processes payments. Each provider acts under its own data processing agreement.
Your rights
You can request access, rectification, erasure, portability and restriction at hello@placa.dev. You can also complain to the Spanish supervisory authority (AEPD). Full data export is available from the panel at any time — portability is a product commitment, not just a right.
Draft pending legal review.