Privacy

Mejor Caña sets no cookies for visitors and uses no analytics, no advertising and no trackers. This page says which data we process, what for, on which legal basis, for how long and with whom.

Controller

Visiting the website

The website is hosted by Cloudflare. Like any server, it receives your browser's IP address in order to serve the pages and protect them from attacks; its technical logs last a few days (up to 7) and we do not use them to find out who you are. Fonts are served from our own domain. Legal basis: legitimate interest in a website that works and is secure (art. 6.1.f GDPR).

The map (/mapa)

When you open the map, your browser downloads the base map style and tiles directly from CARTO (basemaps.cartocdn.com). CARTO therefore receives your IP address and the area of the map you look at, as with any map service. No other page loads anything from CARTO: the small maps are our own images.

Your diary

Your beer diary is stored only in this browser (localStorage) and is never sent to us, unless you tick «Share the price»: then the venue, size, brand, price and date of that beer travel, as in the next section. You can export it, import it or delete it at any time; clearing the browser data erases it.

When you send a price, a confirmation or a report

• What you write: venue, size, brand, price, date, millilitres, tapa and the optional note; in a report, the kind of report and, if you add a missing venue, its name and address.
• A pseudonymous code of your connection: the hash (SHA-256) of your IP address with a random salt that changes every day. The IP itself is never stored. The salt is deleted after 2 or 3 days; from then on the code kept next to the price can no longer be linked to any IP, and two different days cannot be linked to each other. The frequency counters that use this code are deleted when their window expires (10 minutes or 1 day).
• The optional photo of the menu: we remove location, date and phone data before storing it. It is never published: only the person reviewing the price sees it. It is stored only if the submission is valid; if we discard the price we delete it straight away, and if we approve it, 30 days after the review. Please, no people in the photo.

What for, and on which basis: publishing checked beer prices in València, reviewing them and stopping abuse (spam, mass submissions). Legal basis: legitimate interest (art. 6.1.f GDPR); we never ask for your name or email. Prices and reports are kept for as long as the service exists, because they are the price history.

Anti-abuse: Cloudflare Turnstile

On each venue page and in the diary, Turnstile is not loaded when the page opens. It loads only when you press «Send price», «Still costs this», «Wrong price?», one of the reports, or «Log it» with «Share the price» ticked: then your browser downloads the script from challenges.cloudflare.com, which looks at browser signals to tell people from bots and, if needed, asks you for a click. We only receive a yes or no answer, which our server checks with Cloudflare without sending it your IP address. Legal basis: legitimate interest in protecting the website from abuse.

Invitations to venues

• Where the address comes from: it is the venue's own public contact (its website or its public profile). We do not buy lists and we do not take them from Google Maps, TripAdvisor, TheFork or delivery apps.
• What we store: on the website, only a salted hash of the address, the venue it belongs to, the date and status of each email, and a hash of the personal link. The address itself is not in the website's database: the mailing list is prepared outside it.
• Who sends it: the email goes out through Resend (Resend, Inc., USA), which processes the address only to deliver the message, with the safeguards the GDPR requires for transfers outside the EU.
• What for, and on which basis: inviting the venue to publish and correct its own prices, for free. Legal basis: legitimate interest (art. 6.1.f GDPR). We write once per venue.
• How to object, in one click: every email carries an unsubscribe link (also in the email header, for your mail app's «unsubscribe» button), and the personal-link page has «This is not my venue / I don't want to take part». Writing to christian@mejorvalencia.com works too. After that we keep only the address hash and the venue in an exclusion list, so we never write again.
• The personal link does not expire and can be revoked at any time (we revoke it when you unsubscribe or ask us to). Prices the venue publishes with it are shown as «Declared by the venue», with the date.

Email

If you write to christian@mejorvalencia.com, the message goes through Cloudflare Email Routing and reaches the controller's mailbox at Gmail (Google). We use it only to answer you and keep it as long as needed to deal with your request.

Providers

• Cloudflare, Inc.: hosting, database (D1), photos (R2), cache (KV), Turnstile and Email Routing.
• Resend, Inc.: sending the invitations to venues.
• CARTO: base map of /mapa, downloaded directly by your browser.
• Google (Gmail): the mailbox where the emails you send us arrive.

We do not sell or hand over data to anyone.

How long

• IP address: never stored by us.
• Daily salt: deleted after 2 or 3 days. Frequency counters: 10 minutes or 1 day.
• Menu photos: deleted straight away if the price is discarded; 30 days after the review if it is approved.
• Prices and reports: as long as the service exists, with nothing that identifies you once the salt is gone.
• Invitations: hash and email status while the venue is in the service; the exclusion list as long as the service exists, to respect the objection.
• Cloudflare technical logs: up to 7 days. Your diary: only in your browser, until you delete it.

Your rights

You can ask for access, correction, deletion, restriction, objection (in particular to processing based on legitimate interest) and portability, for free, at christian@mejorvalencia.com. As we store neither names nor IP addresses, to find your submission we may need the venue, the price and the date.

If you think we have not handled your request properly, you can complain to a supervisory authority. The controller is established in Malta, so the competent authority is the Information and Data Protection Commissioner (IDPC, idpc.org.mt). If you live in Spain or another member state, art. 77 GDPR also lets you complain to the authority of your country; for Spain, the Agencia Española de Protección de Datos (aepd.es).