Privacy Policy

1. Data controller

The data controller responsible for your personal data is Caliu. You can contact us at hola@joincaliu.com.

2. Data we collect

• Registration data: name, email, and hashed password when you create an account.
• Profile data: display name, profile photo, city, and interests you choose to provide.
• Booking data: booked events, amounts paid, and booking status.
• Payment data: processed entirely by Stripe. Caliu does not store full payment card numbers.
• Usage data: events viewed, searches, and other product interactions to improve the service (PostHog), subject to applicable settings.
• Technical data: IP address, device type, and OS information needed for security and service reliability.

3. Purposes and lawful bases

4. Recipients and processors

Your data may be shared with the following categories of recipients:

We do not sell your personal data to third parties for advertising purposes.

• Stripe Inc. — payment processing (see Stripe's privacy policy at stripe.com/privacy).
• Supabase Inc. — authentication and database infrastructure.
• PostHog Inc. — product analytics (typically aggregated or minimized where possible).
• Resend Inc. — sending transactional emails.
• Event organizers — the name and contact details needed to manage your booking.

5. Retention

We keep your personal data while your account remains active or as long as needed to provide the service. After account deletion, we aim to erase personal data within 90 days, except where retention is legally required (for example accounting records for up to 5 years).

6. Your rights

Under the GDPR, you may have the right to:

To exercise your rights, contact hola@joincaliu.com. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD).

• Access your personal data and receive certain information about processing.
• Rectification of inaccurate personal data.
• Erasure ('right to be forgotten') where applicable.
• Data portability for data you provided, where technically feasible.
• Object to processing based on legitimate interests, where permitted.
• Restriction of processing in certain circumstances.

7. Cookies and similar technologies

This portal uses strictly necessary cookies for authentication and core functionality. We also use analytics cookies (PostHog) where enabled. You can manage preferences through our cookie banner.

8. Security

We implement appropriate technical and organizational measures to protect personal data (including encryption in transit with TLS). No system is perfectly secure; if we identify a breach likely to affect your rights and freedoms, we will notify you in line with applicable law.

9. Changes to this policy

We may update this Privacy Policy periodically. Material changes will be communicated by email or a prominent notice in the portal. Continuing to use the service after changes take effect constitutes acceptance of the updated policy.