Privacy policy

Last updated: 1 June 2026

Data controller

The Data Controller for personal data collected through findalo.io is Ray José Rodríguez Gil, sole trader, Spanish tax ID 14053624A, with a registered professional address in Puçol (Valencia, Spain), provider of the service "Findalo" (hereinafter, "Findalo").

For any question related to your personal data, write to privacy@findalo.io. For legal or GDPR enquiries: legal@findalo.io.

Data we collect

• Email, phone, name and store URL when you fill in the registration form.
• Registration source (which CTA you clicked, e.g. "Pro Plan" or "Download PrestaShop plugin") and your browser's referrer.
• IP address received in the request, for abuse prevention.
• If you upload a demo CSV: the CSV content is stored temporarily for 24 hours and deleted automatically.

Purposes and legal basis

• Processing your request and creating a trial account (performance of a pre-contractual relationship).
• Sending you product information you requested (explicit consent via the form checkbox).
• Preventing fraud and service abuse (legitimate interest).

Retention period

Form data is retained for the duration of the commercial relationship or, failing that, for up to 24 months from the last contact. You may request erasure at any time.

Recipients

We do not share your data with third parties except sub-processors strictly necessary to deliver the service (ISO 27001 / SOC 2 certified cloud infrastructure, PCI-DSS Level 1 payment processor and transactional email provider, all with a presence in the EEA). Full list of named sub-processors available on request at hola@findalo.io. We do not make international transfers outside the EEA beyond those covered by EU Standard Contractual Clauses.

Your rights

You may exercise your rights of access, rectification, erasure, objection, portability and restriction by writing to privacy@findalo.io. You have the right to lodge a complaint with the Agencia Española de Protección de Datos.

Cookies and analytics

Findalo's public website uses visitor analytics tools to understand how the site is navigated and to improve the experience. By default consent is denied (Google Consent Mode v2 default denied) until you explicitly accept via the cookie banner that appears on first visit.

If you accept, we load:

• Google Analytics 4 (Google LLC) — aggregated metrics for page views, traffic source and events. Identifier: G-L7MGQ8F66Q. No advertising tracking or remarketing audiences. International transfer covered by EU Standard Contractual Clauses and the EU-US Data Privacy Framework.
• Mouseflow (Mouseflow ApS, Denmark) — heatmaps and session-replay to understand UX behaviour. Sensitive inputs (passwords, emails, payment forms) are masked automatically. Data processed within the EEA.

If you decline, neither service is loaded. Your choice is saved in your browser's localStorage under the key findalo_consent and expires after 24 months — once that period has passed we will ask you again. You can revoke it at any time by clicking "Manage cookies" in the page footer.

On the sign-up and contact forms we also use Cloudflare Turnstile (Cloudflare, Inc.) as anti-bot protection. It is a technical mechanism necessary for the security of the service (exempt from consent under art. 22.2 LSSI), and the international transfer is covered by the EU-US Data Privacy Framework.

Cookie and storage table

The search widget embedded in customer stores is independent of this public website. It records on our own infrastructure the events needed to provide the service and its analytics to the merchant: search terms, clicks, add-to-carts and purchases (with order reference and amount), associated with a random session identifier stored in the browser's sessionStorage, which disappears when the tab is closed. It does not use its own cookies or advertising tracking, does not allow Findalo to identify the buyer, and these events are kept for a maximum of 24 months. The controller of that processing is the store where you shop; Findalo acts as data processor (Annex I of the Service Agreement).

Full list of sub-processors at /en/privacidad/subencargados.