Privacy policy

Last updated: 27 September 2026

Data controller

The Data Controller for personal data collected through findalo.io is Ray José Rodríguez Gil, sole trader, Spanish tax ID 14053624A, with a registered professional address in Puçol (Valencia, Spain), provider of the service "Findalo" (hereinafter, "Findalo").

For any question related to your personal data, write to privacy@findalo.io. For legal or GDPR enquiries: legal@findalo.io.

Data we collect

• Email, phone, name and store URL when you fill in the registration form.
• Registration source (which CTA you clicked, e.g. "Pro Plan" or "Download PrestaShop plugin") and your browser's referrer.
• IP address received in the request, for abuse prevention.
• Email address, language, the consent wording you accepted, the date and the page you subscribed from, if you sign up for the blog newsletter. Of the IP address we keep only a fingerprint, not the address.

Purposes and legal basis

• Processing your request and creating a trial account (performance of a pre-contractual relationship).
• Sending you product information you requested (explicit consent via the form checkbox).
• Preventing fraud and service abuse (legitimate interest).
• Sending you blog posts if you subscribe to the newsletter (explicit consent, confirmed by email, which you can withdraw from the unsubscribe link in any send).

Retention period

Form data is retained for the duration of the commercial relationship or, failing that, for up to 18 months from the last contact; after that it is deleted automatically. You may request erasure at any time.

If you are a customer, your account data (indexed catalogue, configuration, statistics, profile and logins) is kept while the account exists and for 30 days after you cancel it, during which you can export it. You can cancel the account, export your data and manage your communication consents from your panel (Settings → Profile) or by writing to legal@findalo.io. If your account is on the free trial (Free plan) and you do not move to a paid plan, the account and its data are deleted 30 days after the end of the trial, and we notify you by email beforehand. So that the free trial is one per store, we keep, including after deletion, the domain of the store that used it and the date, with no other data (legitimate interest in preventing abuse of the trial). Apart from this, after deletion we only keep the billing details of issued invoices (6 years, Spanish Commercial Code and General Tax Law) and the record of contract acceptance (5 years, limitation period), as detailed in clause 6.4 of the Service Contract.

Newsletter data is kept for as long as you stay subscribed. A sign-up that is not confirmed within 14 days is deleted. If you unsubscribe we keep only the record of that unsubscribe, so that we do not write to you again.

Recipients

We do not share your data with third parties except sub-processors strictly necessary to deliver the service (ISO 27001 / SOC 2 certified cloud infrastructure, PCI-DSS Level 1 payment processor and transactional email provider, all with a presence in the EEA). Full list of named sub-processors available on request at hola@findalo.io. We do not make international transfers outside the EEA beyond those covered by EU Standard Contractual Clauses.

Your rights

You may exercise your rights of access, rectification, erasure, objection, portability and restriction by writing to privacy@findalo.io. You have the right to lodge a complaint with the Agencia Española de Protección de Datos.

Cookies and analytics

Findalo's public website uses visitor analytics tools to understand how the site is navigated and to improve the experience. By default consent is denied (Google Consent Mode v2 default denied) until you explicitly accept via the cookie banner that appears on first visit.

If you accept, we load:

• Google Analytics 4 (Google LLC) — aggregated metrics for page views, traffic source and events. Identifier: G-L7MGQ8F66Q. No advertising tracking or remarketing audiences. International transfer covered by EU Standard Contractual Clauses and the EU-US Data Privacy Framework.
• Mouseflow (Mouseflow ApS, Denmark) — heatmaps and session-replay to understand UX behaviour. Sensitive inputs (passwords, emails, payment forms) are masked automatically. Data processed within the EEA.
• OpenAI conversion pixel (OpenAI, USA) — measures whether a visit coming from one of our ads in ChatGPT ends up creating an account. It stores the ad click identifier and, when the signup completes, sends the conversion event with the signup reference; it does not receive your email, your name or your store's data. We do not use it for remarketing or to build audiences.

If you decline, none of them is loaded. Your choice is saved in your browser's localStorage under the key findalo_consent and expires after 24 months — once that period has passed we will ask you again. You can revoke it at any time by clicking "Manage cookies" in the page footer.

On the sign-up and contact forms we also use Cloudflare Turnstile (Cloudflare, Inc.) as anti-bot protection. It is a technical mechanism necessary for the security of the service (exempt from consent under art. 22.2 LSSI), and the international transfer is covered by the EU-US Data Privacy Framework.

Cookie and storage table

The search widget embedded in customer stores is independent of this public website. It records on our own infrastructure the events needed to provide the service and its analytics to the merchant: search terms, clicks, add-to-carts and purchases (with order reference and amount), associated with a random session identifier stored in the browser's sessionStorage, which disappears when the tab is closed. It does not use its own cookies or advertising tracking, does not allow Findalo to identify the buyer, and these events are kept for a maximum of 24 months. The controller of that processing is the store where you shop; Findalo acts as data processor (Annex I of the Service Agreement).

Full list of sub-processors at /en/privacy/subprocessors.