Last updated: October 29, 2026
This policy explains how Agorama processes personal data when you use https://agorama.app, your account, likes and communications with us. It covers this website only.
The controller is Anthony Lajusticia, a self-employed professional established in Spain and registered under the Régimen Especial de Trabajadores Autónomos, trading as Agorama.
Our Legal Notice provides further details. Website usage rules appear in our Terms of Service.
We process your email address and, depending on the fields and features you use, your name or pseudonym, profile photo, language, display preferences, account creation and update dates and verification status.
Authentication information may include a password stored as a hash, passkey public keys and metadata, data needed for two-factor authentication, protected recovery codes and sign-in link or code metadata. We do not receive biometric data used locally by your device to unlock a passkey.
If you choose an external sign-in provider offered on the website, it sends us identifiers and profile information needed for that connection, according to the permissions displayed. Its own service remains governed by its privacy policy.
When you like a proposal, we store its association with your account and the date of the like. We also record when you gave consent.
This information may reveal your political opinions and is sensitive personal data. Associating it with an account identifier does not make it anonymous.
Website requests may transmit an IP address, browser type, device information, requested URL, referring page, timestamps and error or security information.
The website also uses an Agorama visit context. For a signed-out visitor, a fingerprint is computed in the browser from its technical characteristics. It is combined with the IP address on the server and then hashed to recognize a visit context. The context may contain first and last visit dates, landing URL, external referrer and campaign parameters in the arrival link. It may later be associated with your account during registration or sign-in.
A hash remains personal data when it can recognize a visitor or be linked to an account. The IP address is not stored in plain text in the fingerprint field; it may nevertheless appear in technical or security logs.
We use Umami, self-hosted in the European Union, to measure traffic and service use: pages viewed, referrals, general browser characteristics and usage events. The integration may associate these events with the visit context identifier. This measurement can therefore be linked to an account; we do not describe it as invariably anonymous. A URL visited on a political website may itself reveal a sensitive interest.
We process sessions, sign-in attempts, security events, activity logs and information needed to prevent abuse and diagnose incidents. If you contact us, we receive your message, contact details, any attachments and the reply history.
Politician and candidacy profiles may display names, photographs, offices, political affiliations, biographical information and positions from public sources, including official publications, parties and the individuals concerned. References appear on the website. This collection is separate from opinions expressed by our users.
We distinguish the following processing activities under the General Data Protection Regulation (GDPR):
| Purpose | Legal basis |
|---|---|
| Create and manage your account, authenticate you, store preferences and provide requested features | Performance of a contract, Article 6(1)(b) |
| Store likes and produce the corresponding counts | Consent, Article 6(1)(a), and explicit consent for political opinions, Article 9(2)(a), subject to applicable national restrictions |
| Protect the service, prevent manipulation, handle incidents and defend our rights | Legitimate interests in security and proper operation, Article 6(1)(f); a legal obligation where applicable |
| Answer requests and reports | Legitimate interests in responding and correcting content; a legal obligation for rights requests |
| Measure audience and understand website use | Legitimate interests for strictly limited measurement that qualifies for an exemption; consent where required for tracking technologies, tracking or sensitive data |
| Provide information about programs, candidacies and public activities | Legitimate interests in civic information, Article 6(1)(f); for political opinions, Article 9(2)(e) only where manifestly made public by the individual |
| Comply with a legal obligation or legally binding request | Article 6(1)(c) |
Required fields are indicated on forms. Without information essential for authentication, we cannot open or secure an account. Opinion features remain optional.
Accepting the Terms or reading this policy does not authorize processing political opinions, targeted advertising or any other activity requiring separate consent.
We request explicit agreement before storing your first like. Refusing does not stop you reading public information.
Likes provide the requested features and the counts shown on the website. We do not sell your opinions or use them to target advertising. We do not give parties, candidates or advertisers named lists of people who liked proposals.
The public sees like counts, not lists of people who liked a proposal.
You may withdraw consent in political opinion settings. Withdrawal deletes all your recorded opinions on Agorama. Account deletion also removes them. You may also email us. Withdrawal does not affect the lawfulness of earlier processing.
The website uses several types of technology:
context, a session reference, a context local storage flag and the browser fingerprint described above. The cookie is issued for 90 days and may be renewed during visits.In the current implementation, the visit context initializes automatically during browsing; it is separate from enabling Umami and from consent to likes. Clearing local storage or the cookie is not, by itself, a lasting withdrawal: a context may be created again on a subsequent visit.
Technologies strictly necessary for the requested service may be used without consent where the law allows. Others require consent where applicable. Self-hosting a tool or hashing an identifier does not, by itself, establish an exemption.
Your browser lets you inspect, block or clear cookies and local data. Blocking necessary technologies may prevent sign-in or some actions. You may contact us to exercise your rights concerning tracking.
Access is limited to authorized people who need it to operate, secure and maintain Agorama, and providers responsible for hosting, storage, backups, email delivery and, where needed, monitoring and technical support.
Providers acting on our behalf must process data according to our instructions and applicable contractual safeguards. Professional advisers or authorities may receive data needed for a legal obligation or the defense of a right.
Links to external sources lead to websites whose practices we do not control.
We do not sell personal data. We do not disclose it to third parties for their behavioral advertising.
Service data is stored in Europe. Umami is self-hosted in the European Union.
The storage location does not rule out all international access or processing by a provider, or processing by social networks to which you choose to send a link. Where a transfer under our responsibility to a country outside the European Economic Area is necessary, it must rely on an adequacy decision or appropriate safeguards, including standard contractual clauses and any required supplementary measures.
You may request information about recipients and transfer safeguards applicable to your data.
Retention depends on the purpose and your choices:
Where a period cannot be fixed in advance, we consider operational necessity, legal time limits and any incident or dispute. You may request details for your data.
Subject to GDPR conditions, you have rights of access, rectification, erasure, restriction, portability and objection. You may withdraw consent at any time.
In particular, you can edit your profile, export account data, delete political opinions and request account closure in your account area. The export excludes authentication secrets.
Email [email protected] for requests. We may verify your identity proportionately. We normally respond within one month; a complex request may require a two-month extension, notified within the first month.
You may object to processing based on legitimate interests. We then assess your reasons and stop processing unless there are compelling legitimate grounds or a need related to legal claims.
You may complain to the Agencia Española de Protección de Datos (AEPD) or the authority where you live, work or believe an infringement occurred, such as the CNIL in France. You do not have to contact us before complaining.
We use appropriate security measures, including access controls and protection of authentication credentials. No system offers absolute security. Do not email us passwords.
The website provides civic information that can be read without an account. We do not seek to collect children’s political opinions. Where a minor cannot lawfully consent to the relevant processing alone, appropriate consent from a legal representative is needed; merely creating an account does not replace it. Contact us if you believe data was collected without the required authorization.
Material changes to this policy will be announced on the website or through another appropriate channel. Any new processing requiring separate consent will be subject to a prior request.
Contact: [email protected].