Privacy Policy

Last updated: October 29, 2026

This policy explains how Agorama processes personal data when you use https://agorama.app, your account, likes and communications with us. It covers this website only.

1. Data controller

The controller is Anthony Lajusticia, a self-employed professional established in Spain and registered under the Régimen Especial de Trabajadores Autónomos, trading as Agorama.

NIF: Z0570202Z.
Business address: Calle de Alcalá 54, 4º izquierda, 28014 Madrid, Spain.
Contact for privacy and rights requests: contact@agorama.app.

Our Legal Notice provides further details. Website usage rules appear in our Terms of Service.

2. Data and sources

Account and preferences

We process your email address and, depending on the fields and features you use, your name or pseudonym, profile photo, language, display preferences, account creation and update dates and verification status.

Authentication information may include a password stored as a hash, passkey public keys and metadata, data needed for two-factor authentication, protected recovery codes and sign-in link or code metadata. We do not receive biometric data used locally by your device to unlock a passkey.

If you choose an external sign-in provider offered on the website, it sends us identifiers and profile information needed for that connection, according to the permissions displayed. Its own service remains governed by its privacy policy.

Political opinions

When you like a proposal, we store its association with your account and the date of the like. We also record when you gave consent.

This information may reveal your political opinions and is sensitive personal data. Associating it with an account identifier does not make it anonymous.

Browsing, visit context and audience measurement

Website requests may transmit an IP address, browser type, device information, requested URL, referring page, timestamps and error or security information.

The website also uses an Agorama visit context. For a signed-out visitor, a fingerprint is computed in the browser from its technical characteristics. It is combined with the IP address on the server and then hashed to recognize a visit context. The context may contain first and last visit dates, landing URL, external referrer and campaign parameters in the arrival link. It may later be associated with your account during registration or sign-in.

A hash remains personal data when it can recognize a visitor or be linked to an account. The IP address is not stored in plain text in the fingerprint field; it may nevertheless appear in technical or security logs.

We use Umami, self-hosted in the European Union, to measure traffic and service use: pages viewed, referrals, general browser characteristics and usage events. The integration may associate these events with the visit context identifier. This measurement can therefore be linked to an account; we do not describe it as invariably anonymous. A URL visited on a political website may itself reveal a sensitive interest.

Security and communications

We process sessions, sign-in attempts, security events, activity logs and information needed to prevent abuse and diagnose incidents. If you contact us, we receive your message, contact details, any attachments and the reply history.

Information about politicians

Politician and candidacy profiles may display names, photographs, offices, political affiliations, biographical information and positions from public sources, including official publications, parties and the individuals concerned. References appear on the website. This collection is separate from opinions expressed by our users.

3. Purposes and legal bases

We distinguish the following processing activities under the General Data Protection Regulation (GDPR):

Purpose	Legal basis
Create and manage your account, authenticate you, store preferences and provide requested features	Performance of a contract, Article 6(1)(b)
Store likes and produce the corresponding counts	Consent, Article 6(1)(a), and explicit consent for political opinions, Article 9(2)(a), subject to applicable national restrictions
Protect the service, prevent manipulation, handle incidents and defend our rights	Legitimate interests in security and proper operation, Article 6(1)(f); a legal obligation where applicable
Answer requests and reports	Legitimate interests in responding and correcting content; a legal obligation for rights requests
Measure audience and understand website use	Legitimate interests for strictly limited measurement that qualifies for an exemption; consent where required for tracking technologies, tracking or sensitive data
Provide information about programs, candidacies and public activities	Legitimate interests in civic information, Article 6(1)(f); for political opinions, Article 9(2)(e) only where manifestly made public by the individual
Comply with a legal obligation or legally binding request	Article 6(1)(c)

Required fields are indicated on forms. Without information essential for authentication, we cannot open or secure an account. Opinion features remain optional.

Accepting the Terms or reading this policy does not authorize processing political opinions, targeted advertising or any other activity requiring separate consent.

4. Your control over political opinions

We request explicit agreement before storing your first like. Refusing does not stop you reading public information.

Likes provide the requested features and the counts shown on the website. We do not sell your opinions or use them to target advertising. We do not give parties, candidates or advertisers named lists of people who liked proposals.

The public sees like counts, not lists of people who liked a proposal.

You may withdraw consent in political opinion settings. Withdrawal deletes all your recorded opinions on Agorama. Account deletion also removes them. You may also email us. Withdrawal does not affect the lawfulness of earlier processing.

5. Cookies, local storage and browser fingerprinting

The website uses several types of technology:

Session and security: cookies needed for sign-in, protection against fraudulent requests and secure actions. Some sign-in mechanisms may remember your session or last sign-in method.
Preferences: cookies or local storage for language, appearance and interface state.
Visit context: a cookie named context, a session reference, a context local storage flag and the browser fingerprint described above. The cookie is issued for 90 days and may be renewed during visits.
Audience measurement: the Umami script and usage events, potentially associated with the visit context.

In the current implementation, the visit context initializes automatically during browsing; it is separate from enabling Umami and from consent to likes. Clearing local storage or the cookie is not, by itself, a lasting withdrawal: a context may be created again on a subsequent visit.

Technologies strictly necessary for the requested service may be used without consent where the law allows. Others require consent where applicable. Self-hosting a tool or hashing an identifier does not, by itself, establish an exemption.

Your browser lets you inspect, block or clear cookies and local data. Blocking necessary technologies may prevent sign-in or some actions. You may contact us to exercise your rights concerning tracking.

6. Recipients and publication

Access is limited to authorized people who need it to operate, secure and maintain Agorama, and providers responsible for hosting, storage, backups, email delivery and, where needed, monitoring and technical support.

Providers acting on our behalf must process data according to our instructions and applicable contractual safeguards. Professional advisers or authorities may receive data needed for a legal obligation or the defense of a right.

Links to external sources lead to websites whose practices we do not control.

We do not sell personal data. We do not disclose it to third parties for their behavioral advertising.

7. Location and transfers

Service data is stored in Europe. Umami is self-hosted in the European Union.

The storage location does not rule out all international access or processing by a provider, or processing by social networks to which you choose to send a link. Where a transfer under our responsibility to a country outside the European Economic Area is necessary, it must rely on an adequacy decision or appropriate safeguards, including standard contractual clauses and any required supplementary measures.

You may request information about recipients and transfer safeguards applicable to your data.

8. Retention and deletion

Retention depends on the purpose and your choices:

Account and preferences: for the life of the account, followed by deletion or restriction to items needed for a legal obligation, security or a dispute. Closure removes, in particular, email, name and username from the active profile; it does not necessarily erase every technical record or log.
Recorded political opinions: until deletion, consent withdrawal or account deletion. Withdrawal removes the corresponding records from the active database.
Guest contexts not linked to an account: scheduled to expire 90 days after creation, then purged through the cleanup mechanism. Account-linked contexts follow account data management.
Cookies and local storage: until expiry or deletion; some local choices persist until changed or cleared.
Logs, security events and audience data: for the period needed to detect and investigate an incident or compare service use, followed by deletion or aggregation that no longer identifies you. An incident or dispute may justify longer, targeted retention.
Messages and reports: for handling the request and follow-up, then, where necessary, applicable limitation or statutory retention periods.
Backups: copies may remain until replaced in the backup cycle; they must not be used to resume ordinary use of deleted data.

Where a period cannot be fixed in advance, we consider operational necessity, legal time limits and any incident or dispute. You may request details for your data.

9. Your rights

Subject to GDPR conditions, you have rights of access, rectification, erasure, restriction, portability and objection. You may withdraw consent at any time.

In particular, you can edit your profile, export account data, delete political opinions and request account closure in your account area. The export excludes authentication secrets.

Email contact@agorama.app for requests. We may verify your identity proportionately. We normally respond within one month; a complex request may require a two-month extension, notified within the first month.

You may object to processing based on legitimate interests. We then assess your reasons and stop processing unless there are compelling legitimate grounds or a need related to legal claims.

You may complain to the Agencia Española de Protección de Datos (AEPD) or the authority where you live, work or believe an infringement occurred, such as the CNIL in France. You do not have to contact us before complaining.

10. Security, minors and updates

We use appropriate security measures, including access controls and protection of authentication credentials. No system offers absolute security. Do not email us passwords.

The website provides civic information that can be read without an account. We do not seek to collect children’s political opinions. Where a minor cannot lawfully consent to the relevant processing alone, appropriate consent from a legal representative is needed; merely creating an account does not replace it. Contact us if you believe data was collected without the required authorization.

Material changes to this policy will be announced on the website or through another appropriate channel. Any new processing requiring separate consent will be subject to a prior request.

Contact: contact@agorama.app.