Effective: April 17, 2026
Privacy Policy
1. Data Controller
The data controller responsible for your personal data is Digital Outdoor SL, a company based in Barcelona, Spain.
For any privacy-related inquiries, you can contact us at support@alpinelog.com.
2. Data Collected
We collect the following personal data, grouped by source:
| Source | Data | Notes |
|---|---|---|
| Sign-up | Username, email, password (hashed) | Required fields |
| Google sign-up | Username, email, Google account ID, profile picture | Via Google OAuth |
| Profile settings | Name, surname, birthday, bio, avatar, outdoor professional status, professional role | Optional fields |
| Activity logs | Activity type, date, conditions, description, photos, rating, result | User-generated content |
| Automated | IP address, browser/device info, session data, cookies | Standard web analytics and auth |
Sign-up
Data: Username, email, password (hashed)
Required fields
Google sign-up
Data: Username, email, Google account ID, profile picture
Via Google OAuth
Profile settings
Data: Name, surname, birthday, bio, avatar, outdoor professional status, professional role
Optional fields
Activity logs
Data: Activity type, date, conditions, description, photos, rating, result
User-generated content
Automated
Data: IP address, browser/device info, session data, cookies
Standard web analytics and auth
3. Legal Basis for Processing
Under GDPR Article 6, we process your data based on the following legal grounds:
| Processing | Legal Basis |
|---|---|
| Account creation and authentication | Contract performance (6.1.b) |
| Displaying activity logs and profile data | Contract performance (6.1.b) |
| Analytics and platform improvement | Legitimate interest (6.1.f) |
| Cookies (non-essential) | Consent (6.1.a) |
| Email communications (verification, password reset) | Contract performance (6.1.b) |
4. Third-Party Services
The following third-party services may process your data. Each service operates under its own privacy policy.
| Service | Purpose | Data Shared |
|---|---|---|
| Google OAuth | Authentication | Email, name, profile picture |
| Email service provider | Transactional emails (verification, password reset) | Email address |
| Image hosting | Avatar and activity log photo storage | Uploaded images |
| PostHog (EU hosting, Frankfurt) | Product analytics (page views, feature usage) | Pseudonymized usage data; no IP storage; only loaded after cookie acceptance |
| Hosting provider | Application and database hosting | All platform data |
Google OAuth
Purpose: Authentication
Data shared: Email, name, profile picture
Email service provider
Purpose: Transactional emails (verification, password reset)
Data shared: Email address
Image hosting
Purpose: Avatar and activity log photo storage
Data shared: Uploaded images
PostHog (EU hosting, Frankfurt)
Purpose: Product analytics (page views, feature usage)
Data shared: Pseudonymized usage data; no IP storage; only loaded after cookie acceptance
Hosting provider
Purpose: Application and database hosting
Data shared: All platform data
6. Data Retention
| Scenario | Retention |
|---|---|
| Active account | Data retained as long as the account exists |
| Account deletion | Account data permanently deleted. Activity logs retained but anonymized — username replaced with “Anonymous” |
| Inactive accounts | No automatic deletion. May be revisited in the future |
7. User Rights (GDPR)
Under the General Data Protection Regulation, you have the following rights regarding your personal data:
- Access — Request a copy of your personal data.
- Rectification — Correct inaccurate data. Most fields are editable directly via Profile Settings.
- Erasure (“right to be forgotten”) — Request account deletion. Activity logs are anonymized, not deleted (see section 6).
- Restriction of processing — Request a temporary restriction on the use of your data.
- Data portability — Request your data in a machine-readable format.
- Objection — Object to processing based on legitimate interest.
- Withdraw consent — Withdraw consent for non-essential cookies at any time.
To exercise any of these rights, contact us at support@alpinelog.com. We will respond within 30 days as required by GDPR.
You may also file a complaint with the Spanish Data Protection Agency (AEPD).
8. Minimum Age
Users must be at least 16 years old to create an account on AlpineLog, in compliance with Spanish LOPDGDD Article 7.
9. International Data Transfers
If any third-party service processes data outside the EU/EEA, appropriate transfer mechanisms (such as Standard Contractual Clauses or an adequacy decision) will be in place to ensure an adequate level of data protection.
10. Policy Changes
AlpineLog reserves the right to update this privacy policy. We will notify you of material changes via email or a prominent notice on the platform. The effective date at the top of this page will be updated accordingly.