Effective: October 22, 2026
Privacy Policy
1. Data Controller
The data controller responsible for your personal data is Climbing Solutions SL, a company based in Barcelona, Spain.
For any privacy-related inquiries, you can contact us at support@alpinelog.com.
2. Data Collected
We collect the following personal data, grouped by source:
| Source | Data | Notes |
|---|---|---|
| Sign-up | Username, email, password (hashed) | Required fields |
| Google sign-up | Username, email, Google account ID, profile picture | Via Google OAuth |
| Profile settings | Name, surname, birthday, bio, avatar, outdoor professional status, professional role | Optional fields |
| Activity logs | Activity type, date, conditions, description, photos, rating, result | User-generated content |
| Automated | IP address, browser/device info, session data, cookies | Standard web analytics and auth |
Sign-up
Data: Username, email, password (hashed)
Required fields
Google sign-up
Data: Username, email, Google account ID, profile picture
Via Google OAuth
Profile settings
Data: Name, surname, birthday, bio, avatar, outdoor professional status, professional role
Optional fields
Activity logs
Data: Activity type, date, conditions, description, photos, rating, result
User-generated content
Automated
Data: IP address, browser/device info, session data, cookies
Standard web analytics and auth
3. Legal Basis for Processing
Under GDPR Article 6, we process your data based on the following legal grounds:
| Processing | Legal Basis |
|---|---|
| Account creation and authentication | Contract performance (6.1.b) |
| Displaying activity logs and profile data | Contract performance (6.1.b) |
| Analytics and platform improvement | Legitimate interest (6.1.f) |
| Cookies (non-essential) | Consent (6.1.a) |
| Email communications (verification, password reset) | Contract performance (6.1.b) |
| Automated AI review of the activity catalog (detecting duplicates and errors in names and aliases) | Legitimate interest (6.1.f) |
| Security and technical operation of the website (bot protection, error detection, maps) | Legitimate interest (6.1.f) |
4. Third-Party Services
The following third-party services may process your data. Each service operates under its own privacy policy.
| Service | Purpose | Data Shared |
|---|---|---|
| Google OAuth | Authentication | Email, name, profile picture |
| Resend (USA) | Transactional emails (verification, password reset) | Email address |
| PostHog (EU hosting, Frankfurt) | Product analytics (page views, feature usage) | Pseudonymized usage data; no IP storage; only loaded after cookie acceptance |
| Supabase (data in the EU, Ireland) | Database, user accounts and image storage (avatar and log photos) | All platform data |
| Vercel (USA) | Website hosting and server execution | The data of each visit and of what you submit or look up, including your IP address |
| Sentry (data in the EU, Germany) | Detecting errors in the website and the server | Technical details of the error (page, browser and system) and the connection’s IP address. Never your email or your password. |
| Cloudflare Turnstile (USA) | Bot protection on sign-up, login and password recovery | Technical browser data and your IP address |
| GitHub Actions (USA) | Scheduled automated tasks (catalog review, placing areas on the map) | The catalog data each task processes, with internal identifiers. Never your email, your username or the text of your logs. |
| Anthropic (Claude API, USA) | Automated review of new catalog activities to detect duplicates and errors in names and aliases | Catalog data of the new activity and of similar activities, such as name, spot or sector, aliases, summit, country, and the area name if the area is approved. Never your username, your email or the text of your logs. Anthropic does not use this data to train its models and deletes it within 30 days, unless the law or the enforcement of its usage policy requires keeping it longer. |
| OpenStreetMap (United Kingdom) | Showing maps, placing areas and checking summit names | When you view a map, your browser downloads the map images from OpenStreetMap, which receives your IP address. To place areas and check summits we send names of approved areas and of summits, with their country, and no data from your account. |
Google OAuth
Purpose: Authentication
Data shared: Email, name, profile picture
Resend (USA)
Purpose: Transactional emails (verification, password reset)
Data shared: Email address
PostHog (EU hosting, Frankfurt)
Purpose: Product analytics (page views, feature usage)
Data shared: Pseudonymized usage data; no IP storage; only loaded after cookie acceptance
Supabase (data in the EU, Ireland)
Purpose: Database, user accounts and image storage (avatar and log photos)
Data shared: All platform data
Vercel (USA)
Purpose: Website hosting and server execution
Data shared: The data of each visit and of what you submit or look up, including your IP address
Sentry (data in the EU, Germany)
Purpose: Detecting errors in the website and the server
Data shared: Technical details of the error (page, browser and system) and the connection’s IP address. Never your email or your password.
Cloudflare Turnstile (USA)
Purpose: Bot protection on sign-up, login and password recovery
Data shared: Technical browser data and your IP address
GitHub Actions (USA)
Purpose: Scheduled automated tasks (catalog review, placing areas on the map)
Data shared: The catalog data each task processes, with internal identifiers. Never your email, your username or the text of your logs.
Anthropic (Claude API, USA)
Purpose: Automated review of new catalog activities to detect duplicates and errors in names and aliases
Data shared: Catalog data of the new activity and of similar activities, such as name, spot or sector, aliases, summit, country, and the area name if the area is approved. Never your username, your email or the text of your logs. Anthropic does not use this data to train its models and deletes it within 30 days, unless the law or the enforcement of its usage policy requires keeping it longer.
OpenStreetMap (United Kingdom)
Purpose: Showing maps, placing areas and checking summit names
Data shared: When you view a map, your browser downloads the map images from OpenStreetMap, which receives your IP address. To place areas and check summits we send names of approved areas and of summits, with their country, and no data from your account.
6. Data Retention
| Scenario | Retention |
|---|---|
| Active account | Data retained as long as the account exists |
| Account deletion | Account data permanently deleted. Activity logs retained but anonymized — username replaced with “Anonymous” |
| Inactive accounts | No automatic deletion. May be revisited in the future |
| Automated activity review | We keep a copy of the name, spot and aliases of each reviewed activity, together with the review result. If the activity is deleted, after 90 days we delete that copy and keep only the result, with no text. The report of each review run is deleted after 30 days. If you delete your account, we delete the copies of the activities you created. |
7. User Rights (GDPR)
Under the General Data Protection Regulation, you have the following rights regarding your personal data:
- Access — Request a copy of your personal data.
- Rectification — Correct inaccurate data. Most fields are editable directly via Profile Settings.
- Erasure (“right to be forgotten”) — Request account deletion. Activity logs are anonymized, not deleted (see section 6).
- Restriction of processing — Request a temporary restriction on the use of your data.
- Data portability — Request your data in a machine-readable format.
- Objection — Object to processing based on legitimate interest.
- Withdraw consent — Withdraw consent for non-essential cookies at any time.
To exercise any of these rights, contact us at support@alpinelog.com. We will respond within 30 days as required by GDPR.
You may also file a complaint with the Spanish Data Protection Agency (AEPD).
8. Minimum Age
Users must be at least 16 years old to create an account on AlpineLog, in compliance with Spanish LOPDGDD Article 7.
9. International Data Transfers
Some providers process data outside the EU/EEA. Vercel, Resend, Cloudflare, GitHub and Anthropic are US companies: the data they process for us, described in section 4, is transferred under the Standard Contractual Clauses approved by the European Commission, included in their data processing agreements. Supabase and Sentry store our data in the EU (Ireland and Germany); as they are US companies, any access from the US is covered by the same clauses. Google processes the data of signing in with Google under its own privacy policy. OpenStreetMap (United Kingdom) processes data in a country covered by a European Commission adequacy decision. If any other provider processes data outside the EU/EEA, we apply equivalent transfer mechanisms.
10. Policy Changes
AlpineLog reserves the right to update this privacy policy. We will notify you of material changes via email or a prominent notice on the platform. The effective date at the top of this page will be updated accordingly.