We have launched!

Privacy Policy

1. Data Controller

Granada Creatives
Location: Granada, Spain
Email: [email protected]
Website: https://grx.red

For data protection inquiries, contact us at [email protected].

2. What Data We Collect

2.1 Account Registration

When you create an account on Granada Creatives, we collect the following information:

  • Full Name - Identity verification (not public)

  • Display Name - Public profile identification

  • Email Address - Account management and communications (not public)

  • Handle - Unique public identifier

  • Avatar - Profile picture (public)

  • Story/Bio - Profile description (public)

  • Disciplines - Professional skills categorization (public)

  • Presence Intent - Your relationship with Granada (public)

  • Physical Presence - Location frequency in Granada (public)

  • Postal Code - Geographic context (not public)

  • Social Links - Links to your external profiles (public)

  • Language Preference - User interface language (not public)

2.2 OAuth Authentication Data

If you register using a social login provider, we receive the following from that provider:

  • Google: Email, name, profile picture

  • GitHub: Email, name, profile picture

  • LinkedIn: Email, name, profile picture

  • Facebook: Email, name, profile picture

2.3 Technical Data

  • IP Addresses: Collected in server logs for security purposes

  • Session Tokens: Used for authentication

  • Error Logs: May contain user context for debugging purposes

3. How We Use Your Data

We use your personal data for the following purposes:

  • Account Management: To create and maintain your user account

  • Public Directory: To display your public profile in the Granada Creatives directory

  • Communications: To send you important account-related notifications

  • Service Improvement: To analyze usage patterns and improve our platform

  • Security: To protect against unauthorized access and abuse

  • Legal Compliance: To comply with applicable laws and regulations

4. Legal Basis for Processing

We process your personal data based on the following legal grounds under GDPR Article 6:

  • Consent (Art. 6.1.a): For profile information you voluntarily provide and choose to make public

  • Contract Performance (Art. 6.1.b): To provide you with our services when you create an account

  • Legitimate Interest (Art. 6.1.f): For security, fraud prevention, and service improvement

  • Legal Obligation (Art. 6.1.c): When required by law

5. Data Retention

We retain your data for the following periods:

  • Account Data: For as long as your account is active, plus 30 days after deletion

  • Server Logs (IP addresses): 30 days

  • Error Logs: 90 days

  • Session Tokens: Until logout or expiration (maximum 1 year)

After these periods, data is permanently deleted or anonymized.

6. Third-Party Services and International Transfers

We use the following third-party services to operate our platform:

For transfers to the USA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission to ensure adequate protection of your data.

7. Your Rights Under GDPR

Under the General Data Protection Regulation and Spanish LOPDGDD, you have the following rights:

  • Right of Access (Art. 15): Request a copy of your personal data

  • Right to Rectification (Art. 16): Correct inaccurate or incomplete data

  • Right to Erasure (Art. 17): Request deletion of your data ("right to be forgotten")

  • Right to Restriction (Art. 18): Limit how we process your data

  • Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format

  • Right to Object (Art. 21): Object to processing based on legitimate interests

  • Right to Withdraw Consent (Art. 7.3): Withdraw consent at any time without affecting prior processing

  • Right Not to Be Subject to Automated Decisions (Art. 22): We do not make automated decisions that significantly affect you

8. How to Exercise Your Rights

To exercise any of your rights, you can:

  • Email us at [email protected] with your request

  • Delete your account directly through your profile settings

  • Update your profile information at any time through your account

We will respond to your request within 30 days. We may ask for identification to verify your identity before processing your request.

9. Cookies

We use cookies and similar technologies for authentication, preferences, and analytics. For detailed information about the cookies we use and how to manage them, please see our Cookie Policy.

10. Complaints

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos - AEPD):

AEPD
C/ Jorge Juan, 6
28001 Madrid, Spain
Website: www.aepd.es

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last Updated" date. We encourage you to review this policy periodically.

12. Last Updated

This Privacy Policy was last updated on 2026-01-16.

Last updated: January 27, 2026