Privacy policy

1. Controller

• Data protection contact: privacy@influhedge.com

2. What data is processed

There are no user accounts. No name, address or phone number is requested, and no browsing profile is built.

What is processed is:

• A pseudonymised voter fingerprint. When a payment clears, an irreversible value (salted SHA-256) is derived from the card’s technical fingerprint or, failing that, from the email given to the payment gateway. Neither the card number nor the email is stored — only that value, used solely to tell whether two payments come from the same person so distinct voters can be counted.
• A pseudonymised fingerprint of the IP address, computed the same way, used to apply the daily proposal limits and prevent abuse. The IP is never stored in the clear.
• Transaction data: amount, currency, date, votes and order status.
• Proposal text: the name, username and platform the sender types.
• Correspondence sent to the contact addresses.

Payment data (card, cardholder, billing address) is collected and processed directly by Stripe as an independent controller. The site owner never has access to it.

3. Purposes and legal bases

• Providing the service and performing the purchase — basis: performance of a contract (Art. 6(1)(b) GDPR).
• Recording the waiver of the right of withdrawal — basis: compliance with a legal obligation (Art. 6(1)(c)).
• Counting distinct voters, applying limits and preventing fraud and abuse — basis: legitimate interest (Art. 6(1)(f)) in the integrity of the service.
• Keeping accounting records — basis: legal obligation.

No automated decisions with legal effects are made about individuals, and no profiling for advertising purposes is carried out.

4. Recipients

The following providers are involved, under data processing agreements:

• Stripe — payment processing (independent controller for card data).
• Railway — application and database hosting.
• Cloudflare — content delivery and protection against attacks.

Data is never sold, and is not shared with third parties for commercial purposes.

5. International transfers

Some of the providers above are established in the United States. Those transfers rely on the Standard Contractual Clauses approved by the European Commission and, where applicable, on the EU-US Data Privacy Framework.

6. Retention

• Transaction and consent records: the statutory retention period for commercial and tax documentation.
• IP fingerprints from proposals: as long as needed to apply the limits and review the queue, and in any case no longer than 12 months.
• Rejected proposals: up to 12 months, to prevent repeated resubmission.

7. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to privacy@influhedge.com.

Please note that the pseudonymised fingerprints are irreversible by design: without supplying the original datum (a payment receipt, for example) it may not be materially possible to locate the records associated with a particular person. That is a consequence of processing as little data as possible.

If you believe your rights have not been respected, you may lodge a complaint with the Spanish Data Protection Agency (aepd.es) or your local supervisory authority.

8. Cookies

The public site sets no cookies at all. Language and currency are worked out from the location of the connection on each visit, with nothing stored in the browser.

The only cookie that exists is internal and exempt from consent under article 22(2) LSSI:

• ih_admin — admin panel session. It is only set when the owner logs in; visitors to the index never receive it.

No analytics, advertising or third-party cookies are used, which is why no consent banner is shown.

9. Minors

The service is intended solely for people aged 18 and over. Minors are not accepted in the index; any that are found are removed immediately.

10. Changes

This policy may be updated. The date of the latest version appears in the heading.