Privacy policy

Version: 2026-10-12-legal1

Controller

Alex Wray, an individual (persona física) in Spain, is the controller for VoyageRoulette. Email: support@voyageroulette.com. Postal address: [OWNER: address]. NIF: [OWNER: NIF]. The service is for adults aged 18 or older.

Data, purposes and legal bases

We process email, account and authentication identifiers, age confirmation and terms version, device identity, spins and balances, preferences, saved destinations, itineraries and uploaded photos to provide the service and manage your account (performance of a contract). Customer, subscription, payment and billing references support charging and tax/accounting duties (contract and legal obligation). Stripe processes full card details; we do not store them. Technical data such as IP addresses and security logs help prevent fraud, abuse and failures (our legitimate interest in protecting the service, balanced against your rights). Support requests are used to respond and handle rights and complaints. We do not use this data for advertising or automated decisions with legal or similarly significant effects; destination selection uses filters and catalog availability.

Recipients and external services

Supabase provides authentication, database and storage; Stripe processes payments; Cloudflare provides hosting and CDN. Vercel Analytics and Speed Insights are absent. When you load the relevant features, OpenStreetMap (maps and Nominatim), Open-Meteo (weather), Unsplash and Wikimedia (images) may receive your IP and technical data; Nominatim receives place searches. Booking and reference links open Google, Skyscanner, Momondo, Kayak, Booking.com, Hotels.com, Meteostat, Weather Underground or other providers named at each link, under their own privacy policies. Not all these parties are processors: their role depends on the service. [OWNER: verify processor agreements, hosting regions, subprocessors and any other live integrations].

International transfers

Some providers may process data outside the EEA. [OWNER: confirm actual international transfers, countries, adequacy decisions or contractual safeguards and how to obtain a copy]. We do not assume all providers store data in Spain.

Retention

Account data is kept while needed for the service; on account closure it is deleted or restricted as required for legal duties and possible claims. Billing, security and support records are kept only for applicable periods. [OWNER: specify implemented account-deletion process and retention periods for billing, logs, support, backups and consent evidence].

Necessary cookies and storage

We use only storage needed for identity, authentication, requested preferences and service functions. There is no advertising tracking or non-essential analytics and no cookie banner. Cookie: vr_device (identity and quota; configured lifetime 365 days). localStorage: vr.deviceId; Supabase sb-<project>-auth-token and PKCE verifiers; vr.locale, vr.theme, vr.originIata, vr.worldMode; vr.reveal and vr.daynight only in permitted previews; vr.spinHistory and user variants; vr.excludedCountries.<userId>; vr.savedSpots.<destinationId>[.<userId>]; vr.geocode, vr.geocode.nextRequestAt and vr.geocode.lock.<id>. sessionStorage: vr.pendingSpin.<scope> and vr.checkoutReturn.v1. Retention depends on the session, cleanup or feature expiry; clearing browser storage removes sessions and preferences. Stripe may use necessary storage on its checkout and portal pages.

Your rights

Request access, rectification, erasure, restriction, portability and objection, particularly to legitimate-interest processing, at support@voyageroulette.com. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. We respond within one month, with any legally permitted extension; we request proportionate identification only when necessary. You may complain to the Spanish Data Protection Agency (www.aepd.es). Data needed to contract or comply with law is required for those functions; without it we cannot provide them.