Last updated: 7 July 2026
Privacy Policy
Data controller: Rubén Fernández, operator of Drayfus. hi+legal@drayfus.com .
What data we handle, and why
- Account: your email address (identification and authentication) and an automatically generated public name you can change. If you sign in with Google, we receive your email and your Google account identifier; we never receive your password.
- Content you create: stacks, descriptions, notes and votes. It is public by the nature of the service.
- Technical data: server logs and IP address, for security and to limit abuse (rate limiting).
- Analytics: we use Umami (cookieless analytics), which measures visits in aggregate, non-identifiable form.
- Errors: we use Sentry to detect failures; its reports may include your IP address and technical request data (we scrub personal data before sending).
Legal basis
Performance of the service (art. 6.1.b GDPR) for account and content; legitimate interest (art. 6.1.f) in keeping the service secure and stable (technical data, aggregate analytics and error detection).
Processors and third parties
- Hosting: Fly.io, with servers in the European Union (Paris). Fly.io is a US company and acts as a processor with appropriate safeguards.
- Backups and files: Tigris (S3-compatible storage), which may replicate data outside the EEA with appropriate safeguards.
- Analytics: Umami Cloud (cookieless).
- Errors: Sentry.
- Authentication: when you sign in with Google, Google processes your data under its own policy.
Some of these providers may process data outside the EEA (e.g. the USA) with appropriate safeguards (standard contractual clauses). We don't sell your data.
Retention
For as long as your account is active. If you delete it, we erase your personal data; public content may be kept in dissociated form. Technical logs are kept for limited periods.
Your rights
Access, rectification, erasure, restriction, objection and portability by writing to hi+legal@drayfus.com . You may also lodge a complaint with the Spanish Data Protection Agency (aepd.es).
Minors
Not aimed at children under 14.
Cookies
Only strictly necessary technical cookies (sign-in and form protection); they don't require consent. No advertising or tracking cookies.