Legal

Privacy Policy

Effective 2026-06-27

This Policy is written in English. A Spanish (Castilian) version will follow. If there is any conflict between language versions, the English version governs.

This Privacy Policy explains how Album Mundial ("we", "us") handles your personal data when you use the Album Mundial website and digital album service (the "Service"). It is written to meet the requirements of the EU General Data Protection Regulation (GDPR) and the Spanish Organic Law 3/2018 on Data Protection and Digital Rights.

1. Who is the data controller

The controller of your personal data is the operator of Album Mundial. For any privacy question, request, or complaint write to support@albummundial.net.

2. What data we collect

Account data. Email address, a hashed password, the locale you signed up in, and the timestamps of account creation and last sign-in.
Gameplay data. The packs you open, the players you collect, where you place them on the album, and any dupe-exchange activity. This is the state of your album and is tied to your account ID.
Purchase data. For each order: the amount, the currency, the items, the PayPal order ID, and the order timestamps. We do not store your full payment method — that lives with PayPal under their terms.
Shipping data (print orders only). Recipient name and postal address are stored against the order so we can print and ship a physical album book.
Pre-account session data. If you open the free welcome pack before signing up, we generate an anonymous session tied to a device fingerprint cookie. When you later create an account, that session is merged into your account.
Technical and analytics data. IP address, browser and device type, pages visited, events triggered inside the app (e.g. opening a pack, completing a checkout). We use this to operate the Service, fight fraud, and improve the product.

3. Why we use your data and the legal basis

To run the Service (provide the account, save your album, fulfil purchases). Legal basis: performance of the contract between you and us (GDPR art. 6(1)(b)).
To prevent fraud and abuse (rate-limiting, session-fingerprint checks, anti-bot). Legal basis: our legitimate interest in protecting the Service (art. 6(1)(f)).
To comply with legal obligations (tax records for paid orders, responding to lawful requests). Legal basis: legal obligation (art. 6(1)(c)).
To measure and improve the Service (product analytics via PostHog, advertising-pixel measurement via Meta and TikTok). Legal basis: legitimate interest for first-party analytics; consent for third-party advertising pixels where legally required (art. 6(1)(a) / art. 6(1)(f)).

4. Who we share data with

We only share data with the service providers we need to run the product. Each is bound by a data-processing agreement.

Supabase — database, authentication, and file storage for sticker artwork.
Vercel — hosting and edge delivery of the website.
PayPal — payment processing for pack and print orders.
Resend — transactional emails (account, order receipts, password recovery).
PostHog — product analytics on what features are used and where users drop off.
Meta and TikTok — advertising pixels for measuring marketing campaigns.
Gelato — print and fulfilment partner for physical album books (only your shipping data is shared).
Wikipedia — when you view a player page, we fetch a public biography summary directly from the Wikipedia API. No personal data is sent.

We do not sell your personal data.

5. International transfers

Where possible we use EU-region hosting (Supabase EU, PostHog EU). Some providers above (Vercel, PayPal, Meta, TikTok, Resend, Gelato) may transfer data outside the EEA. Where they do, we rely on the EU Commission's Standard Contractual Clauses and the relevant adequacy decisions to protect the transfer.

6. Cookies and similar technologies

We use:

Strictly necessary cookies for sign-in sessions, anti-CSRF tokens, and the anonymous pre-account session. These cannot be switched off.
Analytics via PostHog. We store a long-lived identifier so events from the same browser can be linked.
Advertising measurement via Meta Pixel and TikTok Pixel. Where required by law, these load only after consent.

7. How long we keep data

Account and gameplay data: while the account is active, and for a reasonable period after deletion to defend against chargebacks and abuse claims.
Purchase records: at least six years from the order date, to satisfy Spanish tax and accounting rules.
Shipping data: kept with the order; not reused for other purposes.
Analytics events: PostHog retention defaults apply (typically up to seven years on aggregated events; raw event data is shorter).

8. Your rights

Under GDPR you have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
have your data deleted (the "right to be forgotten"), subject to retention obligations for tax and fraud records;
restrict or object to certain processing;
receive a portable copy of the data you provided to us;
withdraw any consent you previously gave, without affecting processing done before the withdrawal;
lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es) or another EU supervisory authority.

Send any of these requests to support@albummundial.net. We will reply within the GDPR timelines (normally within one month).

9. Security

Passwords are stored hashed; database access is restricted by row-level security and service-role keys; production secrets live in a managed secret store and are never committed to source code. If a personal-data breach happens that is likely to result in a risk to your rights, we will notify the supervisory authority within 72 hours and, where required, notify you directly.

10. Children

The Service is not aimed at children under 14. We do not knowingly collect personal data from anyone under that age. If you believe a child has provided us data, contact support@albummundial.net and we will delete it.

11. Changes to this Policy

We may update this Policy as the Service evolves. The current version is always posted here with the effective date above. If we make material changes we will provide reasonable notice (for example a banner on the site or an email) before they take effect.

12. Contact

Privacy questions or data-rights requests go to support@albummundial.net.