Privacy policy

Who is responsible

The data controller for the processing described below is Carlos Fraile Duran (NIF 53974104G), Amariz Loureiro nº 60, 36390 Vigo (Pontevedra), España, operating the site under the trading name Mundevo. Contact for any privacy matter: mundevocom@gmail.com.

No Data Protection Officer has been appointed: the processing here is neither large-scale monitoring nor processing of special-category data, so the appointment is not required under Article 37 GDPR. Questions go to the address above.

What we collect

Mundevo collects two kinds of data: anonymous analytics about how visitors use the site, and event data about affiliate-link clicks and ad-slot impressions needed to operate the recommendation engine.

• Session identifier. An anonymous cookie (lde_sid) is set on the first request. It is HttpOnly, SameSite=Lax, 30-day TTL, contains no name, email, or identifier traceable back to you, and is used only to deduplicate affiliate clicks and ad impressions per session.
• Hashed IP address. When you click an affiliate link or trigger an ad impression beacon, your IP address is SHA-256 hashed with a server-side salt and truncated to 32 characters before storage. The raw IP is never written to disk. The hash cannot be reversed to recover the original IP.
• User agent and referrer. Standard browser-supplied strings, stored alongside the hashed IP, used to filter out bots from analytics.
• Page path + slot identifier. Which page you were on and which ad slot or affiliate slot you interacted with. No personal content from the page is stored — only the URL path (e.g. /cost-of-living/madrid).

We do not collect: names, emails, phone numbers, payment information, precise location, device fingerprints, or contact lists. We do not run server-side rendered personalization based on reader identity. There is no account system, no newsletter, and no contact form — the only way to send us personal data is to email us directly, in which case we hold your message and address for as long as needed to deal with it.

Why we process it, and on what legal basis

Article 6 GDPR requires a specific legal basis for each purpose. Ours are:

Providing this data is neither a statutory nor a contractual requirement. You can refuse the consent-based categories and the site works normally.

How long we keep it

• Session cookie (lde_sid) — 30 days from the last request, then it expires from your browser on its own.
• Click and impression events — retained in aggregate for as long as the site publishes revenue reporting. The hashed IP attached to each event is not reversible, so what remains after the session window is statistical rather than personal data.
• Consent preference — stored on your device for up to 24 months, after which the banner asks again.
• Emails you send us — kept while the matter is open and then for as long as needed to evidence how a correction or a rights request was handled.

Retention by Google (Analytics and AdSense) and by our hosting provider is governed by their own schedules, linked in the next section.

Third-party services

Mundevo uses the following third-party services, each subject to its own privacy policy:

• Google AdSense — displays advertisements, acting as an independent data controller for the ad data it collects. AdSense uses cookies to personalize ads based on your browsing history when you consent. Google's ad-policy page covers what they collect, and you can additionally control ad personalization across all sites at My Ad Center.
• Google Analytics 4 — anonymous traffic analytics. We pass GA4 only the standard pageview and event data; no custom user identifiers. Google privacy policy.
• Affiliate partners — currently Wise, SafetyWing, Holafly, NordVPN and NordPass. When you click one of their links, you leave Mundevo and they apply their own tracking as independent controllers. Each partner has its own privacy policy linked from their sign-up flow. If the partner list changes, this page is updated with it.
• Vercel — hosts the site. Receives standard server access logs.
• Turso (libSQL) — stores the click and impression events described above. No reader-identifying data is written.
• Google Fonts — the Inter typeface is loaded from Google's CDN, which means your browser's IP address is visible to Google when a page loads.

We do not sell personal data, and we do not share it with anyone beyond the processors and independent controllers listed here.

Transfers outside the EEA

Google, Vercel and Turso are US-headquartered, so data handled by them may be processed outside the European Economic Area. Those transfers rely on the safeguards in Chapter V GDPR: the EU–US Data Privacy Framework where the recipient is certified under it, and the European Commission's Standard Contractual Clauses otherwise. You can request a copy of the safeguards applied to a specific transfer by writing to mundevocom@gmail.com.

Your rights

Under Articles 15–22 GDPR you have the right to request access to your personal data, its rectification, its erasure, restriction of processing, data portability, and to object to processing based on legitimate interest. Where processing rests on consent, you may withdraw that consent at any time without affecting the lawfulness of what happened before the withdrawal.

One honest caveat about how far those rights can reach here: because we hold no identifiers, there is generally nothing tied to "you" specifically to retrieve or delete. The hashed IP cannot be reversed, so even we cannot look up your individual records. Article 11 GDPR covers exactly this situation — where a controller can no longer identify a data subject, the access, rectification, erasure and portability rights do not apply unless you supply additional information enabling identification.

To exercise a right, email mundevocom@gmail.com. We respond within one month, extendable by two further months for complex requests, and we will tell you if that extension applies. If you want bulk deletion of all events from a specific IP range during a specific window, say so and we will action it.

There is no automated decision-making producing legal or similarly significant effects on you, and no profiling of individuals. The algorithm that chooses which partner appears on a page reacts to the page's topic, not to who is reading it.

If you believe we have handled your data unlawfully you can lodge a complaint with the Agencia Española de Protección de Datos (AEPD), or with the supervisory authority of the EU member state where you live or work. You are not required to contact us first.

Cookies

Under Article 22.2 LSSI-CE, only strictly necessary storage may be used without your consent; everything else waits for the banner. Mundevo's own code sets exactly one cookie:

Analytics and advertising scripts load in Google Consent Mode v2 with every category denied by default, so nothing is stored on your device until you choose. You can change or withdraw that choice at any time:

Change cookie preferences

The optional Build a Nation mini-game also uses your browser's local storage to keep your in-game progress on your device. It is never sent to our servers, and clearing your browser's site data resets it.