Privacy policy

8. If you create an account to build your website

In addition to the above, edeck.me processes the data of people who sign up to create and manage their site:

• Your account: name, email and password (stored irreversibly; nobody can read it). We use them to give you access to the panel and to send you what is necessary (verifying your email, recovering your password, the status of your subscription). Legal basis: the service contract.
• The IP address you sign up from: we store it encrypted, together with a fingerprint that does not reveal it, to stop automated sign-ups and sign-ups that use someone else’s email. It is only looked at to investigate abuse and it is deleted after 90 days. Legal basis: our legitimate interest in protecting the service and the people who receive its emails.
• Your subscription: the plan and its status. Payment is processed by Stripe; your card details go straight to Stripe and edeck.me neither sees nor stores them. Legal basis: the contract and tax obligations.
• Platform emails are sent through the mail server of IONOS, which acts as a data processor.
• The platform backups (the databases and files of every website, with the data in this section and that of each shop’s customers) are stored every day with Backblaze, Inc. (a United States company), in its European Union data centre (Amsterdam), as a data processor. They are encrypted on our server before being sent, with a key that only edeck.me holds: Backblaze stores the files but cannot read them. We keep 30 daily, 8 weekly and 12 monthly copies, so a deleted item may remain in them for up to about 12 months; if a backup ever has to be restored, it is deleted again before being served. They are only used to restore the service if something fails. Legal basis: for your account data, our legitimate interest, and the security obligation of Art. 32 GDPR, in not losing it; for the data of websites and their customers, we keep it as each owner's processor (section 11 of the publishing rules).
• Your site’s content (texts, images, products) and your customers’ data in your shop (their orders, their balance and what they send you through your forms) are stored by you on edeck.me. For that data, you are the controller and edeck.me is your processor: it only stores and serves it so that your website works. Your customers’ account belongs to edeck.me (section 10): you see their orders in your shop and their account details from the moment they become your customers, never the ones they place in other shops or in which other shops they buy. This applies while your website exists; if it is deleted, see section 11.
• If your website is permanently deleted: we keep a copy of your seller details, the ones your website published on its legal pages (name or company name, tax ID, address, email, phone and registration details, only those you had filled in), and show it to the people who bought from you, next to their orders, so they know whom to claim against. It is kept with no deletion deadline. We also keep your shop’s orders and the messages from your forms (the latter, until they are a year old). Section 11 explains this, including how to object.
• Support access to your panel: if you need help or there is a problem with your website, edeck.me staff may view your panel exactly as you see it, in read-only mode (nothing can be changed) and for 30 minutes at most each time. Each access is recorded with its reason and we send you an email at that moment. Legal basis: the service contract.
• Visits to your site are counted by edeck.me with Umami, hosted on its own servers, with no cookies; only if the visitor accepts analytics cookies in your site’s notice, a random code is also stored in their browser for 13 months to know if they come back (it is deleted if they withdraw their permission). The IP address and browser are used on the spot to work out the approximate country, region and city and a pseudonymous visitor code that changes every month; the IP address is not stored and that code does not reveal who the visitor is or follow them to other websites. You see the statistics in your panel. It does so on your behalf, as a processor, under section 11 of the publishing rules, and the cookie and privacy policies your site generates explain it to your visitors. For itself, edeck.me only uses aggregated figures per site (for example, total visits), which identify nobody, to run and improve the service. So that your own visits are not counted, while you use the panel your browser keeps a technical cookie, vs_notrack, for one year, and an equivalent mark in the local storage of your own site when you open it from the panel; they contain no personal data and you can delete them whenever you want.
• In the edeck.me panel (sign-in, sign-up and billing) we also measure, with Umami, cookie-free and in aggregate, the sign-up steps —creating the account, confirming the email, choosing a plan, completing payment and publishing— to see where people drop off and improve the process. Your IP is not stored and you are not identified.
• If you delete your account: you do it from your panel, in Account and security ("Delete my account"), with your password, once you no longer have any website (you delete them first from Billing, "Delete this site"). If there is nothing left that we must keep, we delete it entirely. If there is something (the history of your charges, a website in the trash or already deleted, orders or a balance as a buyer, a moderation decision), the account is closed: your sessions are closed and it can no longer be used to sign in, but your data is kept together with what must be kept, with its own periods (for charges, those set by law; for shops, those in sections 10 and 11). If you later come back with the same email and reset your password, you get back the same account with its history. Legal basis: compliance with legal obligations and our legitimate interest in keeping that history and handling claims. You can object by writing to us at the address in the contact section, and we will delete what does not need to be kept.

9. The artificial intelligence demo

If, when creating your site, you use the “Your website with AI” step, we send to DeepSeek, an artificial intelligence provider whose servers are in China, the data you type in that form: your business name, the kind of website, what you do, the location if you give it, your products or services if you give them and the tone you choose.

• Purpose: only to generate the design and the texts of your website demo.
• Legal basis: your consent, given by using that step. It is optional: you can skip it and build your website step by step without sending anything.
• What we do not send: your email, your password, payment data, or any data about your website’s visitors or customers.
• International transfer: as China does not have an adequacy decision from the European Union, the transfer is based on your explicit consent for this specific purpose. Do not type third parties’ personal data in that form.

10. If you buy in a shop made with edeck.me

If you create an account in a shop made with edeck.me, that account belongs to edeck.me and works in every shop made with edeck.me, with the same email and password.

• Controller: edeck.me is the controller of the account (email, password stored irreversibly, first and last name, phone, ID document and address if you give them, saved addresses, cart and favourites). The owner of each shop is the controller of each order, of your balance in that shop, of your customer record in it, of your permission for its notices and offers and of what you send through its forms, as explained in its privacy policy; edeck.me stores it on their behalf, as a processor. edeck.me and each shop are not joint controllers: each one answers for its own part.
• What we use the account for: to give you access in any shop, to fill in your details when you buy and to show you, in your profile in any shop, the orders you placed in all of them. Only you see that list, signed in and with your email verified: each shop only sees its own orders and does not know in which other shops you buy. And when you become a customer of a shop (by creating the account in it or by signing in with it), we pass on your account details to it so it can manage its relationship with you. Legal basis: the account contract, that is, the account terms you accept when you create it (Art. 6(1)(b) GDPR).
• Record of your acceptance: the version of the terms, the date, the shop, the IP address and the browser. Legal basis: our legitimate interest in being able to prove it (Arts. 6(1)(f) and 7(1) GDPR). It is kept even if you delete the account, for as long as claims about it can be brought.
• If you sign in with Google or Facebook: we receive your name and email from them (from Google, only if it treats it as verified), and nothing else; we do not post anything on your behalf.
• Retention: for as long as you keep the account. If you delete it, your orders stay in each shop, which must keep them by law (for example, for invoicing), but no longer linked to the account.
• If a shop closes: when its owner cancels it and it is deleted, edeck.me keeps your orders in that shop, with their payments, and the record of your balance in it. You can still see the orders you placed with your account in "My orders" in any other shop made with edeck.me (with your email verified), together with the details of whoever sold to you, so you know whom to claim against. We will send you the rest (the orders you placed without an account, their payments and the record of your balance) on request, as evidence. From then on, edeck.me is the controller. Legal basis: our legitimate interest in you not losing your purchase history. They are kept with no deletion deadline, also if you delete your account or bought without one: they are your purchase history and what allows us to help you or contact you again if a problem arises with one of them. When the shop is deleted, we tell you by email. You can object by writing to us, and we will delete them unless they are needed for an ongoing claim. Section 11 explains this in detail.
• Your rights: about the account, write to us at the address in the contact section; about an order, to the shop where you placed it (if it has closed and been deleted, to us).

11. If a website made with edeck.me is deleted

While a website or shop is on edeck.me, its owner is responsible for the data of its visitors and customers, and edeck.me only stores it on their behalf (section 8). When its owner cancels it and the website is permanently deleted (section C12 of the terms of service), edeck.me does not delete everything: it keeps what its customers may need so as not to lose the information about their purchases, to know whom to claim against, to ask for help or for us to contact them if a problem comes up. From that moment, edeck.me is the controller of that data.

• Orders: the shop’s orders, payments, balances, coupons and products, as explained in section 10.
• Form messages (data subjects: the people who wrote to the website): what was sent through its forms, that is, the form fields and the email address for the reply. Purpose: to help whoever sent it if they ask us for help, for a copy of their message or for confirmation that they sent it (for example, if they wrote to the shop and got no answer), or to contact them if a problem comes up with what they asked for. They are not shown to anyone or used for anything else. Retention: they are deleted one year after they were sent, the same period they had while the website was active.
• Seller details (data subjects: shop owners): a copy of the owner’s details that the website published on its legal pages (legal notice, privacy, terms of sale): name or company name, tax ID, address, email, phone and registration details, only those filled in, and nothing else from those pages. We also keep the shop’s currency, which is not personal data. Purpose: so that people who bought in the shop know who sold to them and can claim against them (the guarantee, withdrawal, a return, an invoice) or ask them for help. Who sees them: buyers with an edeck.me account and a verified email, in “My orders” in any other shop made with edeck.me, next to their orders from the closed shop; people who bought without an account get them from us if they ask, after we check that they placed an order in that shop. While the website is in the trash, before it is deleted, the details it has at that moment are shown. Retention: no deletion deadline. They are kept because buyers may need them for as long as they keep their orders, and the seller may object (section 11).
• Legal basis: the legitimate interest (Art. 6(1)(f) GDPR) of buyers and of the people who wrote to the website in not losing their information and being able to make a claim or ask for help, and ours in being able to help them. We have weighed this against the rights of the people concerned: we keep only what is essential, for the period stated for each item (orders with no deletion deadline, because they are the purchase history of whoever bought and what allows us to help them), and show it only to those who need it; messages are shown to no one, and the seller details are the ones the seller had to publish on their website in order to sell (Art. 10 of the Spanish Information Society Services Act, Law 34/2002).
• Your rights: you can ask us to access this data, correct it, erase it or restrict its use, and object to us keeping it, by writing to the address in the contact section. If you object (for example, as an owner, to us keeping your seller details), we will stop processing it unless there are compelling legitimate grounds that override your interests, such as an order that can still be claimed or a claim in progress, or it is needed for the establishment, exercise or defence of legal claims (Arts. 17(3)(e) and 21 GDPR); we will tell you what we decided and why. You can also complain to the Spanish Data Protection Agency.
• Backups: what is deleted may remain in the encrypted backups for up to about 12 months, as explained in section 8.

12. If you report content

Anyone can tell us about content that is illegal or breaks the publishing rules with the Report content form or by email.

• What data: your name and email (except in reports of child sexual abuse, which can be anonymous), the address of the content, the rule and your explanation, and an encrypted fingerprint of your IP address, not the IP itself.
• Purpose and legal basis: to handle the report, acknowledge it and tell you our decision, as Article 16 of the Digital Services Act (Regulation (EU) 2022/2065) requires (legal obligation, Art. 6(1)(c) GDPR); the IP fingerprint, to stop abusive submissions (legitimate interest, Art. 6(1)(f)). If the report concerns a possible criminal offence, we process it under Articles 16 to 18 of that Regulation (Art. 10 GDPR).
• Who sees it: the edeck.me team. We do not give it to the owner of the reported website unless it is strictly necessary (for example, if you report as the holder of an intellectual property right) or required by law, and only to the authorities when the law requires it.
• Retention: the IP fingerprint is deleted after 90 days; the report and the decision are kept for 3 years after it is resolved (the limitation period for very serious infringements of Spanish Law 34/2002), after which your name, email and explanation are removed.
• Your rights: those in the contact section, and complaining to the Spanish Data Protection Agency.