Privacy Policy

Last updated: August 2026

At Fotolista.es we take our users' privacy seriously. This policy explains what data we collect, how we use it, and what your rights are under the EU General Data Protection Regulation (GDPR) and the UK GDPR.

1. Data controller

2. Data we collect

Fotolista.es only collects the data strictly necessary to provide the service:

• Images you upload: the photos you upload to generate a listing are sent directly to the AI API for analysis. They are never stored on any server of ours.
• Account data: if you sign up, we store your email and your password (encrypted, never in plain text) so we can identify you and manage your subscription.
• Generated listings: we store the text result (title, description, price, condition) linked to your account, so you can check your history. The image itself is never stored — see the point above.
• Anonymous browsing data: IP address, browser type, pages visited and session duration, collected anonymously and in aggregate through analytics tools.
• Advertising cookies: if you have advertising enabled in your browser, Google AdSense may set its own cookies to show personalised ads (see section 6).
• Contact data: if you get in touch with us by email or WhatsApp, we'll only use the data you provide to respond to your query.

3. Purpose of processing

• Analysing uploaded images to generate optimised titles, descriptions and prices.
• Creating and managing your user account, including email verification and password recovery.
• Improving the performance and user experience of the service.
• Showing contextual advertising through Google AdSense.
• Responding to enquiries and support requests.

4. Legal basis for processing

• Performance of a service (Art. 6.1.b GDPR): processing your image and your account data is necessary to provide the service you requested, including managing your subscription.
• Legitimate interest (Art. 6.1.f GDPR): anonymous analytics to improve the service.
• Consent (Art. 6.1.a GDPR): for personalised advertising cookies.

5. Recipients and international transfers

Uploaded images are sent to the Google Gemini API (Google LLC, US) for AI processing. Google provides adequate safeguards under the GDPR's international transfer framework. We do not share your data with third parties for their own purposes.

Advertising is managed by Google LLC through Google AdSense. You can read Google's privacy policy at policies.google.com/privacy.

Verification and password-reset emails are sent through Brevo (Sendinblue SAS, France), within the EU. You can read its privacy policy at brevo.com/legal/privacypolicy.

6. Cookies

Fotolista.es uses the following types of cookies:

• Essential cookies: required for the basic operation of the site. These don't require consent.
• Analytics cookies: collect anonymous data about site usage to help us improve the service.
• Advertising cookies (Google AdSense): used to show relevant ads. You can opt out at adssettings.google.com.

Essential cookies are always active, as they're necessary for the site to work. For advertising and analytics cookies, we ask for your consent via a banner when you first visit; you can accept or decline them at any time by clearing this site's browsing data in your browser.

7. Data retention

Uploaded images are not stored after processing. Your account data (email, encrypted password) and your history of generated listings are kept for as long as your account stays active; if you request to close it, they are deleted within 30 days. Contact data is kept for as long as needed to handle your enquiry, and for a maximum of 1 year. Anonymous browsing data is kept for 26 months.

8. Your rights

Under GDPR, you have the right to:

• Access: find out what data we hold about you.
• Rectification: correct inaccurate data.
• Erasure: request deletion of your data.
• Restriction: restrict processing in certain cases.
• Portability: receive your data in a structured format.
• Objection: object to processing based on legitimate interest.

You can exercise these rights by contacting us at fotolista09@gmail.com. As the data controller is based in Spain, you can also file a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD), at www.aepd.es. If you're based in the UK, you can alternatively contact the Information Commissioner's Office (ICO) at ico.org.uk.

9. AI-generated content

Fotolista uses artificial intelligence (Google Gemini) to analyse your photo and generate titles, descriptions, estimated prices and keywords. These are automatic suggestions, not professional advice or a guarantee of accuracy. Always review and validate the content before publishing on Wallapop, Vinted or any other platform — you know your item better than the AI does.

It's normal for the AI to make mistakes occasionally, especially with unusual items, unfamiliar brands, or condition details that are hard to see in a photo. If you spot a clear error, please report it via contact so we can improve.

10. Security

We take appropriate technical and organisational measures to protect data against unauthorised access, loss or accidental destruction, in line with Article 32 of the GDPR.

11. Changes to this policy

We may update this privacy policy at any time. The last-updated date will always be visible at the top of this page. We recommend checking it periodically.

If you have any questions about this policy, email us at fotolista09@gmail.com or message us on WhatsApp at +34 747 40 64 65.