Finca 4 Caballos

Privacy Policy — Finca 4 Caballos App

Version: 14 July 2026. This policy covers the “Finca 4 Caballos” Android app (gate control and sensor display) and its programming interface (API).

1. Controller

FILL IN: name, postal address (Gran Canaria, Spain) and contact e-mail of the controller.

Controller within the meaning of the GDPR: [NAME], [POSTAL ADDRESS], e-mail: [CONTACT E-MAIL].

2. What data we process

Account: login identifier, display name, role. Passwords are stored exclusively as Argon2id hashes, never in plain text.
Login sessions: time, IP address, device label and app version — to protect against unauthorised access. Access and refresh tokens are stored as hashes only.
Gate operations (security log): who opened or closed the gate and when, including IP address and outcome. Required to protect the property (legitimate interest, Art. 6(1)(f) GDPR).
Guest access codes: label, validity and uses of each code including time and IP address of redemption. Codes are stored as HMAC hashes only.
Sensor data: battery voltage, temperature, gate state and similar — pure device data without personal reference.
Diagnostic data: only if you actively submit it via the support function.

Location data: the current app version does not collect location data. A future optional feature (“auto-open on approach”) will only ever be enabled with the explicit, revocable consent of the person concerned (Art. 6(1)(a) GDPR) and will be described in this policy before introduction.

3. Push notifications

The Play Store version uses Google Firebase Cloud Messaging (FCM). Google receives a device push identifier; transfers to the USA are based on the EU Standard Contractual Clauses. Message content is deliberately minimal (e.g. “Gate opened”) and contains no names and no location data. Every notification type can be switched off individually in the settings.

4. Recipients and processors

Server hosting: own server in the EU. FILL IN: hosting provider/location of vm120.
The Things Industries (LoRaWAN sensor network, EU cluster) — device data only.
Google Ireland Ltd. / Google LLC (Play version only: FCM push).

5. Retention

Gate and access logs: [12 months — CONFIRM], then deleted.
Login sessions: until logout or expiry, then [90 days — CONFIRM].
Account: until account deletion.
Sensor data without personal reference: unlimited (archive).

6. Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR), and the right to lodge a complaint with a supervisory authority — the competent authority is the Spanish Agencia Española de Protección de Datos (www.aepd.es).

Delete your account: in the app under “More → Delete account”, or by e-mail to [CONTACT E-MAIL]. Deletion removes the account, sessions and personal links; logs required by law or for security are deleted once the retention periods above expire.

7. Security

Encrypted transport (TLS), hashed passwords and tokens, role-based permissions, logging of security-relevant events, and documented technical and organisational measures under Art. 32 GDPR.

Legal notice

FILL IN (LSSI-CE, Spain): operator name, address, e-mail, NIF/NIE where applicable.

[NAME] · [POSTAL ADDRESS] · E-mail: [CONTACT E-MAIL]