Privacy policy

The controller of the personal data processed on descubrecanarias.com is:

Only what each feature needs. If you browse without an account, we don't ask for any personal data.

• Account: name, email and password (stored hashed, never in plain text). If you sign in with Google or Apple, we receive your name, email and, where applicable, your profile picture.
• Session security: IP address and device or browser type of each open session, to protect your account and detect suspicious access.
• Your activity on the site: favourites, reviews and ratings you publish, and requests to manage a business listing.
• Businesses and paid plans: business and menu details. Payments are processed by Stripe; we never see or store your card details.
• Usage statistics: pages visited and aggregated technical data, only if you accept analytics cookies.
• Technical errors: when something breaks we log technical details of the error, without identifying personal data, so we can fix it.

• Creating and managing your account, sending you the necessary emails (verification, password reset, security codes) and providing the services you request. Basis: performance of a contract (art. 6.1.b GDPR).
• Managing subscriptions and billing for business plans. Basis: performance of a contract and compliance with legal, tax and accounting obligations (art. 6.1.b and 6.1.c GDPR).
• Protecting the site and accounts against fraud, abuse and automated access. Basis: legitimate interest (art. 6.1.f GDPR).
• Detecting and fixing technical errors. Basis: legitimate interest in keeping the service running (art. 6.1.f GDPR).
• Measuring site usage with aggregated statistics to improve the guide. Basis: your consent (art. 6.1.a GDPR), which you can withdraw at any time.

We don't make automated decisions with legal effects on you or build profiles for advertising.

• Account data: for as long as your account is active. If you delete it, we erase or anonymise the data, except what the law requires us to keep.
• Sessions: until they expire or you sign out.
• Billing: for the period required by commercial and tax law (up to 6 years).
• Statistics: up to 14 months in Google Analytics.
• Technical errors: up to 90 days.

We don't sell or hand over your data. To provide the service we rely on providers acting as data processors, under contract and only following our instructions:

• Stripe: payments and subscriptions.
• Resend: sending transactional emails.
• Google: statistics (Google Analytics, only with your consent) and Sign in with Google.
• Apple: Sign in with Apple, if you choose it.
• Cloudflare: anti-bot verification (Turnstile) on sign-in and registration.
• Sentry: technical error logging.
• Mapbox: map display.
• Hosting providers where our servers run.

When you click “Check availability” you leave our site for Viator, which processes your data as an independent controller under its own privacy policy.

We will only disclose data to authorities when required by law.

Some of these providers are based in the United States. Transfers rely on the EU-U.S. Data Privacy Framework where the provider is certified, or on the standard contractual clauses approved by the European Commission.

You can exercise the following rights at any time, free of charge:

• Access: find out what data of yours we process.
• Rectification: correct inaccurate data.
• Erasure: ask us to delete it.
• Objection and restriction: have us stop processing it, or only process it for certain purposes.
• Portability: receive it in a structured format.
• Withdraw your consent, without affecting processing carried out before.

Write to info@quiube.com stating which right you want to exercise. If we can't confirm your identity from your account email, we may ask you to prove it. We will reply within one month at most.

If you feel we haven't handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD).

You must be at least 14 years old to create an account. If you are younger, you need the consent of your parents or guardians. If we find an account belonging to someone under 14 without that consent, we will delete it.

We apply appropriate technical and organisational measures: encrypted connections (HTTPS), one-way hashed passwords, sessions that expire, optional two-step verification and restricted access to data.

If we change anything significant, we will show it on this page with the new update date and, if you have an account and the change affects you, we will let you know by email.