Privacy Policy

Last updated: 22 July 2026

WaterAtlas is an open, non-commercial project currently in an early testing stage. This policy explains, in plain language, what personal data the service collects, why, on what legal basis, and the rights you have under the EU General Data Protection Regulation (GDPR) and Spanish data-protection law (LOPDGDD). We aim to collect as little as possible.

Who is responsible (data controller)

WaterAtlas is operated by an individual based in Spain (see the Legal Notice for contact details; identification is available on request). For any privacy question or request, contact privacy@water-atlas.com.

What we collect

• Account data — if you register: your email address and a securely hashed password (we never store your password in plain text).
• Saved searches & alert preferences — the filter criteria you choose to save and whether you opted in to email alerts.
• Newsletter — if you subscribe: your email address and the date and source of your subscription.
• Essential cookies — a session/authentication cookie (and a matching security/CSRF cookie) so you can stay signed in. We do not use advertising, analytics, or cross-site tracking cookies. Because these cookies are strictly necessary, no consent is required to use them; we show a short cookie notice for transparency only.
• Minimal technical logs — standard server and request logs (including IP address) generated by our hosting provider for security and reliability.

The water-sector project data shown on the map is aggregated from public third-party sources and does not contain your personal data.

Why we use it, and our legal basis

We only process your data to provide and secure the service. Specifically:

• To run your account and store the searches you asked us to save — legal basis: performance of a contract (GDPR Art. 6(1)(b)).
• To send email alerts and the newsletter — legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time (this does not affect processing already carried out).
• To keep the service secure and reliable (technical logs) — legal basis: our legitimate interests (Art. 6(1)(f)) in preventing abuse and maintaining availability.

We do not sell your data, use it for advertising, or carry out automated decision-making or profiling.

Service providers (processors)

We rely on a small number of infrastructure providers that process data only on our behalf, under data-processing agreements:

• Vercel — hosting and deployment.
• Neon — managed database.
• Resend — email delivery (alerts and the newsletter).

Payment processing is not active during the testing stage.

International transfers

The providers above are based in the United States, so your personal data may be transferred outside the European Economic Area. Where that happens, the transfer is safeguarded by the European Commission's Standard Contractual Clauses and/or the provider's certification under the EU–US Data Privacy Framework, as applicable. You can request more detail on these safeguards by contacting us.

Retention

We keep account data for as long as your account exists, and newsletter data until you unsubscribe. You can delete your saved searches at any time from your account, and you can delete your account and all associated data yourself at any time from your account settings — this is immediate and permanent. You can also download a copy of your account data from the same page. Minimal technical logs are kept only for a short period for security purposes.

Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, and port your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time for processing based on it (for example, email alerts or the newsletter — use the unsubscribe link in any message, or contact us). You can exercise most of these directly from your account, or by emailing privacy@water-atlas.com. We will respond within the time limits the law requires.

Right to lodge a complaint

If you believe we have not handled your data correctly, you have the right to lodge a complaint with your local data-protection authority. In Spain this is the Agencia Española de Protección de Datos (AEPD) — www.aepd.es. We would, however, appreciate the chance to address your concern first.

Children

The service is not directed to children and is not intended for use by them.

Changes

As the project is in active development, this policy may change. Material changes will be reflected by updating the date above.