Privacy Policy
Updated on 26 October 2026
This policy explains how ALCOMADSER S.L. handles data related to CholloDeal. You can browse the catalogue and open offers without creating an account. Purchases and payments take place on Amazon or other retailers, not on CholloDeal.
Data controller
ALCOMADSER S.L.
Calle Marqués de la Valdavia, 95, portal 2, 2.º A, 28100 Alcobendas, Madrid, España
Tax ID: B88063805
Contact: info@chollodeal.com
Browsing and operating the service
When you request a page, image or search, technical providers receive information needed to deliver it and protect the service, such as your IP address, requested URL, date and technical browser information. A URL may include the text entered in a search. Do not enter sensitive information in the search box.
We use this information to serve the website, maintain security and diagnose incidents, based on our legitimate interest in operating a secure service. Technical logs follow the provider's service retention periods and account settings, for as long as needed for those purposes; we do not combine them into a browsing profile of each visitor. A specific incident may require retaining necessary evidence for investigation or legal responsibilities.
Offer clicks: data, purpose and retention
When you open a product link, our server records the product, associated offer if any, date, marketplace, affiliate tag used and a general source category, such as home, catalogue or product page. This record does not store the referring URL, its parameters or searches, free-text campaigns, country, device type, IP address, or any session or visitor identifier.
We measure actual interest in offers and maintain product statistics, based on our legitimate interest in managing the catalogue using limited measurement without identifying people or tracking them across sites. This record is independent of your Google and Vercel analytics choice and does not set cookies. We honour the browser's Do Not Track and Global Privacy Control signals by not recording these clicks. You can also object by contacting us.
Individual click records are retained for 90 days and removed in the next daily cleanup. Before removal, each click is added to its product's total. We then retain only the product identifier and accumulated counter, without individual click information or a breakdown of people, while we maintain catalogue statistics. These are not unique-person counts. Cleanup also removes legacy source, campaign, country, device or session fields remaining in older records.
Cleanup runs in batches. If an incident or backlog prevents completion, remaining records are processed in subsequent runs; failures and incomplete runs are reviewed. Deleting from the active database does not immediately remove an earlier backup: available backups follow their retention cycle and must not be used to restore removed statistics without reapplying cleanup.
Google Analytics and your choice
Google Analytics loads only if you accept analytics. The legal basis is your consent, which you can withdraw in Cookie settings without preventing use of the website. Visits, pages and usage events are measured; Google may receive identifiers and technical browser information. This integration does not use Google Signals or enable advertising storage or personalisation.
Analytics cookies and the choice stored in your browser are configured for 180 days without renewal on visits. The Analytics property's event retention is 2 months and user retention is 14 months; the user identifier's period restarts with new activity and key events follow user retention. These settings do not limit standard aggregated reports. See the cookie policy for details and controls.
Vercel Web Analytics and your choice
Vercel Web Analytics also loads only if you accept analytics, based on your consent, and stops when you withdraw it in Cookie settings. It does not use analytics cookies. Vercel receives technical request information and measures pages, referrals, device, browser and approximate location. We remove query parameters and the fragment from the page URL before sending events; this does not remove the technical logs needed to serve the website.
According to its documentation, Vercel identifies sessions using a hash of the request and discards the visitor session after 24 hours. This session period is not the deletion period for statistical reports, whose availability depends on the provider's service and settings. See its privacy information linked below.
Email enquiries
If you email info@chollodeal.com, we process your address, name if supplied, message and attachments to reply. For a requested service or pre-contractual step, the basis is responding to your request; for other enquiries, our legitimate interest in replying to people who contact us. Information needed for obligations or claims is processed on the corresponding legal bases.
We retain correspondence while needed to resolve the enquiry and address the resulting relationship or responsibilities. It is then deleted or, where required, held with restricted access for applicable statutory periods. An enquiry does not subscribe you to advertising. IONOS provides the email service.
Telegram searches
When you search using the channel's direct messages, the bot receives the text, update identifier, and chat/topic identifiers to respond. A Telegram update may also include the sender's name and identifier; we do not store these as a profile. We use what is needed to provide the search you request and our legitimate interest in preventing duplicate replies and abuse. Telegram is optional; you can browse the website without using it.
The bot sends the reply and link through Telegram. Our deduplication persistence stores HMAC-derived keys rather than search text, names or raw user identifiers. Keys older than seven days are removed when a new request is processed; without new requests they may remain until the next cleanup. Messages kept in Telegram follow its controls, retention and privacy policy. Removing CholloDeal's keys does not delete the chat history.
Providers and international processing
Vercel hosts and serves the application and provides Web Analytics when you consent. Supabase provides the Chollodeal project's PostgreSQL database in eu-west-1, Ireland (European Union). IONOS Cloud S.L.U. provides email and manages the domain. Google provides Analytics when you consent. These providers receive information needed for the services described; disclosures may also be required by law.
Hosting the primary database in Ireland does not mean all processing stays in the EU. Support, operations and subprocessors may involve international transfers. Providers' agreements describe locations and safeguards, including standard contractual clauses where applicable. You can read the linked documents or ask us about safeguards applicable to your situation.
Amazon, images and external links
When you open Amazon, including through Search on Amazon, the search text or destination product is sent together with our affiliate tag. The tag is a link parameter, not a CholloDeal cookie. Rejecting our analytics does not remove it. Amazon determines purchase attribution under its terms and applies its own cookie preferences and privacy policy.
CholloDeal's hosting delivers and optimises catalogue images, mainly sourced from Amazon, and receives technical information needed to serve them. Retailers and external platforms process data under their own policies when you visit them; accepting CholloDeal cookies does not accept cookies on those sites.
Your rights and how to exercise them
You can request access, rectification, erasure, restriction, objection and portability where applicable, or withdraw consent, by emailing info@chollodeal.com or writing to the controller's address. Explain your request and the details needed to locate it. We request further identity information only when necessary to avoid disclosing data to someone else. Withdrawal does not affect the lawfulness of earlier processing.
We generally respond within one month; any legally justified extension is communicated within that period. If a record does not identify you, we explain that limitation without creating additional identifiers solely to identify you. You may complain to the Spanish Data Protection Authority (AEPD). We do not make solely automated decisions with legal or similarly significant effects, or create personal profiles to decide which offers to show you.