Legal

Privacy Policy

Last updated: 27 July 2026

This policy explains what data Malaga.today collects, why, and how you can exercise your rights under GDPR and the Spanish LOPDGDD.

What we collect

Anonymous analytics: Google Analytics 4 (property G-54F8VC19W2) records page views, country of origin, browser type, and screen size. We do not record IP addresses, browser fingerprints, or cross-site identifiers by default. Google Analytics runs only after you grant consent via the cookie banner, until then no analytics data is sent (consent mode v2 default-deny).

Cookies: Google Analytics cookies (_ga, _ga_) are set on your device only after you accept analytics in the cookie banner. Without consent, no analytics cookies are set. Admin login uses a separate cookie (sales_session). No advertising cookies. No third-party retargeting cookies.

Local storage: Theme preference (light/dark), language preference (en/es/de/fr/sv/no/da/fi/nl/ar), and consent state (mt_consent). Nothing else.

Google Tag Manager: Loads GTM container GTM-W8NF4BJS, which manages tag firing. GTM is blocked from firing analytics or marketing tags until you grant consent.

AI crawler policy

All crawlers allowed. Malaga.today exposes structured JSON-LD on every venue, event, town, and category page, plus an llms.txt and llms-full.txt feed for AI assistants. Search crawlers (Google, Bing, DuckDuckGo), AI search systems (Perplexity, You.com), and AI training crawlers (GPTBot, ClaudeBot, Google-Extended, Applebot-Extended, Amazonbot, Bytespider, CCBot, Meta-ExternalAgent) are all welcome. We log each AI bot hit server-side so we can measure AEO impact in our analytics.

Where venue data comes from

Venue names, addresses, and amenities come from OpenStreetMap (ODbL licensed). Photos are uploaded by venue owners. Stories and tags are added by editors or by owners via the claim flow. We don't sell venue data to third parties.

Your rights

Access: Email us to receive a copy of any data we hold about you.
Rectification: If you find errors in your venue listing, edit it directly via the claim page or contact us.
Erasure: Request deletion of any personal data we hold.
Object to processing: For any processing not covered by legitimate interest or consent.
Withdraw consent: Re-open the cookie banner via the "Cookie settings" link in the footer and change your preferences at any time.

Data retention

Anonymous analytics data is retained for 30 days, then aggregated and deleted. Admin session cookies expire after 7 days. Consent state is kept until you change it or clear your browser storage. Venue profiles persist until you ask us to delete them.

Payments

If you buy a claim plan, payment is processed by Stripe Subscriptions (we do not use PayPal as previously stated, the reference is from an earlier policy version). We don't store your card number. We store your email, billing country, and the plan you're on. Stripe's privacy policy governs the payment data: stripe.com/privacy.

Contact

Data protection enquiries: use the form on the claim page. We respond within 7 days.