This policy explains which personal data FALSUM processes, why it is used, where it is kept and how to exercise data protection rights.
1. Controller
- Controller
- Estefania Garcia Garcia
- Privacy contact
- hello@playfalsum.com
FALSUM is the brand used to present the catalogue and services described on this site.
2. Data, purposes and legal basis
| Activity | Data | Purpose | Legal basis |
|---|---|---|---|
| Orders and returns | Name, email, optional phone number, shipping address, selections, amounts, statuses, issues and audit trail | Record, prepare and deliver orders; handle changes, returns and enquiries | Performance of a contract and compliance with legal duties |
| Newsletter | Email, language and proof of consent | Send publishing news and a weekly mystery case | Consent, withdrawable at any time |
| Subscription confirmation | Email and expiring encrypted token | Confirm that the address belongs to the person requesting subscription | Consent and security of the sign-up process |
| Optional analytics | Pseudonymous identifiers, navigation, campaign source, device and technical metrics | Measure use and performance to improve the site | Prior consent |
| Local previews | Name, email and books selected by the visitor | Show a profile preview or remember interest on this device | Action requested by the visitor; data is not sent to FALSUM |
| Security and hosting | IP address, user agent, requested URL, date and technical connection data | Serve the site, prevent abuse, diagnose errors and maintain security | Legitimate interest in operating a secure service |
We do not request special categories of data or make automated decisions with legal effects.
3. Newsletter and proof of consent
Signing up requires a specific checkbox, a statement that the subscriber is at least 14 years old and confirmation through a link sent to the email address given. The link expires after 48 hours and its contents are encrypted.
After confirmation, Resend retains the email, consent version, request and confirmation dates, web source, language and age statement. We do not store the IP address as part of the proof. Every marketing message includes a simple, free unsubscribe method.
4. Providers, recipients and transfers
- Supabase: database for orders, customers, reader accounts, statuses and audit trails. Data is hosted in London (United Kingdom), which has a European Commission adequacy decision.
- Resend (Plus Five Five, Inc.): emails, contacts, preferences, account access links and double opt-in records. Resend processes and stores data in the United States.
- Vercel: hosting, server functions, content delivery and technical security logs.
- Google sign-in: only when someone chooses their Google account. Google then shares the verified email and name to create or identify the account. No other data is accessed.
- PostHog EU: optional product analytics, the only measurement tool, hosted in the configured European region and enabled only after consent.
Processing terms have been agreed with each provider, sub-processors reviewed and applicable international transfer safeguards documented, including standard contractual clauses where relevant. Personal data is not sold.
5. Retention
- Orders, invoices and returns: during the contractual relationship and then restricted for the periods needed to meet tax, accounting and consumer duties and potential claims.
- Reader accounts: while the account remains active. Access links expire after twenty minutes and are stored encrypted so they cannot be reused.
- Pending subscriptions: the link stops working after 48 hours. Provider delivery logs are retained for the contractually configured period.
- Active subscribers: while the subscription continues.
- Unsubscribes and proof of consent: the minimum information needed to honour the withdrawal and address claims is kept restricted for legally required periods, then deleted.
- Analytics: at most three months in PostHog, and only while consent continues.
- Local data: until the visitor deletes it on this site or clears site data in the browser.
- Technical logs: only as long as needed for security, diagnosis and legal compliance.
6. Your rights
You may request access, correction, deletion, portability, restriction or objection to processing, and withdraw consent without affecting earlier processing. Email the privacy contact in section 1, stating which right you wish to exercise. Additional information may be requested only when needed to verify identity.
Account holders can delete their account through Account. This removes their email, name and access links. Earlier orders remain without an associated account, retaining the identity and shipping details supplied at purchase because tax and accounting law requires retention for the periods in section 5.
You may also complain to the Spanish Data Protection Agency (AEPD).
7. Children
Children under 14 cannot subscribe to the newsletter. Families may view children's content, but sign-up must be completed by someone able to consent. A subscription identified as belonging to a child under 14 will be deleted.
8. Data stored on this device
Account and book-interest previews do not create an account or send those details to our servers. You can remove them now without changing the language or analytics choice.
9. Security and changes
We apply data minimisation, separation of private keys, order access controls, origin checks and limits on data sent to providers. No system is entirely infallible; if a breach occurs, the required assessment and notification procedures will apply.
We will update this policy when processing or providers change. If a change affects the consent previously given, we will request fresh consent where required.
Last updated: 25 September 2026.