Privacy Policy

Last updated: September 2026

This Privacy Policy explains how freeaitokens.net ("we", "our", "us") collects, uses and protects information when you visit our website or use our waitlist subscription service. It is written to comply with the EU General Data Protection Regulation (GDPR) and the Spanish Data Protection Act (LOPDGDD).

1. Data controller

The data controller is: Miguel Juan Ruiz Igualada (individual).
Address: C/Salzillo, 7.
Country: ES.

For any privacy-related request you can contact us atlegal@freeaitokens.net.

2. Data we collect

Depending on which features you use, we may collect:

• Name and email address — for waitlist, account, service and billing communications.
• Consent and policy-acceptance records — purpose, status, timestamp, source and policy/version where applicable.
• Waitlist/subscription status — for example pending, confirmed, unsubscribed, Free or Premium entitlement state.
• Locale / region — if provided or required to localise the service.
• Social sign-in data — identity provider, provider account identifier and limited profile/email data returned by Google or Microsoft for authentication.
• Billing references and tax/location information — internal entitlement and external customer/subscription references, billing country/address and tax ID where required for checkout or tax treatment. Full card details are handled by Stripe and are not stored by the Site.
• Technical and security data — IP/network information, user agent, request/security logs and anti-abuse signals where needed to operate and protect the service.

We do not sell, rent or share your personal data with third parties for their own marketing purposes.

3. Purpose and legal basis

• Waitlist management — to process your subscription, send double opt-in confirmation, and manage your waitlist status. Legal basis: consent (Art. 6(1)(a) GDPR).
• Security and abuse prevention — to protect the service against automated abuse. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Technical operation — server logs processed by our hosting infrastructure for security and operational purposes. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Premium account and contract administration — to authenticate users, maintain subscription entitlements, record contractual acceptances and provide service/billing communications. Legal basis: performance of a contract or steps requested before entering into a contract, and compliance with legal obligations where applicable.
• Optional marketing — only where separately consented to; withdrawal of marketing consent does not cancel the account or block necessary service/security/billing messages.

4. Data retention

• Waitlist data — retained as long as your subscription remains active or until you request erasure. After unsubscribe, only records required for compliance, security, suppression or audit purposes are retained for the applicable period.
• Technical logs — retained only as long as necessary for security and operational purposes.

5. Service providers and third parties

We use third parties for specific functions. Their legal role may vary by processing activity:

• Brevo — transactional email delivery, delivery events, bounces, complaints and suppression handling.
• Google — Google social sign-in when selected by the user; Google Analytics 4 through consent-gated Google Tag Manager; and Google AdSense / Google's consent-management tools when advertising is enabled.
• Microsoft — social sign-in when selected by the user.
• Stripe — payment processing, subscriptions, Customer Portal, fraud controls and, when enabled after the applicable tax-registration gate, automated indirect-tax calculation.
• Cloudflare — Turnstile bot/abuse protection and DNS/security infrastructure used by the Site.
• Hosting/infrastructure providers — server, network, backup and operational services needed to deliver and secure the Site.

Each provider processes data under its applicable contractual and privacy terms. We limit data shared to what is reasonably necessary for the relevant function.

6. International transfers

Some of our service providers may process data outside the European Economic Area. Where this occurs, we ensure appropriate safeguards are in place (e.g. Standard Contractual Clauses or adequacy decisions) in compliance with Chapter V of the GDPR.

7. Your rights

Under the GDPR and LOPDGDD, you have the right to:

• Access your personal data.
• Rectify inaccurate data.
• Request erasure of your data.
• Restrict processing in certain circumstances.
• Object to processing based on legitimate interest.
• Data portability where applicable.
• Withdraw consent at any time (without affecting the lawfulness of processing before withdrawal).
• Lodge a complaint with the Spanish Data Protection Agency (AEPD — aepd.es).

To exercise any of these rights, contact us atlegal@freeaitokens.net.

8. Unsubscribe

Every email includes an unsubscribe link. You may also request removal by contacting us at legal@freeaitokens.net. Unsubscribing removes you from future waitlist or marketing communications. Required service, security or billing communications for any future paid subscription are managed separately.

9. Cookies and tracking

Optional analytics are managed through Google Tag Manager and remain disabled unless you explicitly accept analytics. Before that choice, the Site does not request the GTM container or Google Analytics 4 and analytics storage remains denied. Cloudflare Turnstile may use technical mechanisms needed for bot and abuse detection. Advertising consent is managed separately from analytics consent. See our Cookie Policy for the current categories, controls and third-party technologies.

10. Advertising and Google AdSense

When advertising is enabled, the Site may use Google AdSense and, if later disclosed here, other advertising vendors or networks. Third-party vendors, including Google, use cookies or similar technologies to serve ads based on a user's prior visits to this Site and/or other websites. Google's use of advertising cookies enables Google and its partners to serve ads based on visits to this Site and other sites on the Internet.

For EEA, UK and Switzerland traffic, we use a Google-certified consent management platform integrated with the IAB Transparency and Consent Framework when required for AdSense. The consent interface exposes the applicable vendors, purposes and available choices. Advertising consent remains separate from our analytics control. Users may also manage personalised advertising through Google's own settings. If additional advertising vendors or networks are enabled, this policy and/or the CMP will identify them or provide access to their disclosures before activation.

11. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be published on this page with an updated revision date.