Privacy Policy

Data Controller

KARBON MEDIA, S.L.
Av. Maisonnave 41, 3B, 03003 Alicante, Spain
CIF: B26948828
Data Protection contact: [email protected]

1. Information We Collect

We collect the following types of information:

• Account data: email address, username, and encrypted password when you register
• Payment data: processed securely by our payment processor; we do not store credit card numbers
• Usage data: pages visited, videos viewed, IP address, browser type, and device information
• Cookies: strictly necessary cookies for authentication and CSRF protection

2. Legal Basis for Processing (GDPR)

We process your data based on:

• Contract performance: to provide the Service and manage your account
• Legitimate interest: to prevent fraud, ensure security, and improve the Service
• Legal obligation: to comply with applicable laws
• Consent: for non-essential cookies (if applicable)

3. How We Use Your Information

• To provide and maintain the Service
• To process payments and manage subscriptions
• To verify age eligibility
• To detect and prevent fraud or abuse
• To comply with legal obligations (including 18 USC 2257)

4. Information Sharing

We do not sell your personal information. We may share data with:

• Payment processors: for transaction processing
• Infrastructure providers: Cloudflare (CDN/security), BunnyCDN (content delivery)
• 2257 Custodian of Records: 2257Sentry, LLC (as required by US federal law)
• Law enforcement: when required by law or to protect our rights

5. Data Storage and Security

Your data is stored on secure servers within the European Union, protected by encryption in transit (TLS 1.2/1.3) and access controls. Passwords are hashed using industry-standard algorithms and never stored in plaintext.

6. Cookies

We use strictly necessary cookies for authentication and security (CSRF protection). These cookies are essential for the Service to function and do not require consent under EU law. We do not use third-party tracking, analytics, or advertising cookies.

7. Your Rights (GDPR / EU)

Under the General Data Protection Regulation, you have the right to:

• Access the personal data we hold about you
• Rectification of inaccurate data
• Erasure ("right to be forgotten")
• Restrict processing of your data
• Data portability in a machine-readable format
• Object to processing based on legitimate interest
• Withdraw consent at any time
• Lodge a complaint with the Spanish Data Protection Agency (AEPD)

To exercise these rights, contact: [email protected]. We will respond within 30 days.

8. Data Retention

We retain your personal data for as long as your account exists. Upon account deletion, we remove your personal data within 30 days, except where retention is required by law (e.g., transaction records for tax purposes, 2257 records).

9. International Transfers

Your data may be processed outside the EEA by our infrastructure providers (Cloudflare, BunnyCDN). These transfers are protected by Standard Contractual Clauses (SCCs) or adequacy decisions as required by GDPR.

10. Minors

The Service is strictly for adults aged 18 and over. We do not knowingly collect data from minors. If we learn that we have collected data from a person under 18, we will delete it immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice on the Service.

12. Contact

KARBON MEDIA, S.L.
Av. Maisonnave 41, 3B, 03003 Alicante, Spain
[email protected]

Supervisory authority: Agencia Española de Protección de Datos (AEPD)