1. Controller
The controller is Andrés Miguel Quintero González, tax ID 15479556G, at Valencia, 46025, España. Privacy contact: andresquinterospain@gmail.com.
2. Data we process
We may process the identifier and handle of the connected X account, its public profile image, the artists you follow, the artist selected for Starter Fan Points or a purchase, transaction amount and status, technical Stripe identifiers, timestamps, support communications and basic technical data needed for security and operation. We retain the X identifier, selected artist and Founding Fan number to prevent duplicate free claims and preserve the badge. X authorization is used only to confirm the public account identity; FanRank does not retain the X access token after verification is completed. We also record aggregate events for X connection, artist selection, Starter Points claims, checkout, payment and reward use. FanRank does not receive or store your full card number.
When you use a personal invitation link, FanRank stores the referring handle in browser local storage for 30 days and records the visit, landing path and attributed first purchase pseudonymously. To manage rewards, we link the internal X account identifiers of the referrer and invited fan, the qualifying transaction, reward status and the artist selected when it is claimed. Public profiles show only aggregate referred-visitor and buyer totals.
If you accept analytics cookies, Google Analytics 4 may process visited pages, traffic source, country or approximate location, device type, browser and interactions such as artist selection or following, Starter Points claims, checkout start and payment confirmation. FanRank does not send your X handle or full payment details to Google, and Google signals and personalised-advertising features remain disabled.
Your handle, artist, Fan Points, badges, verification status and position are public. The handle links to the corresponding public X profile. Do not submit information you do not want displayed.
3. Purposes and legal bases
We process data to take payment, deliver and maintain the requested service, publish and order the ranking, handle refunds and support, measure aggregate usage and conversion, prevent fraud, protect the platform and comply with accounting, tax and legal duties.
- Performance of the contract requested by you.
- Compliance with legal obligations.
- Legitimate interests in security, fraud prevention, legal defence and operational improvement.
- Consent where specifically required.
4. Recipients
Stripe processes payments. X provides authentication for the connected account. OpenAI/Sites and Cloudflare provide publishing, security and hosting infrastructure. Google provides the optional Google Tag Manager and Google Analytics 4 services when a visitor accepts analytics cookies. These providers process data under their applicable terms and policies. Data may be disclosed to authorities where legally required.
5. International transfers
Some providers may process data outside the EEA. Where required, recognised GDPR safeguards are used, such as adequacy decisions or standard contractual clauses.
6. Retention
Transaction and invoicing records are retained for legally required periods. Public ranking records remain while needed to operate the service and preserve its integrity, unless deletion is appropriate. Followed-artist preferences remain until you unfollow them or request erasure. The X connection expires automatically after 30 days and can be removed earlier using the disconnect option. Support information remains for as long as needed to resolve the request and address potential liability. Identifiers used to limit abuse have a short technical expiry. Pseudonymous analytics events are periodically deleted once they are older than 90 days.
7. Your rights
You may request access, rectification, erasure, objection, restriction or portability by emailing andresquinterospain@gmail.com. You may also complain to the Spanish Data Protection Agency at aepd.es. Erasure may be restricted where retention is legally required or necessary for legal claims.
8. Minors and security
Fan Points purchases are intended for people aged 18 or over or otherwise legally capable of contracting. We use reasonable safeguards, although no Internet-connected system can guarantee absolute security.