Privacy Policy

Last updated: September 17, 2026

1. Who is responsible for your data

Eternally ("we", "us") is the data controller for the personal data described in this policy. If you have any question or request regarding your data, you can reach us at Support@eternally.es.

2. What personal data we collect

When you publish a message, we collect:

• The name you choose to display (which may or may not be your real name).
• The message text you write.
• An optional photo you choose to upload.
• An optional link, if you're publishing a brand/ad message.
• Your IP address, recorded at the time of submission (used for fraud prevention and security).
• A PayPal transaction reference (order ID), used to verify your payment. We do not receive or store your card number, PayPal password, or full billing details — that is handled entirely by PayPal.

We also use a small amount of data stored locally in your own browser (not on our servers) to remember which messages you've already reacted to (❤️), and to recognize a message as "yours" so we can notify you on-screen if you're ever outranked in the Hall of Fame. This local data never leaves your device and is not accessible to us.

3. Why we process your data (legal basis)

• Performance of a contract: we need your name, message, and payment reference to provide the service you're paying for (publishing your message).
• Legitimate interest: we log IP addresses and review content before publishing to prevent fraud, abuse, and illegal content on the platform.
• Consent: we only run Google Analytics (see section 5) if you actively accept it via the cookie banner.

4. Who we share your data with

We use the following third-party services, each of which processes some data on our behalf, under their own privacy and security terms:

• PayPal — processes your payment. See PayPal's Privacy Statement.
• Google Analytics — only if you accept cookies, helps us understand site traffic. See Google's Privacy Policy.
• Hostinger — our hosting provider, which stores our database and files.

We never sell your personal data to anyone, for any purpose.

5. Cookies and local storage

We ask for your consent before loading Google Analytics, using the banner shown on your first visit. If you accept, Google Analytics may set cookies to distinguish visitors and measure site usage. If you reject or ignore the banner, Analytics stays off and no such cookies are set. You can change your choice at any time by clearing your browser's local storage for this site.

Separately, we use your browser's local storage (not a cookie, and not shared with us) to remember your own reactions and your own published messages, purely so the site can work correctly for you across visits.

6. International data transfers

Some of the providers listed above (PayPal, Google) may process data outside the European Economic Area, including in the United States. These providers rely on their own legal safeguards (such as Standard Contractual Clauses) to protect your data in these transfers — please refer to their respective privacy policies for details.

7. How long we keep your data

Because the whole idea of this platform is that approved messages stay published indefinitely, the name, message, and photo you submit are kept for as long as your message remains published. Your IP address and payment reference are kept for as long as needed for fraud prevention and accounting purposes, or until you request their deletion.

8. Your rights under GDPR

If you are located in the European Economic Area (or in a jurisdiction with similar protections), you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data.
• Erase your data ("right to be forgotten") — note that this may mean removing your published message, since the name and message are the data in question.
• Restrict or object to certain processing.
• Portability — receive a copy of your data in a portable format.
• Lodge a complaint with your country's data protection supervisory authority, if you believe we've mishandled your data.

To exercise any of these rights, contact us using the details in section 1. We will respond within the timeframes required by applicable law.

9. Children

This service is not directed at children under 16. We do not knowingly collect personal data from children under that age.

10. Changes to this policy

We may update this Privacy Policy from time to time. The date at the top of this page reflects the most recent revision. Continued use of the platform after a change implies acceptance of the updated policy.

This policy is provided as a good-faith effort to describe our data practices clearly. It is not a substitute for tailored legal advice, and we recommend consulting a qualified professional to confirm full compliance with the laws applicable to your specific situation.