Privacy Policy
Version 1.3 · Last updated: 28 October 2026
Applies to the inklan apps for iOS and Android, the organisation portal at portal.inklan.com, the website at inklan.com, and the pages, organisation widgets and calendars at app.inklan.com.
1. Who we are
inklan is run by Javier Peralta Muñoz, trading as inklan ("inklan", "we", "us"), a sole trader established in Spain, at Avenida Arias de Velasco, 14, 29601 Marbella, Málaga, Spain. We are the data controller for the personal data described in this policy. For anything about your data, write to privacy@inklan.com.
2. The data we collect
From you, and from your use of inklan:
- Account and sign-in: your email address, handle and sign-in methods; a password hash if you set a password; your two-factor secret and recovery codes if you turn it on; the devices you sign in on, with their IP addresses; and a log of security events.
- Profile: name, photo, bio, website and links, gender, birth date, hobbies, language and theme, and your visibility settings. Only the handle is required.
- What you create and join: plans, trips, communities and their posts, the people and organisations you follow, the members you block, join requests, invitations, tickets and check-ins, and the reports you file.
- Messages: chats are end-to-end encrypted, so we store only their encrypted content and what we need to deliver them, such as who is in each chat and when messages were sent and read. A link in a message reaches our server, which fetches its preview.
- Payments: for tickets, the amount, status and Stripe's references, never your card number; for organisers, the Stripe account you connect and the sales made on it; for Premium, your subscription status.
- Location: only when you use a feature that needs it: your position, read once, when you open Explore or choose an area for Events near you; the places you search for; and the area you choose. We do not track your location.
- Organisations: name, registration or tax number, addresses, members and roles, verification, and single sign-on settings.
- Usage and technical data: the days you used inklan, when you last opened the app and your time zone, your notifications, push tokens, crash reports, records of your requests to the assistant (never what you asked or what it wrote), and server logs.
- Website and shared links: your IP address and browser details; on inklan.com, the pages you visit and the links you click, counted without storing anything on your device.
- Consent choices: the versions of the Terms and this policy you accepted or were shown.
From others:
- Google or Apple, if you sign in with them: your name, email address and, from Google, your picture.
- A member or organisation that invites you by email: your email address.
- Find friends: a member who allows access to their contacts sends up to 60 email addresses from their address book to check which belong to members. We do not store them.
- Your organisation's sign-in provider, if it uses single sign-on to the organisation portal: your identity.
What the apps and the website store on your device is in the Cookie Policy.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Providing inklan: your account and sign-in; plans, trips, communities and messages; tickets, their checkout, refunds and check-in; organisers' payouts; Premium and invite rewards; the organisation portal and its tools; and telling an organisation and its hosts who bought a ticket for its plans, and what they paid | Contract — Art. 6(1)(b) GDPR |
| Service emails and notifications. You can turn off reminders, summaries, Events near you and activity notifications in Settings → Notifications; sign-in codes, security alerts, receipts and notices of changes to these documents always reach you | Contract — Art. 6(1)(b) |
| Security: spotting unusual sign-ins, checking new passwords against known breaches, rate limits, free-tier limits, and recording who invited whom so that invite rewards are not abused | Legitimate interests — Art. 6(1)(f): protecting accounts and the service |
| Moderation: handling reports, and checking new and edited plans and trips for illegal content before they are published | Legitimate interests — Art. 6(1)(f): keeping members safe; and legal obligation — Art. 6(1)(c), under the EU Digital Services Act |
| Usage statistics from our own records, and counting visits to the website | Legitimate interests — Art. 6(1)(f): understanding how inklan is used, so we can improve it |
| Crash reports, feature settings and minimum-version checks in the apps. You can turn crash reports off in Settings → Privacy & data | Legitimate interests — Art. 6(1)(f): keeping the apps working |
| Recommending communities and things to join, and showing an organisation the members who keep coming to its plans | Legitimate interests — Art. 6(1)(f): making discovery useful, and helping organisations recognise their regulars |
| Sending an invitation email to someone a member or organisation invites | Legitimate interests — Art. 6(1)(f): letting members invite the people they choose |
| Keeping payment records | Legal obligation — Art. 6(1)(c): Spanish commercial and tax law |
| Establishing, exercising or defending legal claims | Legitimate interests — Art. 6(1)(f) |
To have an account you must give us an email address, or use Google or Apple, choose a handle, and confirm that you are at least 18. Everything else is optional. Without a birth date you cannot join plans or trips that have an age limit.
4. Who receives your data
- Other people on inklan, as the features show them: your profile, to members and guests, within your visibility settings; your participation, to the people in the plans, trips and communities you join; your messages, to the members of the chat. The hosts and organisations that run a plan or trip you join see who is going, check tickets in, refund them and can export the attendee list with names and handles. The member whose invite code you signed up with sees your first name and photo.
- The organiser who sells you a paid ticket. It is sold on the organiser's own Stripe account, so the organiser sees what you enter in Stripe's payment form, such as your name, email address and card details, and holds them as an independent controller.
- Service providers that process data for us under a data processing agreement: hosting, in the European Union; payments; app stores and subscription management; push notifications, crash reports and app settings; sign-in with Google and Apple; email delivery; place search; AI models, for the assistants and for checking plans and trips for illegal content, which receive no name, handle, email address or user ID; event listings; and website visit counting. The app stores, and Stripe for what it collects from organisers, act as independent controllers.
- Services your device contacts directly, which see your IP address: map images, the name of your area in Explore, the typeface, pictures of events, trips and cities from the sites that host them, and the preview picture of a link in a chat.
- Authorities and advisers, where the law requires it; and a company that takes over inklan, after we tell you.
We do not sell your personal data. You can ask privacy@inklan.com for the names of our providers.
5. Transfers outside the European Economic Area
Our servers are in the European Union. Some providers process data in the United States or the United Kingdom. For the United Kingdom we rely on the European Commission's adequacy decision. For the United States we rely on the provider's certification under the EU-US Data Privacy Framework where it has one, and otherwise on the Commission's Standard Contractual Clauses. Services your device contacts directly may answer from servers outside the European Economic Area. You can ask privacy@inklan.com for a copy of the safeguards.
6. How long we keep it
| Data | How long |
|---|---|
| Your account, profile, connections, blocks, invites, consent records and moderation records, the Stripe accounts you connect, and what you created | While your account exists |
| Direct chats | While your account exists. A deleted message loses its content at once |
| Messages in plan, trip, city and community chats | Three months after they were sent. A plan or trip chat closes when the plan or trip ends, and what is left is deleted 30 days later |
| Your Explore city of the month, your Events near you area, your key backup, push registrations, and when you last opened the app | Until you change, turn off or remove them, or delete your account |
| Sign-in sessions | Up to 90 days after the session ends |
| Security log | 12 months |
| Usage statistics: the days you used inklan, and website visits | 13 months, and 12 months |
| Counts about an organisation's plans and trips, which name nobody | Up to 400 days |
| Notifications | 30 days |
| Records of assistant requests, and ticket scans refused at the door | 90 days |
| That you filed a report | Six months after it is decided |
| Server logs and traces | Up to 30 days |
| Link previews, and failed-attempt and rate-limit counters | 6 hours, and a few minutes |
| Payment and refund records, and an organisation's Stripe accounts | 6 years from the end of the financial year, as Spanish commercial and tax law requires |
| The record that an account was erased | 540 days |
| The identifier of an erased account | Kept, with only the time of the erasure, so that a delayed message cannot bring the account's data back |
| Database backups | 14 days, rolling |
When you delete your account, we erase or irreversibly anonymise your data within 30 days, except what the law requires us to keep. Deleted data leaves our backups within 14 days. What you added to shared spaces, such as a plan you hosted or a community post, may stay without your name. Deleting your account does not cancel a Premium subscription bought from Apple or Google: cancel it in your store account.
7. Your rights
You can ask us to give you access to your data, to correct or erase it, to restrict or object to its processing, and to give it to you in a portable format. You can withdraw a consent at any time, without affecting what was done before. You can get a copy of your data by email in Settings → Privacy & data, and delete your account in Settings → Account → Delete account. For anything else, write to privacy@inklan.com. We reply within one month. For complex requests we may take two months more, and tell you so within the first.
You can complain to the Agencia Española de Protección de Datos (www.aepd.es), or to the supervisory authority of the EEA country where you live.
8. Automated decisions
Before a plan or trip is published, and when it changes, an automated check refuses it if it clearly organises, sells or promotes something illegal. You can change it and try again, or write to support@inklan.com to have a person review it. We take no decision with legal or similarly significant effects on you by fully automated means.