Bosques — Privacy Policy

DRAFT — NOT LEGAL ADVICE. Prepared by the legal-compliance agent for internal review. A qualified lawyer (Spanish data-protection practice) must review this before it is published. A Spanish-language version should be published alongside the English one, since the primary audience is in Spain.

Last updated: 2026-07-13 (draft)

The short version

Bosques has no accounts and runs no analytics of its own. We operate no server that receives or records what you search for — the site is a static page.

The tool is free and funded by advertising shown through Google AdSense. Google is a third party that may set cookies and process personal data (including your IP address and, with your consent, ad-personalisation signals) to serve and measure ads. In the EEA/UK you are asked for consent, through a Google-certified consent message, before any non-essential cookies are set, and you can change or withdraw that choice at any time.

Separately, the app fetches public map and satellite data directly from your browser from several third-party services. Like any web request, those services receive your IP address and the specific request (for example, the town you typed or the map area you are viewing). This policy explains every one of these flows honestly.

Who is responsible (data controller)

[OPERATOR NAME — natural or legal person publishing the site] Contact: [email address] [Postal address / registration details if operating as a business — required by Spanish LSSI-CE Art. 10; see compliance report]

For the limited processing described below (causing your browser to contact third-party services so the app can work), the operator acts as controller of that decision. We never receive, store, or see your data ourselves.

What happens when you use the app

When you use Bosques, your browser — not our server — contacts:

None of these requests include your name, email, account, or any identifier beyond what every web request carries. The towns you look up say nothing about where you are — we never ask for your location and the app never uses browser geolocation.

Each of these services processes requests under its own privacy policy: Opendatasoft, OSMF/Nominatim, NASA. We chose keyless public services and send them the minimum a request needs; we cannot control their server logs.

Advertising (Google AdSense)

This site shows ads served by Google AdSense. Google acts as an independent data controller for the personal data it processes through the ads; its handling is governed by Google's Privacy Policy and How Google uses information from sites that use its services.

• Cookies and identifiers. Google and its ad partners may read and set cookies (and use similar identifiers) to serve ads, cap frequency, detect fraud, and — where you have consented — personalise ads based on your interests and previous visits to this and other sites.
• Consent in the EEA/UK. Before any non-essential advertising cookies are set for visitors in the EEA/UK, a Google-certified consent message (CMP) asks for your consent and records your choice. If you refuse, ads are limited to non-personalised ads (which still need cookies for basic functions such as frequency capping and fraud prevention, on the legal basis Google relies on) or are not shown. You can reopen the consent message and change your choice at any time.
• Your controls. You can review and turn off ad personalisation at Google Ad Settings, and opt out of many vendors at youronlinechoices.eu and optout.aboutads.info.

Legal basis (GDPR)

• Advertising cookies and ad personalisation: your consent (Art. 6(1)(a) GDPR and Art. 22.2 LSSI-CE), collected through the Google-certified consent message before non-essential cookies are used. Google may rely on its own legal bases for strictly-necessary ad-serving functions such as fraud prevention.
• Fetching public map/satellite data (transmitting your IP to the services below to deliver what you explicitly request): legitimate interest (Art. 6(1)(f) GDPR) — a free public-information tool with no backend must fetch public data directly from its sources, there is no less intrusive way, and we store nothing.

Note on NASA GIBS and Google (USA): some requests reach services operated in, or transferring data to, the United States. For NASA this happens because you request satellite imagery only NASA provides; for Google it relies on its own transfer safeguards. [LAWYER REVIEW: Chapter V position for the US-government recipient and for Google transfers — see compliance-report.md §4.]

Cookies and local storage

• Advertising cookies (Google AdSense): set by Google/its partners as described above, only after consent in the EEA/UK. These are the reason this site now shows a consent message.
• Strictly-necessary technical cache: the app may keep a small technical cache (a color lookup table and your last search) in your browser's sessionStorage so the app functions smoothly. It is deleted automatically when you close the tab, never leaves your device, and contains no identifiers — this falls under the "strictly necessary" exemption of ePrivacy/Art. 22.2 LSSI, so no consent is required.
• No first-party tracking or fingerprinting by us.

What we never do

• No accounts, logins, or email capture.
• No analytics or audience measurement of our own (v1). If this ever changes, this policy will be updated before it goes live.
• We do not ourselves sell or share your data — the advertising data flows are Google's, described above and governed by Google's policies and your consent choices.
• No browser geolocation, ever.

Your rights

Under the GDPR and the Spanish LOPDGDD (Ley Orgánica 3/2018) you have rights of access, rectification, erasure, restriction, objection, and portability. Because we store nothing about you, there is usually nothing to access or erase — but you can always contact us at [email] and we will answer within one month. You may also complain to the Agencia Española de Protección de Datos (AEPD), www.aepd.es. To exercise rights against the third-party services listed above (their server logs), contact them directly via the links given.

Changes

If the app ever adds features that change this picture (e.g., analytics or donations), we will update this policy and the "last updated" date before the change ships.