Privacy policy

Data controller

LEVART STONES is currently an independent project. The controller's full identifying details will be published as soon as the project adopts a definitive legal form.

Contact for any privacy or data protection matter: travel@levartstones.com.

General principle: take part without an account

You do not need to register or create an account to use LEVART STONES. We do not ask for your real name, phone number or postal address.

To log a stage all you need is a name or nickname, a photo and a location. The email address is always optional in that case.

What data we process and when

Depending on how the platform is used, we may process:

• When creating a stone: the stone's name and story, its mission and destination, the photo provided, the starting location, a contact email and the data associated with the payment.
• When logging a stage: the name or nickname entered, the photo of the find, the optional message, the location, the date and, if provided, the email.
• When requesting email updates: the email address, the preferred language and the subscription status.
• When you write to us: the content of the message and the address it was sent from.
• Technically: minimal records needed for the operation, security and abuse prevention of the platform.
• With your consent: aggregated browsing data through analytics tools (see the Cookie Policy).

Location: exactly what gets published

Location is the heart of the project: without it there is no journey to tell. That is why it is worth understanding how it works.

A location can be obtained in two ways: by sharing your device's geolocation (with your explicit browser permission) or by manually typing the city, country or a specific place.

The recorded location is published on the stone's public map exactly as provided. If device geolocation is used, the published position will be as precise as the device reports it: it is not shifted, rounded or hidden.

For that reason we recommend recording the location at the place where the stone is found or left, rather than from a home or other private place. If you would rather not publish a precise point, type a city or a public place along the route manually.

LEVART STONES does not perform any continuous device tracking: we only process the one-off location a user chooses to provide for each action.

Photographs

Uploaded photographs are part of the stone's public route and are shown on its page.

We recommend photographing the stone and the place, avoiding identifiable people. If they appear, whoever uploads the image must have their consent; for children, that of their parent or guardian.

Anyone can request the removal of a photograph by writing to the contact given in this policy.

Legal bases for processing

Each processing activity relies on a specific legal basis:

• Performance of a contract or pre-contractual steps: activating a stone, handling the payment and delivering its QR and PDF.
• Consent: publishing the stage with the photo, nickname and location provided; subscribing to new-stage notifications; analytics and functional cookies. Consent can be withdrawn at any time.
• Legitimate interest: content moderation, platform security, abuse prevention and service improvement, always in a proportionate way.
• Compliance with legal obligations: retention of tax and accounting information linked to payments.

What information is public

LEVART STONES is built on publicly sharing the routes of the stones. The following is public:

• the name, story, mission and photo of every published stone;
• the name or nickname of whoever logs a stage;
• the photo, message, date and location of every approved stage.

What is never public

The following are never published:

• email addresses;
• payment data;
• the contact details of whoever creates a stone;
• internal technical and moderation information.

Children

LEVART STONES is also designed to be enjoyed as a family, and children can take part accompanied by a responsible adult.

Minors must not provide personal data, share their location, upload photos or make payments without the help and authorisation of their parent or guardian. Under Spanish law, consent for children under 14 must be given by their legal representative.

If we detect a child's data provided without that authorisation, we will delete it. Deletion can also be requested through the contact in this policy.

Providers processing data on our behalf

To run the service we rely on technology providers acting either as processors or as independent controllers of their own tools:

• Lovable Cloud: application hosting, database and photo storage.
• Stripe: processing of stone activation payments. LEVART STONES does not store card details.
• Resend: delivery of transactional emails (confirmations, new-stage notifications and internal alerts).
• Google: Google Analytics 4 (analytics, only with consent) and AI services used for on-demand translation of user-contributed texts.
• Microsoft: Clarity (usage analytics, only with consent).
• OpenStreetMap and its geocoding service: map rendering and conversion of place names into coordinates.

International transfers

Some of these providers may process information outside the European Economic Area. In those cases the safeguards set out in the GDPR are used, such as the standard contractual clauses approved by the European Commission.

Data retention

Published content (stones and approved stages) is kept while the project is active, as it forms part of the public account of the journey.

Email addresses used for notifications are kept until unsubscription is requested. Tax information linked to payments is kept for the legally required periods.

Moderation and security data is kept only for as long as strictly necessary.

Your rights

You can request access, rectification, erasure, restriction, portability and objection to the processing of your data, and withdraw your consent at any time.

To exercise them, write to travel@levartstones.com stating what you need and, where relevant, the specific stone or stage.

You may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you believe your request has not been handled properly.

Changes to this policy

This policy may be updated if the project's features or providers change. The date of the latest update appears at the top of the document.