Last updated: October 2026

At JACAR (Jacar Systems S.L.), the controller of jacar.es, we process the minimum personal data needed to publish the site, send the newsletter to people who ask for it and protect the site from abuse. This policy explains what data we process, why, on what legal basis and for how long, under Regulation (EU) 2016/679 (GDPR), Spain’s Organic Law 3/2018 (LOPDGDD) and Spain’s Law 34/2002 (LSSI).

1. Data controller

Jacar Systems S.L. (trading as “JACAR”), owner of jacar.es.

  • Tax ID (CIF): B83631242
  • Registered address: C/ Maquinilla 13D, 7-4, 28031 Madrid (Spain).
  • Registration: Madrid Mercantile Registry, Volume 18773, Book 0, Folio 156, Section 8, Sheet M-327186, Entry 1.
  • Contact: rgpd@jacarsystems.com

2. Data protection officer

Given the nature and scale of the processing, appointing a Data Protection Officer is not mandatory (Art. 37 GDPR). For any matter regarding your data, write to rgpd@jacarsystems.com.

3. What we process

Reading the site needs no account and no data from you. What we process depends on what you do on it:

Newsletter

If you subscribe, we store:

  • Your email address. We do not ask for your name.
  • The newsletter language (Spanish or English), taken from the page you subscribe on.
  • The address of that page and the topic of the form you used, so we know which content brings in subscribers.
  • Your subscription status (pending, confirmed or unsubscribed) and its dates.
  • We do not record which issues you open or which links you click: opens and clicks are only counted in aggregate, never tied to a subscriber.

Subscription is double opt-in: after you send the form you get an email with a link, and you are only subscribed once you click it. When you confirm, we send you a welcome email. Every issue includes a link to unsubscribe or manage your preferences.

Article ratings

If you rate a post or a lab with the stars, we store the rating, the post, the date and time and your IP address. Your browser also keeps a cookie listing the posts you rated (see section 10).

View counter

Each post shows how many times it has been read. The counter uses no cookies and stores nothing in your browser, so it does not need your consent. It does not count visits from bots or from the site’s administrators either.

So that the same read is not counted twice, the server computes a one-way hash of your IP address, your browser and the post. It combines them with a key that changes every day, deletes the hash after 24 hours and does not store your IP address. The only thing kept for good is each post’s total, with no data about you.

Cookieless usage statistics (Plausible)

We measure which pages are read with Plausible Analytics, which we host on our own server (plausible.jacar.es). It uses no cookies or any other browser storage and does not store your IP address. To count unique visitors it computes a hash of your IP address and browser combined with a key that is deleted every 24 hours, so it cannot recognise you the next day. It records the page, the referring page, the browser, operating system and device type, and the approximate country and region. It also records a few interactions without identifying you, for example how far a page is read, loading speed, or a newsletter form submission.

Google analytics (Google Analytics 4)

If you accept analytics cookies, Google Analytics 4 sets its cookies and records the pages you visit, how you interact with them, your device type and your approximate location. Until you accept, the Google tag is not even loaded: your browser makes no request to Google. If you follow a link to jacarsystems.com, measurement may join both visits into one session.

Email enquiries

If you write to us, we process your name, your email address and the content of your message.

Security and server logs

The server automatically logs every request: IP address, date and time, requested page, referring page and browser type. We use this to detect attacks and temporarily block the IP addresses they come from.

To stop automated mass signups, the newsletter form limits attempts per IP address and per email address (the latter kept only as a one-way hash). Those counters expire on their own after one minute and 24 hours respectively. We also keep an audit log of newsletter signups without the full address: only its first letter and the domain.

4. Purposes

  • Newsletter: send you new posts and site news in the right language, confirm your signup, and unsubscribe you when you ask.
  • Ratings: show each post’s average rating, stop one person from voting more than once, and remember the rating you gave.
  • View counter: show how many times each post has been read and highlight the most read.
  • Cookieless statistics: learn which content is read, where readers come from and whether the site loads fast, so we can improve it.
  • Google Analytics: measure site usage in more detail, if you accept.
  • Enquiries: answer your questions.
  • Security: keep the site available, detect and block attacks and abuse, and keep a record of newsletter signups.
  • Consent (Art. 6.1.a GDPR and Art. 21 LSSI): the newsletter, which you confirm with the link in the signup email, and Google Analytics, which you accept in the cookie notice. You can withdraw consent at any time: with the unsubscribe link in any issue or from the cookie notice. Withdrawing it does not affect earlier processing.
  • Steps at your request (Art. 6.1.b): handling the enquiries you raise.
  • Legitimate interest (Art. 6.1.f): site security and its logs, the signup audit log, protecting ratings against duplicate votes, the view counter and Plausible’s cookieless statistics. Our interest is keeping the site secure and knowing which content is useful; we do this without identifying you or building profiles. You can object by writing to rgpd@jacarsystems.com.
  • Legal obligation (Art. 6.1.c): where we must retain data to comply with the law.

6. Retention

We keep each piece of data only as long as necessary for its purpose:

  • Newsletter: while you stay subscribed. If you unsubscribe, we delete your data 30 days later. If you never confirm, we delete it 30 days after the request. You can erase your data yourself from the preferences page linked in every email.
  • Signup audit log: 12 months.
  • Ratings: the rating is kept while the post is published; your IP address is removed from the vote record after 90 days.
  • View counter: the hash that stops a read being counted twice is deleted after 24 hours, and the key used to compute it is destroyed within 48 hours at most. Per-post totals contain no personal data.
  • Cookieless statistics: the key used to count unique visitors is deleted every 24 hours. The statistics left contain no personal data.
  • Google Analytics: 2 months, the shortest period Google Analytics 4 allows.
  • Email enquiries: while we handle your request and for as long as needed to address any resulting liabilities.
  • Server logs: 14 days, then deleted. IP blocks for attacks are temporary.
  • Backups: daily backups are kept for 30 days, weekly ones for 12 weeks and monthly ones for 6 months, then deleted automatically. So data we erase can remain for up to 6 months in an encrypted backup, used only to restore the site after a failure.

7. Recipients

We do not sell or share your data. The newsletter, its delivery, Plausible statistics and email run on servers we manage ourselves, with no third-party services. We use these providers, acting as processors on our behalf:

  • OVH (OVH SAS / OVH Hispano): servers that host the site, the newsletter, Plausible statistics and our mail server, and the database server, all in its Gravelines data centre (France).
  • Hetzner Online GmbH: storage for the site’s images and files (Falkenstein, Germany) and a secondary copy of the backups.
  • Google Ireland Ltd.: analytics (Google Analytics 4), with your consent, and encrypted storage of backups in Google Drive.
  • CrowdSec SAS (France, EU): receives the IP address and the type of attack when the security system blocks a malicious request, to maintain a shared blocklist. It receives nothing about normal browsing.

8. International transfers

Hosting, the newsletter, email and Plausible statistics are processed within the European Union. Google may process analytics data and the encrypted backups through Google group entities outside the EEA. Such transfers rely on the safeguards Google has in place: standard contractual clauses and, where applicable, the EU-US Data Privacy Framework.

9. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw your consent, by writing to rgpd@jacarsystems.com (we may ask you to verify your identity). If you subscribe to the newsletter, you can also do it yourself from the preferences page linked in every email: unsubscribe, download your data or erase it. If you believe the processing does not comply, you may lodge a complaint with the Spanish Data Protection Agency (AEPD).

10. Cookies and browser storage

Analytics cookies (Google’s) are set only if you accept them. The view counter uses no cookies. If you later withdraw consent from the cookie notice, we delete them. The site uses these first-party cookies:

  • jacar_consent (1 year): stores your choice in the cookie notice.
  • jacar_ppp and jacar_mode (1 year): remember how many posts to show per page and the listing mode, only if you change them.
  • yasr_visitor_vote_cookie (1 year): set only when you rate a post, and remembers the rating you gave.

Some features keep settings in your browser’s local storage: light or dark theme, the listing view, the steps you mark as done in labs, your Cintoteca favourites and the settings of the “About” page. This data never leaves your browser and you can clear it from your browser settings. Details are in the cookie policy.

11. Security

We apply technical and organisational measures to protect your data: encryption in transit (HTTPS/TLS), EU hosting, automatic detection and blocking of attacks, limits against mass form submissions, daily encrypted backups and restricted access to information.

12. Children

The site is not directed at children under 14 and we do not knowingly collect their data. If we detect such data, we will delete it.

13. Changes to this policy

We may update this policy to reflect legal or site changes. Any change will be published on this page, showing the last-updated date.