Privacy policy
Updated November 4, 2026
AllTuner Audis collects as little personal data as running the service allows. Its public pages set no cookies, count visits without them, and show no advertising.
Who is responsible
The data controller is the operator named in the legal notice. For anything about your data, write to [email protected].
Visitors
When you open a page or play its audio, the request passes through our servers and our providers', which record:
| What | Why | How long |
|---|---|---|
| Your IP address, the address requested, the time, and your browser's name (access logs) | Keeping the service running and secure: finding faults and stopping abuse | A limited period, then deleted |
| Your IP address, as a counter of recent requests | Limiting how often someone can ask for a sign-in link | Minutes |
| Visit counts: the page, the referring site, your browser, device type and country, without cookies or a stored identifier | Knowing which pages are read | Kept as statistics |
| Error reports when a page fails: the address and browser name, never cookies, tokens or query strings | Fixing the fault | 30 days |
If you choose a language, a cookie remembers it. Nothing else is stored in your browser unless you sign in.
The legal basis is our legitimate interest in operating a secure service and knowing how it is used (Article 6(1)(f) GDPR). We don't use this data to profile anyone, and we don't sell or share it beyond the providers below.
People an institution invites
An institution can share its pages with people it chooses. Staff record each invited person's email address against the institution. To sign in, you give that address and we email you a link that works for 15 minutes; once you follow it, a cookie keeps you signed in for up to 90 days, or until 30 days without a visit, or until you sign out.
We keep your email address while you have access, and use it only to let you in and to send you sign-in links. When an institution removes your access, you can no longer sign in; to have your address deleted, write to us.
The legal basis is the agreement with the institution that invited you (Article 6(1)(b) and (f) GDPR).
Staff
Staff sign in to the backoffice through Cloudflare Access with their work email address. We record which staff member made each change, to keep an audit trail of the service.
Providers
- Hetzner, in the EU, which hosts the servers, the visit counts (Umami, run by us), error reports and logs.
- Cloudflare, which delivers the site and stores the audio and images (R2 storage in the EU). Cloudflare is certified under the EU-US Data Privacy Framework.
- Resend, in the United States, which sends the sign-in emails.
- Google (the Gemini API), which reads the scripts aloud. The scripts are about the institutions' collections and contain no visitor's data.
Your rights
You can ask for access to, correction or deletion of your personal data, object to or restrict its use, or ask for a copy, by writing to [email protected]. If you think we have not handled your data properly, you can complain to the Spanish data protection authority (Agencia Española de Protección de Datos, aepd.es), or to the one of the country where you live.