Back to home

Privacy policy

Version 2026-05-02. Lost at Night is a citizen-science project developed by Fundación Ibercivis within the framework of the Plan-B project. The principal investigator is Alejandro Sánchez de Miguel (CSIC).

1. Who we are

Data controller: Fundación Ibercivis (NIF G-99409492), C/ Mariano Esquillor s/n, 50018 Zaragoza, Spain. Contact: ethics@ibercivis.es.

2. What data we process

• Account data: email address, username, hashed password.
• Profile data (optional): country, city, biography, profile picture.
• Activity data: control points contributed, time spent, batches and challenges joined.
• Consent records: timestamps for privacy policy acceptance, newsletter subscription, and cookie preferences.
• Technical logs: IP address (truncated), browser metadata, retained for at most 30 days.

3. Purpose and legal basis

Purpose	Legal basis (GDPR Art. 6)
Account management and authentication	Performance of contract (6.1.b)
Storing your scientific contributions	Public interest research / consent (6.1.e / 6.1.a)
Newsletter and project updates	Consent (6.1.a) — opt-in only
Analytics cookies	Consent (6.1.a) — opt-in only
Security and abuse prevention	Legitimate interest (6.1.f)

4. Retention

• Account data: until you request deletion.
• Scientific contributions (control points): pseudonymised and retained indefinitely after account deletion, since they cannot be reasonably attributed to you once disassociated.
• Server logs: 30 days maximum.
• Consent records: kept while your account is active and for 3 additional years for accountability (GDPR Art. 5.2).

5. Recipients and processors

We share your personal data only with the following service providers, all of which act as data processors under written agreements:

• Hosting provider (server infrastructure, EU).
• Email delivery service for transactional emails (verification, password reset) and the optional newsletter.
• OpenStreetMap Nominatim (reverse geocoding of ISS image coordinates) — your IP address is shared only when the map widget is loaded.

6. International transfers

All processors are based within the European Economic Area (EEA). If a transfer outside the EEA becomes necessary, we will rely on Standard Contractual Clauses or other safeguards under GDPR Art. 46.

7. Your rights

Under GDPR Articles 15–22 you may:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Request deletion of your account and associated personal data.
• Restrict or object to processing.
• Port your data in a machine-readable format.
• Withdraw consent at any time (effective from withdrawal, without affecting prior processing).
• Lodge a complaint with the Spanish Data Protection Agency (AEPD).

You can exercise most rights directly from your profile page or by writing to ethics@ibercivis.es.

8. Automated decisions

We do not take any decisions about you based solely on automated processing.

9. Minors

Lost at Night is open to volunteers aged 14 and over. If you are under 14, please ask a parent or guardian to register on your behalf.

10. Updates to this policy

When we make substantive changes we will update the version number above and ask you to re-confirm your consent.