Privacy policy

Just An Hour (itsjustanhour.com) is run by David O'Mahony, an individual based in Barcelona, Spain, who is the data controller for the personal details you give us. That means deciding how they're used, and being responsible for looking after them.

For anything to do with your personal data, email privacy@itsjustanhour.com.

When you create an account and use the site, we collect:

• Account details: your name, email address and password. Your password is stored scrambled (hashed), so nobody, including us, can read it.
• Profile details: where you're based (Barcelona and, if you choose, your district, or another town), your date of birth, your mobile number, the causes you're interested in, and when and how often you're free to volunteer.
• Applications: which organisations you apply to, the roles you pick, any note you write, and the status of each application.
• If you sign in with Google: your name and email address from your Google account. We never see your Google password.
• Technical information: our hosting and database providers automatically record basic information such as your IP address, browser type and the time of each request, to keep the service running and secure.

We don't ask for more than we need, and we don't collect sensitive information such as health details, religion or political views. Please don't include them in your application notes.

Data protection law (the EU General Data Protection Regulation, or GDPR, and Spain's Organic Law 3/2018) says we need a legal reason, called a legal basis, for each use of your details.

• To create and run your account, show you organisations and send your applications to the organisations you choose. Legal basis: performing our agreement with you (GDPR article 6(1)(b)).
• To send you emails you need, such as confirming your email address, resetting your password or confirming a change of email. Legal basis: performing our agreement with you.
• To check you're old enough to volunteer through the site (16 or over). Legal basis: performing our agreement with you, and our legitimate interest in keeping the service safe.
• To keep the site secure, prevent misuse and fix problems. Legal basis: our legitimate interest in running a safe, working service (GDPR article 6(1)(f)).
• To meet legal obligations, for example if a public authority makes a valid request. Legal basis: legal obligation (GDPR article 6(1)(c)).

We don't send marketing emails, we don't use your details for advertising, and we don't make automated decisions about you.

Organisations you apply to. When you apply, the organisation receives your name, email address, mobile number, age, location, causes, availability, the roles you picked and your note, so they can get in touch and find the right role for you. Only the organisations you apply to receive your details. Once they have them, each organisation is responsible for how it uses them under its own privacy policy, as a separate data controller.

Service providers who help us run the site. They only process your details on our instructions and under data processing agreements:

• Supabase, which stores our database and handles sign-in. Your data is stored in the European Union (Ireland).
• Resend, which sends our account emails. Emails are sent from the European Union (Ireland).
• Vercel, which hosts the website.
• Google, only if you choose to sign in with Google.

We never sell your personal details, and we don't share them with anyone else unless the law requires it.

Your account and profile are stored in the EU. Some of our service providers are based in the United States and may process limited information, such as technical data, there. Where that happens, the transfer is protected by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses, as the GDPR requires.

• While your account is open, we keep your details so the service works.
• If you delete your account (in Settings), your account, profile and applications are deleted from our database straight away. Copies may remain in our providers' backups for a short period before they're overwritten.
• Technical logs kept by our providers are deleted automatically after a limited time.
• Organisations you've applied to keep the details they received for as long as their own policies say.

You have the right to:

• See the personal details we hold about you, and get a copy.
• Correct details that are wrong. You can edit most of them yourself in My profile.
• Have your details deleted. You can delete your account yourself in Settings.
• Ask us to limit how we use your details, or object to uses based on our legitimate interests.
• Receive your details in a common, machine-readable format so you can take them elsewhere.

To use any of these rights, email privacy@itsjustanhour.com. We'll reply within one month. We may need to confirm it's really you before we act.

If you're unhappy with how we've handled your details, please tell us first so we can try to put it right. You also have the right to complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (aepd.es), or the authority where you live in the EU.

You need to be 16 or over to create an account. We ask for your date of birth to check this. If we learn that someone under 16 has created an account, we'll delete it.

We only use cookies that the site needs to work. We don't use analytics, advertising or tracking cookies, so we don't need to ask for your consent to them.

• Sign-in cookies (names starting with sb-), which keep you logged in. They're removed when you log out.
• A language cookie (jah-locale), which remembers your chosen language, if you change it.

If we ever add other cookies, we'll update this policy and ask for your consent first where the law requires it.

All connections to the site are encrypted. Passwords are hashed, never stored as plain text. Access rules in our database mean each person can only see and change their own details. No security is perfect, but we take reasonable steps to protect your information, and we'll tell you and the authorities if a breach puts your rights at risk, as the law requires.

If we change how we use your details, we'll update this page and the date at the top. If the changes are significant, we'll let you know by email or on the site before they take effect.

Questions or requests about your personal data: privacy@itsjustanhour.com.