Privacy and cookies

Who is responsible

José Luis Saorín Ferrer, NIF (Spanish tax ID) 79081262V, with registered address at Santa Cruz de Tenerife (Spain) and reachable at jl@joseluissaorin.com. He is the author of Andarama, an open-source program (EUPL-1.2), and maintains andarama.com, the hosted instance. The owner's details are also in the legal notice.

Cookie-free analytics

To know how many people visit the site we use Plausible, a European service that sets no cookies, stores no IP addresses and does not identify anyone across visits. It counts page views and a few anonymous events (for example, that a tool was used). That is why there is no cookie banner: there is nothing to accept.

Tours published with Andarama carry the same kind of analytics: aggregated visits, scenes and hotspots, without cookies and without IPs.

If you arrive from an ad

When someone reaches andarama.com from a Google ad, the address carries a click identifier (gclid, gbraid or wbraid) and sometimes campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content). Only in that case does a notice appear asking whether you let us tell Google, so we know whether the ad works. Anyone arriving any other way sees no notice.

• If you say yes, the click identifier, the campaign parameters and the page you landed on are kept in your browser's session storage (cleared when you close the tab) and added to the links to app.andarama.com. If you then start the trial, request a demo or pay for a plan, we record it together with the identifier and report it to Google Ads from our server, with user-data and personalisation consent marked as granted, solely to measure the ad.
• If you say no, the click identifier is discarded and only the campaign parameters are kept, which say which campaign you came from but do not identify you. Nothing is sent to Google.

We do not install the Google tag or any advertising cookie: everything goes through our server. The legal basis is your consent, which you can withdraw at any time by writing to jl@joseluissaorin.com. The identifier is used for at most 90 days from the click. Google (Google Ireland Limited) processes what it receives under its own privacy policy.

Accounts and payments: Clerk

If you create an account on app.andarama.com, sign-up, sign-in and plan billing are handled by Clerk. Clerk stores your email, your name if you give it, your sign-in method and billing details; to keep you signed in it uses technical cookies, which are essential for the application to work. Tours, media and everything you create are stored in Andarama's own database, not in Clerk. Clerk is a United States company: this data is processed there, with the safeguards for international transfers that Clerk provides in its data processing agreement. Card payments are processed by Stripe through Clerk; Andarama never sees your card number.

Infrastructure: Cloudflare

andarama.com is served from Cloudflare (Workers, D1, R2 and KV). The database (D1) and the media you upload (R2) are located in Western European data centres. The code runs on Cloudflare's network, in the data centre closest to the visitor, and some short-lived technical data (KV) is replicated across the network. Cloudflare processes requests as a data processor and may keep technical logs for a limited time for security.

Data processors

These are the companies that process data on behalf of andarama.com:

• Cloudflare, Inc. (United States; database and media in Western Europe): hosting, database, storage and abuse protection.
• Clerk, Inc. (United States): accounts, sign-in and plan billing, with Stripe as payment processor.
• Plausible Insights OÜ (Estonia, European Union): cookie-free visitor analytics.
• Resend, Inc. (United States): sending transactional email (account notices and replies to demo requests).

And, only if you accept the ad notice, Google Ireland Limited receives the click identifier and the conversion, as explained above.

The free tools

The 360 viewer, the little planet maker and the cubemap converter run entirely in your browser. The images you open with them are not uploaded to any server: they never leave your computer. We only record, without identifying you, that the tool was used.

Demo forms and email

If you request a demo or a proposal from the training, universities or museums forms, we store your name, your institution, your email, your message, the language and the page you wrote from (and, if you accepted the ad notice, the click identifier), in order to reply to you. The legal basis is your own request. It is kept for as long as the conversation lasts and for two years at most. Accounts receive transactional email (verification, invitations, plan notices), never advertising.

Your rights and how to delete your account

You can request access, rectification, erasure, portability, restriction and objection by writing to jl@joseluissaorin.com.

To delete your account and everything you have created, email us from the account's address. We delete the account in Clerk and the tours, publications and media from Andarama's database and storage, and confirm it by email within 30 days at most. Signing out or removing access from the app's profile does not by itself delete your tours, which is why full deletion is requested by email. Before that, if you like, export what you have made: you can do so at any time as a ZIP or as an .andarama file.

If you believe something is not being done right, you can lodge a complaint with the Spanish Data Protection Agency, AEPD (aepd.es).

Changes

If this policy changes, the date is noted here. Last revision: 27 September 2026.