Privacy policy

Controller: Cucha (cucha.org)

Email: privacidad@cucha.org

Cucha (cucha.org) is a web and mobile platform for managing animal shelters, foster homes and pet adoptions.

• Account: name, email, phone number (if you provide it), language and encrypted password.
• Sign-in with Google, Apple or Facebook: if you choose this option, that provider gives us your name, your email and, if available, your profile photo. We never receive your password and we never post on your behalf.
• Adoption or foster profile: preferences, experience with animals, details about your home and, for an adoption, your ID document (DNI/NIE) and the potentially dangerous animal licence where the law requires it.
• Foster homes: we only show your postcode or neighbourhood; your full address is never shown to other users.
• Shelters: details of the organisation and its team, animal records (including clinical data), applications, tasks, messages, documents and invoicing.
• People a shelter records even if they have no Cucha account: members, sponsors and donors (name, tax ID, address, contact details, contributions and donation certificates), volunteers (contact details, usual days and time slots, start and end dates, signed volunteer agreement, insurer and policy number with its validity, and hours worked), feral cat colony caretakers (contact details and accreditation, in the same record as their volunteering) and whoever reports a rescue (name and phone number).
• Enquiries from a shelter's public showcase: name, email, phone number (if you provide it) and your message, with your consent.
• Social media: if a shelter connects its Facebook Page or Instagram account, we store its ID and an encrypted access token to publish the animal profiles the shelter chooses.
• Technical data: IP address, device, operating system, app version, error logs and our own usage metrics.
• Location: only with your permission and while you use the app. Approximate, to show you nearby shelters or animals; precise, only if you manage feral cat colonies and mark a colony's spot, which only your organisation's staff can see.

• Providing the service (performance of a contract, Art. 6(1)(b) GDPR): managing your account, connecting you with shelters, processing adoption and foster applications, messaging and service notifications.
• Legal obligations (Art. 6(1)(c) GDPR): adoption contracts, animal welfare law (including feral cat colony management), donation certificates, and tax and accounting obligations.
• Legitimate interest (Art. 6(1)(f) GDPR): security, fraud prevention, fixing errors and improving the service with aggregated data.
• Consent (Art. 6(1)(a) GDPR): location, push notifications, showcase enquiries and non-essential communications. You can withdraw it at any time in Settings.

Cucha may calculate a compatibility score between your profile and an animal to help the shelter, but every adoption decision is always made by a person at the shelter. We do not make automated decisions with legal effects on you.

You only see animals from shelters you are linked to (by invitation, link or code). When you send an application, that shelter receives the data it needs to assess it. Data a shelter manages about its animals, adopters, foster homes, volunteers, members, colonies and caretakers is that shelter's responsibility; Cucha processes it on the shelter's behalf as a data processor. If a shelter records you without you having a Cucha account, the shelter must inform you and handle your rights requests, although you can also write to us.

A shelter can create temporary links for third parties (its vet clinic, a local council or a caretaker's card). These links only show what is strictly necessary: never phone numbers, emails or a colony's location, and only the last 4 digits of a microchip.

We do not sell your data or share it for advertising. We only disclose it to authorities when the law requires it.

• Supabase: database, authentication and storage (servers in the EU).
• Vercel: website hosting.
• Resend: sending emails.
• Expo: mobile push notifications.
• Google Maps Platform: maps and address search.
• Google, Apple and Meta (Facebook and Instagram): only if you sign in with them or the shelter connects its social media accounts.

Some of these providers are US companies. Any transfer outside the European Economic Area is covered by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses.

For as long as your account is active. When you delete it, we erase or anonymise your data without undue delay, except what the law requires us to keep (for example, invoices and donation certificates for the statutory tax periods). Backups are rotated periodically.

Data a shelter manages belongs to that shelter: it decides how long to keep it and when to delete it. Cucha uses it for nothing other than providing the service and, if the shelter leaves Cucha, hands it over in open formats and then deletes it.

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to privacidad@cucha.org. You can also delete your account in Settings. If you are an adopter, foster home or volunteer of a shelter, you can also contact that shelter.

If you are not satisfied with our answer, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

We encrypt communications (HTTPS/TLS), restrict access by role with security policies in the database itself, and store third-party tokens encrypted. No system is infallible: if a breach affects you, we will notify you as required by law.

We only use technical cookies and local storage, needed to keep you signed in and remember your preferences (language, theme). We do not use advertising or third-party tracking cookies.

Cucha is not intended for children under 14. You must be an adult to adopt or foster an animal.

If Cucha stops operating, we will give at least 60 calendar days' notice, by email and in the app, to shelters, foster homes and users with an active account. During that period you can download your shelter's data or your profile in open formats (CSV, PDF, JSON) from the Export centre. After that period, we will delete any data we are not legally required to keep.

If we change this policy in a significant way, we will let you know by email or in the app.