Política de privacidad

Version 2026-11-06. Effective on publication. Published at sargassumcheck.com/privacy and beachsignal.com/privacy and linked from every footer and from the photo tool before you send anything.

---

The short version

• There are no accounts, no passwords, no payments and no advertising. We do not ask who you are.
• We count page views and partner-link clicks on our own server with Cloudflare Workers Analytics Engine; it sets no cookies, stores no IP address and does not fingerprint your device; we see totals only.
• Where a page shows hotel offers through the Stay22 embed, your browser loads it from Stay22, which sees your IP address and may set its own cookies.
• Your browser contacts our host (Cloudflare) and, when a map is open, OpenStreetMap's tile servers. "Use my location" is resolved on your device and not sent to us.
• If you send a beach photo, we store it privately with its capture time and place, may send it to Google's Gemini service for automated condition analysis, and never publish the original. One anonymous cookie limits abuse of the photo tool. You can have the photo deleted with its receipt number.
• When an AI assistant calls our connector, we process its tool inputs for the request without storing them; Cloudflare keeps request metadata (section 3a).
• Booking links lead to other companies, which may set their own cookies, including affiliate cookies that tell them we referred you.
• We do not sell personal data, share it for advertising, or use your photos to train AI models unless the permission you accepted when you sent them says so (section 4).
• Wherever you live, you can ask us what we hold about you, have it corrected or deleted, and complain to a regulator.

---

1. Who is responsible

The data controller is Waffle Corp., a Delaware corporation, 2093 Philadelphia Pike #2073, Claymont, DE 19703, United States, operating sargassumcheck.com and beachsignal.com under its Terra Continua and BeachSignal brands.

Contact: contact@sargassumcheck.com — for anything in this policy, for requests about your data, for photo withdrawal and for legal notices. There is no data protection officer; the law does not require one for processing of this size and kind.

2. What this policy covers

This policy covers sargassumcheck.com, map.sargassumcheck.com, beachsignal.com, their data feeds and the operator pages. It describes the Service as it runs on the version date. A flow that is switched off is marked as such; when a flow is switched on or changed, this policy changes in the same release and its date moves.

3. Browsing the map and planner

• No account, no identity. You do not need an account. We do not ask for your name or email to use anything.
• Visit counting. When our server answers a page or a partner-link click, it adds one data point to Cloudflare Workers Analytics Engine: the page or link, the referring site, an approximate country and the device type (phone or desktop). It sets no cookies, runs no script in your browser, stores no IP address or identifier and does not fingerprint your device, so there is nothing to opt out of; we read only totals.
• Hotel offers (Stay22 embed). Where a page shows hotel offers through Stay22, an embed is loaded by your browser from Stay22's servers only when that part of the page is shown. Stay22 receives your IP address, browser details and the page address, and may set its own cookies, under its own policy (stay22.com/privacy). Pages without the embed send nothing to Stay22.
• Hosting. The site runs on Cloudflare (Workers, D1 database, R2 storage) in the United States. Like any host, Cloudflare processes your IP address and request details to deliver the pages, cache them and protect the site from abuse, and may set its own security cookie (for example __cf_bm) to tell people from bots. We use that cookie for nothing.
• Hotel photos. Hotel photos load in your browser from the hotels' own websites or other sites that publish them, which receive your IP address as with any image.
• Map tiles. The base map is loaded by your browser from OpenStreetMap tile servers, which receive your IP address and the tile addresses (so, roughly, the area you look at) when a map is open. Their policy is at osmfoundation.org/wiki/Privacy_Policy. No map, no request.
• Your location. If you choose "use my location", your browser asks your permission and shares your position with the page to select the nearest beach. This happens on your device and is not sent to us.
• Webcams. Camera cards give our reading of a public webcam operated by someone else, with a link to the operator's page. Nothing from the camera is fetched by your browser on our site; the operator is contacted, and sees your IP address under its own policy, only when you open its page. We may fetch webcam frames ourselves, on our servers, to analyse sargassum; that contacts the operator from our side, not yours.
• Local storage. The site keeps small settings (for example a chosen month or a collapsed panel) and your photo receipts in your browser's local storage, which never leaves your device.

3a. Asking through an AI assistant

Our read-only connector lets an assistant such as Claude or ChatGPT request beach and seasonal answers. It needs no account or sign-in.

• What reaches us. The assistant sends a tool name and text inputs: a beach, an area or a starting place, and an answer language. Inputs are limited to 120 characters each and the request body to 64 KB. We are not given access to your conversation, files, assistant account or memory. The assistant chooses the inputs and may include words from your question, including personal information you wrote; do not include sensitive information. Connection metadata such as the assistant's own name and version is ignored.
• Inputs and answers. We do not store tool inputs or answers or write them to application logs. They are processed in memory for the request. No aggregate tool-call counts are collected by the deployed connector, and it creates no conversation history, account, cookie or session identifier. We do not sell these inputs, use them for advertising or profiling, or train models on them.
• Host logs. Cloudflare processes request details to deliver and protect the connector. Workers invocation logs are enabled and persist request and response metadata, including the method and URL, for up to 7 days under Cloudflare's Workers Logs retention. URL query strings are not redacted, so do not put personal information in a connector URL. The connector does not add inputs or answers to these logs; request bodies are not part of the standard invocation log. Logpush and tail log consumers are not enabled. We use host logs to investigate faults and abuse, not to build a history of your questions.
• Links. Answers link only to pages of this site, with fixed tags (utm_source=mcp, utm_medium=ai_connector and utm_campaign set to the tool's name), never a user identifier. If you follow a link, section 3 applies. We do not claim to measure individual connector referrals or link them to a conversation.
• Your assistant. Its provider holds your conversation under its own terms and privacy policy. We do not control what it sends or how it stores or presents the returned answer. Questions or deletion requests about its conversation history go to that provider. Requests about our processing go to contact@sargassumcheck.com.

4. Sending a beach photo or report

If you choose to send a photo of a beach, we receive and store:

• the image, compressed on your device, with its embedded metadata removed before upload;
• the capture time and location your device reports, or a map point you confirm, and the beach you had selected;
• the exact consent text you accepted (its version and fingerprint) and a receipt number;
• the time of upload and the request's technical details (IP address, browser description) in our host's logs.

Where it goes. Photos are stored privately in Cloudflare R2 and the records in Cloudflare D1, in the United States. There is no public address for an original photo.

Automated analysis. As the photo form states, a photo may be sent to Google's Gemini service for automated beach-condition analysis (how much sargassum is on the sand and in the water, and whether the frame is usable). Google receives the image and the beach context, not your receipt, cookie or any identifier of you, and processes it under its API terms, which do not allow Google to use API content to improve its models. We keep the structured reading the model returns. Webcam frames and hotel-site images are also classified automatically (by Cloudflare Workers AI or Gemini); those are not about you.

What we never do. We never publish your original photo; only a privacy-processed version — metadata removed, any face or plate obscured, reviewed by a person — could ever be shown, with the beach and date and without your name unless you ask. We do not sell your photos or license them to others. A photo is used to train AI models only if the permission you accepted when you sent it says so; photos sent under earlier permissions are not used for training.

Abuse limits. To limit abuse, the photo service sets one anonymous, secure cookie (__Host-beachsignal-photo) that expires after 31 days; it identifies no person and is not used for anything else. Your browser keeps your photo receipts in its local storage so you can manage or withdraw your photos for 30 days; after that you need the receipt number you were shown.

How long we keep it. We keep visitor photos and archived camera frames indefinitely to improve our estimates and models (section 9). You can ask us to delete a photo at any time by sending its receipt number to contact@sargassumcheck.com; if you have no receipt, send the approximate time, beach and device details and we will look for a match. Deleting a photo removes the file, its location and its records; the condition reading derived from it and the fact that a photo was received may remain in the beach's estimate history without any link to you.

Reports without a photo (a condition level you select) are stored with the beach, time and the same technical details, and handled the same way.

5. Booking links and other sites

Hotel and booking links take you to other companies' sites — hotel websites, Expedia, Hotels.com, Vrbo, Booking.com, Google Maps and others. After you click, those companies may set their own cookies, including affiliate cookies that tell them we referred you (Expedia Group's lasts 7 days), and their privacy policies apply. You book and pay on their sites; we never receive your name, your payment details or your booking. What an affiliate programme reports back to us is a count of referred clicks and bookings and the commission earned, with no personal data about you. Where our links go through a link-tagging service (Stay22), that service sees the link you clicked and your IP address under its own policy. See the Affiliate Disclosure.

6. Email, operators and partners

• If you write to us, we receive your email address and message and use them only to reply, to act on your request and to keep a record of how we handled it.
• Operator inquiries prepared on the operators page are sent from your own email app; the page itself saves nothing.
• Operators in a pilot (hotels, beach clubs) give us a business contact, photos and reviews of their listing; we keep them for the pilot and the listing, show the operator's name beside its photos, and never show the contact person's details. Operators can ask for their data to be removed at any time.
• Affiliate programmes (Expedia Group, Stay22 and hotel-chain programmes once joined) hold our account details, not yours.

7. Why we process your data, and on what legal basis

For people in the EEA, the UK and Switzerland the law requires us to name a legal basis for each purpose. The table applies to everyone; the legal-basis column matters where that law applies.

We do not profile you, make automated decisions with legal effect about you, or use your data for marketing. If we ever want to use your data for a new purpose, we tell you first and, where the law requires, ask.

8. Who receives your data

Service providers (processors). Each receives only what its job needs, under its written terms.

AI assistant providers you choose receive your conversation and our returned answer under their own policies; they are independent of us.

Independent recipients your browser contacts (not our processors): OpenStreetMap Foundation (map tiles), Stay22 (the hotel-offer embed), the hotels' own websites and other sites that publish their photos, webcam operators, and the hotel and booking sites you click, each under its own policy.

Authorities and legal claims. We disclose data when a law, court order or lawful request requires it, or when necessary to protect the Service, our users or the public from fraud, abuse or harm. We check that each request is valid, limit what we give to what is required, and — unless a law or court forbids it or a life is at risk — tell the person concerned when we can reach them.

A change of ownership. If Waffle Corp. transfers the Service to an affiliate or a successor, your data may pass with it under this policy; we say so on the Service first.

Nobody else. We do not sell personal data, do not share it for advertising, and do not give it to data brokers. We have never done so.

9. How long things are kept

10. International transfers

Waffle Corp. is a United States company and its providers are in the United States. If you use the Service from the European Economic Area, Switzerland or the United Kingdom, the little we hold about you is transferred to the United States. For the transfer from you to us, it is necessary to provide what you asked for. For transfers to our providers we rely on each provider's certification under the EU-U.S. Data Privacy Framework where it has one (Cloudflare and Google are certified as of the version date; check dataprivacyframework.gov) and otherwise on the European Commission's Standard Contractual Clauses in our contract with it. You can ask us for a copy of the clauses.

11. Security

Photos are stored in private storage with no public address; access to our providers' consoles is limited to the operator, protected by multi-factor sign-in, and used to read contributions only to moderate them or to answer a request. Everything between your browser and the Service travels over TLS. No system is perfectly secure: if we learn of a breach that affects your personal data, we will tell you without undue delay where we can reach you, and tell the regulators the law requires within the time it requires (72 hours under the GDPR). Report security problems to contact@sargassumcheck.com; our security policy is published in the repository's SECURITY file.

12. Your rights

These rights are yours wherever you live. Where a law such as the GDPR, the UK GDPR, Mexico's federal data-protection law or a U.S. state privacy law gives you more, you have that too.

You can: know what personal data we hold about you and get a copy; have it corrected; have it deleted (a photo, with its receipt number, without asking anything else); take it with you in a machine-readable form; restrict or object to processing based on our legitimate interests; withdraw consent at any time where we rely on it (photos), with no effect on what was done before; opt out of sale or sharing of your personal data and of targeted advertising — we do none, so there is nothing to opt out of, and we treat a Global Privacy Control signal as such an opt-out anyway; and not be discriminated against for exercising any right.

How. Email contact@sargassumcheck.com. For a photo, the receipt number is all we need. For anything else we ask only what is needed to find your data and to be sure it is yours. An authorised agent may act for you if you confirm the authorisation. We answer within one month (or 45 days where U.S. state law sets that period) and tell you if we need longer. There is no charge unless a request is manifestly unfounded or repetitive.

Appeal. If we refuse a request, we tell you why and how to appeal; you can appeal by replying, and a different reviewer answers within 45 days. You can also complain to a regulator at any time.

Regulators. In the EEA, your national data protection authority (in Spain, the Agencia Española de Protección de Datos, www.aepd.es; all of them at edpb.europa.eu). In the UK, the Information Commissioner's Office (ico.org.uk). In Switzerland, the FDPIC. In Mexico, the Secretaría Anticorrupción y Buen Gobierno (successor to INAI). In the United States, your state attorney general or the California Privacy Protection Agency.

California. We do not sell or share personal information and have not done so in the preceding 12 months. The categories we collect are identifiers (IP address, the anonymous photo-tool cookie), internet activity limited to request logs and cookie-free visit totals, geolocation data only when you send a photo or report, and the photos themselves; the sources are you and your browser; the purposes are those in section 7; the recipients are those in section 8. We collect no sensitive personal information except the precise location you attach to a photo, which we use only for the purpose you sent it.

13. Children

The Service is meant for adults planning travel. We do not knowingly collect personal data from children under 13 (16 in the EEA, Switzerland and the UK, or your country's lower age). If you believe a child has sent us a photo, write to contact@sargassumcheck.com and we will delete it within 48 hours of confirming it.

14. Changes to this policy

We change this policy when the Service changes. A feature that is switched on or added changes the policy in the same release. For a change that reduces your rights or widens what we collect or who receives it, we show a notice on the Service at least 30 days before it takes effect, and we never apply it to data already collected without your consent where the law requires consent. Smaller changes take effect when posted. The date at the top says which version you are reading; earlier versions are available on request.

15. Contacting us

Write to contact@sargassumcheck.com. You do not need an account or anything but email. By post: Waffle Corp., 2093 Philadelphia Pike #2073, Claymont, DE 19703, United States.

---

Waffle Corp. · Version 2026-10-31