Privacy policy

Controller and contact

Javier Castellanos Serrano, Spanish tax ID 06288373N. Address: Calle Velarde 27, 45730 Villafranca de los Caballeros, Toledo, España. Contact and rights requests: [email protected].

You do not need an account to view prices. Having no registration does not mean that no personal data is processed: connections include an IP address and technical data, and some features need location information or information you choose to submit.

Purposes and legal bases

• Contact and rights requests. We use your email address, message and the information needed to reply. General enquiries and corrections rely on our legitimate interest in responding to communications (GDPR Article 6(1)(f)). Requests for steps before a contract rely on Article 6(1)(b) only where applicable. Handling rights requests or complying with a legal obligation relies on Article 6(1)(c). Contacting us does not subscribe you to marketing.
• Features you request. Device location is used with your specific permission when requested (Article 6(1)(a)). Choosing a municipality manually avoids this permission. Your profile, favourites and preferences support the comparison and settings you request; where these are personal data, our legitimate interest in providing that feature is the basis (Article 6(1)(f)), without advertising use.
• Advertising. Non-exempt storage or access and advertising personalisation require consent (GDPR Article 6(1)(a) and LSSI-CE Article 22(2)). Rejecting does not prevent access to the content. Continuing to browse does not count as acceptance.
• Hosting, security and abuse prevention. Our legitimate interest in serving the website, limiting repeated requests and maintaining its integrity (Article 6(1)(f)), using only necessary technical data. You may object on grounds relating to your situation; we will assess your request and any overriding legitimate grounds.

Location, routes and searches: what leaves your browser

When you request ‘Near me’, your browser asks for geolocation permission. Coordinates may retain their original precision in sessionStorage, alongside accuracy, timestamp and municipality; they are treated as valid for 30 minutes. Once expired they are no longer used, but the record is not automatically deleted at that instant. If you choose a municipality, its centre is used and labelled accordingly.

For road-distance comparisons, your browser sends the origin and stations to /api/rutas on our domain, hosted by Cloudflare. That API receives the coordinates before rounding them. It rounds the origin to three decimal places and sends it to OpenRouteService / HeiGIT with the destinations. It does not explicitly forward the visitor’s IP address. Three decimal places is roughly a hundred metres, depending on latitude; it does not guarantee anonymity.

The trip planner also sends the origin, destination and place-search text to our APIs. The server rounds origin and destination to three decimal places before asking ORS for the route. Normalised searches and itinerary results are cached by Cloudflare for 24 hours: cache keys contain search text or approximate coordinates respectively. No user ID is added to that cache; this does not necessarily make its contents anonymous. The /api/rutas matrix does not keep an equivalent results cache.

Avoid entering names or other unnecessary personal information in searches. You can revoke location permission in your browser, choose a municipality manually and clear site storage; withdrawal does not invalidate earlier processing. No verified numerical retention period has been established for HeiGIT API calls. Its terms restrict submitting personal data and compatibility with this processing flow still needs review.

My car, favourites and preferences

Our own code stores your My car profile, consumption, litres, fuel type and favourites in your browser’s local storage. It does not send the profile or favourite lists to our server or provide account synchronisation. Downloading a manufacturer’s catalogue does generate a technical request to the host. ‘Delete profile’ removes gmb-mi-coche and gmb-consumo; favourites can be removed using their selector and other storage can be cleared in your browser settings.

Reports and votes: prepared, not enabled when checked

On 31 October 2026, /api/aviso returned disponible:false and turnstile:null. This is a dated observation, not a guarantee that no earlier data or separate services exist. While the service is disabled, use the contact email. The prepared implementation provides for the following:

• Reports: page path without query parameters, station, error type, date, and optional comment and email. Purpose: review the information and reply where appropriate. Intended basis: consent through a voluntary, informed submission (Article 6(1)(a)); this must be demonstrable before activation. Do not include sensitive data or other people’s information. A report does not automatically change a price.
• Usefulness votes: page, response, date and a random session identifier transformed using HMAC to prevent duplicates. Intended basis: legitimate interest in improving information and avoiding repeated votes (Article 6(1)(f)). This is pseudonymisation, not guaranteed anonymisation.
• Cloudflare D1: intended retention of 90 days for reports and votes. Abuse counters use an HMAC of IP and hour with a daily secret, without plain IP addresses in that table, and are scheduled for cleanup after two days. Cleanup runs after accepted submissions or through the scheduled worker: passage of time alone does not run it. The schedule and operation must be verified before effective periodic deletion can be promised.
• The prepared summary would send reports to the owner through Cloudflare and their Gmail inbox; it may include the comment and email. Deletion from the inbox after 90 days is manual and is not performed by the code. Deleting database rows also does not establish immediate removal from recovery copies; the actual plan and recovery windows need checking. If enabled, Turnstile adds Cloudflare’s abuse verification.

To withdraw consent for a report or request deletion, email the contact address and identify the page and approximate date. Withdrawal does not affect the lawfulness of earlier processing or prevent retention strictly required by law.

Technical data, maps and recipients

Cloudflare provides hosting, functions and, when configured, D1 and report-summary email. It receives IP addresses, URLs, headers and connection data and may keep infrastructure and security logs. Routing APIs use a SHA-256 IP fingerprint in hourly rate-limit cache entries (one hour); if that capability is unavailable, the code provides for IP addresses in memory with deferred cleanup. This differs from report HMACs and does not mean infrastructure never sees or retains IP addresses.

When a map loads, OpenFreeMap (Hyperknot Software Kft., Hungary) receives connections for styles, tiles, icons and Noto Sans glyphs, including the IP address and requested resources or areas. On desktop, a map may load as it approaches the viewport; on mobile, it opens using the map button. This is not an advertising request. Its policy states that it does not use cookies or tracking and provides for error logs of up to seven days and incident-related IP logs of up to 30 days. This integration relies on legitimate interest in providing comparison maps, limited to that purpose.

OpenRouteService / HeiGIT receives the routing and search requests described above. Google provides advertising and consent services and, through Gmail, the owner’s incoming email. The owner accesses communications to handle them. Processor or independent-controller roles depend on the service and contract; not every provider is claimed to act as a processor for every activity.

Cloudflare · OpenFreeMap · HeiGIT · Google

Google advertising and consent

Google AdSense and its providers may use cookies and identifiers to serve ads, limit frequency, measure results and personalise them, according to the purposes and providers you authorise. Non-exempt access requires a prior choice. You can reject and withdraw consent using ‘Cookie settings’ in the footer; your local decision is remembered for six months from when you make it. The CMP provides the vendors, purposes and retention periods relevant to your session.

How Google uses data from partner sites. Google ad settings. Changing Google’s personalisation settings does not replace your cookie choice on this website.

Retention and international transfers

Enquiry emails are kept while the conversation is handled and, as a management rule, for up to one year after it closes; where a legal duty or claim requires retention, it is limited to what is needed for the applicable legal period. This is not automatic deletion implemented by the website. Local preferences have no programmed expiry; location, caches and reports have the limits and conditions explained above. Infrastructure-log retention depends on provider settings and has not been verified in this account’s dashboard.

Google and Cloudflare may process data outside the European Economic Area. An adequacy decision, including the EU–US framework where the entity and transfer are actually covered, or standard contractual clauses with necessary safeguards may provide a transfer mechanism, depending on the case. This policy does not certify current participation or a particular safeguard for this account: entities, processor agreements and accepted AdSense, Gmail and Cloudflare terms still need checking in the relevant dashboards. You can request information about applicable safeguards by emailing the owner.

Your rights and complaints

You may request access, rectification, erasure, restriction and portability where applicable, object to processing based on legitimate interest, and withdraw consent at any time without affecting earlier lawful processing. Email [email protected]. State the right you wish to exercise and the information needed to identify the processing. We will only request additional identity information if there is reasonable doubt. We normally respond within one month; any lawful extension must be explained and notified. You may complain to the Spanish Data Protection Agency (AEPD).

Related information

Legal notice and owner. Cookies and storage. Sources, licences and dates. About this website and methodology. Leer esta página en español. Explore airport fuel comparisons.

Last updated: 3 November 2026.