Privacy

Reactive Systems SL (CIF B10872950), Calle de las Revistas 7, 07817 Ibiza, Illes Balears, Spain, runs hypeibiza.com and decides what is recorded. Contact: hello@hypeibiza.com.

Page views through Google Analytics 4, only if you accept analytics in the cookie bar. Basis: your consent (art. 6.1.a GDPR). You can withdraw it on the cookies page.

Outbound clicks to shops: the time, the product, the shop, the kind of page you came from and whether the browser is a phone or a desktop. No IP address, no name, no cookie. Basis: our legitimate interest in knowing which shops and pages are used (art. 6.1.f). Kept 90 days, then deleted.

Your language and country choice, in two cookies on your device, one year. Basis: necessary to show the site as you asked.

Server logs at our host (IP address, URL, time) for abuse and rate limiting, kept up to 7 days. Basis: legitimate interest in keeping the site up (art. 6.1.f).

Barcode lookups: the number you scan or type is used only to find the product. Nothing else about you goes with it.

The HYPEIBIZA app for iPhone and Android: a random install ID, kept on the phone in the system's secure storage and on our server only as a hash, so your saved list and alerts work without an account; the phone type and when the app last connected. If you turn on notifications, the push token Apple or Google gives your phone, used only to send the notifications you choose (the alerts you set; when you are signed in, price drops on products you saved; and, only if you turn on Picks for you, at most one suggestion a day from your preferences) and removed when you turn notifications off. The camera is used only while you scan a label: the picture stays on the phone and only the barcode number is sent. When the app registers the install or asks for a sign-in or deletion email, our security provider checks that the request comes from the app on a phone, using device details (model, system version, a device identifier); legitimate interest in preventing automated abuse (art. 6.1.f GDPR). The app counts what is used (the app opened, a product viewed, a save, an alert set, a shop opened and closed, a search, the first-run steps, a card liked or passed in For you) against that install ID, to see which parts work. The likes, passes and shop opens in For you also choose the cards it shows on the next days. Each count also holds a random count ID (so a count sent twice is kept once), a random visit ID that changes after 30 minutes without use, the app version, the screen, and for a product its public page name and its place in a list. A search count holds only the kind of result and how many, never the words you type. No advertising ID, nothing shared, kept 90 days; legitimate interest in improving the app (art. 6.1.f GDPR). If you choose preferences in the first-run steps or later in the app (categories, brands, size, your main interest such as releases, restocks or deals), they are stored with your account, or with the install if you have no account. You can change them at any time in the app. They are used only to choose which products the app shows you and, if you turn on Picks for you, which product a notification suggests; your size is also kept with the push token for that. They are deleted with the account, or 13 months after the install last connected. The app has no ads, no third-party analytics and no tracking across other apps or sites. Basis for the rest: your request (art. 6.1.b GDPR). Delete your account from Account in the app or at hypeibiza.com/account/delete; the phone then carries on as a guest.

Partner links: some shop links pass through the shop's affiliate partner first, which records the click and may set its own cookie so the shop can credit the sale; that processing is theirs, under their own privacy policy. We receive only sale totals and commissions, never your name or your order.

Accounts, if you create one: your email, the products you save and the price when you saved them, to show your list and to mail you when a saved product gets cheaper. You sign in with a one-time link (valid 15 minutes); the session is a cookie holding a random token that we store only as a hash, 90 days. Basis: your request (art. 6.1.b GDPR). Delete the account and its list at any time from the account page.

Advertising: ads on this site may be served by Google, which may set cookies or read your browser's storage for its own purposes. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads based on your visits to this site and other sites on the Internet. You may opt out of personalised advertising at adssettings.google.com, or at aboutads.info for other vendors. For visitors in the EEA, the UK or Switzerland, personalised advertising rests on your consent, asked by a Google-certified consent platform (art. 6.1.a GDPR). See the cookies page.

Email alerts: the address you typed, the products and sizes you asked us to watch, your language, and your alert preferences. Purpose: to send the alerts you asked for. Basis: consent (art. 6.1.a), withdrawn by the unsubscribe link in every mail. Kept until you unsubscribe, then the address stays 12 months on a suppression list so we do not mail it again. The confirmation time and the id of the confirmation mail are the consent log. The weekly digest is marketing under LSSI art. 21 and is sent only when you explicitly request the weekly email; a product price or restock alert is not marketing.

The HYPEIBIZA extension for Chrome reads nothing until you click "Allow on all sites" on its first-run page. It reads nothing while paused or on a site you turned off. It has no account and no ID of its own, and its requests carry no cookie.

On a product page (a page whose structured data or og:type names a product), it sends to hypeibiza.com: the page address; the delivery country from its settings or your browser language; and these fields of the page: the shop's host name, the product name, brand and colour, barcodes (GTIN/EAN), style codes, the sizes the page lists, the page's price and currency, and the page's canonical address. On a marketplace such as Vinted, eBay or Wallapop it sends the page address and the country only. Purpose: to find the same product in our catalogue and show the offers of the shops we compare. Basis: your request, when you install the extension and allow it (art. 6.1.b GDPR).

It never sends other pages, the text you type, forms, passwords, cookies, your browsing history or anything about your shop account. Two things are read in the browser and never sent: the size the page shows as selected, and whether another site referred the visit (an affiliate click ID in the address, or an affiliate network as the referrer). For a referred visit the extension keeps only a yes for that site until the browser closes, and it shows nothing on that site.

Your settings (pause, style, country, sizes, sites turned off) stay in this browser, in Chrome's extension storage. Answers are kept in the browser's session storage and go when the browser closes. "Delete my settings" on the settings page removes the settings; removing the extension removes everything.

On our server: when we must fetch a page of a shop we compare, its address waits in a job queue and is deleted when the job ends; the result is kept up to 24 hours as a cache under a one-way hash of the address, and the row is deleted within 8 days. When we cannot serve a lookup, we count it by day, shop, outcome and product identity (brand, style code, a short model phrase), without the address and without anything about you; these counts are deleted after 180 days. A flood guard counts requests per IP address for one minute, in memory only. Server logs as above. A click on a Go button is an outbound click as above, with "extension" as the kind of page.

No passwords, no editorial newsletter, no purchase data, no profiling, no sale of data. What you buy at a shop stays between you and the shop, under the shop's own privacy policy.

Our hosting, network, email and security providers (the last checks that a click through to a shop comes from a person, using a device identifier; legitimate interest in preventing automated abuse, art. 6.1.f GDPR), in the EU and the United States, and Google LLC (analytics, only with your consent, and advertising). Transfers outside the EU rest on the EU-US Data Privacy Framework or standard contractual clauses. Ask us for the full list of providers at any time.

Under the GDPR you can ask for access, correction, deletion, portability, or object to processing. Write to hello@hypeibiza.com; we answer within one month. You can also complain to the Spanish supervisory authority, the AEPD (www.aepd.es).