At Kehay we take your privacy seriously. This policy explains what data we process when you use the Kehay mobile app and the website kehay.es, why, who we share it with and what your rights are. We only collect what we need to help you discover festivals and events near you. If the versions differ, the Spanish one prevails.
Data controller
Kehay. You can contact us at any time at [email protected].
What data we process and why
- Approximate location. If you allow it, we use your device’s location to show you the nearest events and centre the map. You can use the app without this permission: you’ll search by text or move the map yourself. We don’t keep a history of your locations.
- Google account (optional). If you sign in with Google, we receive your name, email address and profile photo to create your account and save your favourites and interests. You can use most of the app without signing up.
- Posters and events you upload. If you send a photo of a poster or fill in an event, we process that image and the details you provide to publish the event in Kehay’s public catalogue. The photo is analysed automatically to extract the event details (see “Providers” below).
- What you search for. To understand phrases like “magic for kids this weekend near Vic”, the search text may be sent to an artificial intelligence model (see “Providers”). Only the text you type or dictate is sent, without your name, account or location. We keep searches without linking them to anyone, so we don’t ask the same thing twice and to learn what people look for and don’t find; interpreted searches are deleted automatically after 30 days.
- Voice search (optional). If you tap the microphone, the app asks for permission to use it and turns your voice into text with your phone’s own speech recognition (Apple on iPhone, Google on Android). When the phone can do it offline, the audio never leaves it; otherwise Apple’s or Google’s service does the recognition. On the website, the browser uses its own recognition service. Kehay never receives or stores the audio: only the resulting text, like any other search.
- App push notifications (optional). If you turn them on, we store an identifier for your device so we can send you alerts about events. You can turn them off at any time in your phone’s settings.
- Festival alerts on the website (optional). If you ask on kehay.es to be told about a town’s festival, we store the towns you choose, your language and, depending on the channel: in your browser, the subscription address your browser gives us to send it alerts (no name, email or account); by email, your email address. We only use it to let you know when those towns’ festivals are coming and, at most once a week, about weekend plans nearby; never more than two alerts a week and never advertising. By email we send nothing until you confirm through the link we send you; if you don’t confirm, we delete the address after 7 days. You can unsubscribe at any time with the link in every email, at kehay.es/avisos or by blocking notifications in your browser, and when you do we delete the subscription. To know whether these alerts are useful, we also keep the anonymous analytics identifier of the browser you signed up from and whether alerts are opened.
- Usage and diagnostic data. We record, in aggregate, which events are viewed to understand what people are interested in and improve the app. We discard crawler and bot traffic. We don’t use this data to profile you or for advertising.
- How you found us. If you arrive from one of our posters, flyers or links, we note that source (for example “poster” or the name of the town) to learn which outreach works. When you scan the QR code we store the source, the type of phone (Android or iPhone) and the day; to count distinct visitors we use an encrypted, irreversible fingerprint, and we don’t store your IP address. On Android, Google Play tells the app which link it was installed from; on iPhone, Apple only gives us totals per campaign, never who. If you create an account, the source is linked to it. We don’t use device fingerprinting or third-party tracking tools, and this data isn’t shared with anyone.
Legal basis
We process your data on the basis of your consent (location, notifications, website alerts, Google account, posters you choose to upload) and our legitimate interest in keeping the service secure and improving it (aggregate diagnostics and learning which outreach works). You can withdraw your consent at any time.
Providers we share data with
We rely on providers that act as data processors:
- Google — sign-in, maps (Google Maps) and app push notifications (Firebase).
- Your browser’s notification service (Google, Mozilla, Apple or Microsoft, depending on the browser) — delivers website alerts to your browser. The content of the alert travels encrypted.
- OpenAI — automatic analysis of the posters you upload to extract the event details. The image is sent for that purpose only.
- Vercel (AI gateway) — interpreting the text of some searches with a language model. Only the search text is sent, with nothing that identifies you.
- Apple and Google — system speech recognition, only if you use the microphone to search.
- Hosting provider — the servers Kehay runs on, including our own mail server, which sends the email alerts.
We don’t sell your personal data or hand it to third parties for advertising.
Retention
We keep your account data for as long as your account is active. Published events and posters are part of Kehay’s public catalogue. Usage and source data are deleted automatically after 400 days. Website alert subscriptions are kept until you unsubscribe (unconfirmed email ones, 7 days). When you ask us to delete your account, we delete the personal data linked to it.
Instagram messages and comments
If you write or comment “PLANES” on our Instagram account (@festea_es), we automatically reply with a link to what’s on in your area. To do so, Instagram sends us the text of the message or comment and your Instagram identifier. We only check whether it contains the word “PLANES” and, if so, the name of the town that comes with it; nothing else is stored. We keep only the message identifier and the date, so we don’t reply twice, and delete them after 90 days. We don’t use this data for anything else or share it with anyone.
How to delete your data
In the app you can delete your account under Profile → Account → Delete my account, and the personal data linked to it is deleted. Website alerts are deleted when you unsubscribe (see above). For any other data —including anything related to Instagram— email us at [email protected] with your username and we’ll delete it within 30 days at most.
Your rights
You have the right to access, rectify and erase your data, to restrict or object to its processing, and to data portability. To exercise them, email us at [email protected]. You can also complain to the Spanish Data Protection Agency (aepd.es) if you think we haven’t handled your request properly.
Children
Kehay is not aimed at children under 14 and we don’t knowingly collect their data. If you think a child has given us data, contact us and we’ll delete it.
Changes to this policy
We may update this policy to reflect changes in the service or the law. We’ll publish the current version on this page with its update date.
Contact
Questions about your privacy? Email us at [email protected].