Legal

Privacy Policy

Last updated: 26 October 2026

This Privacy Policy explains how Content Angels Agency SL (“we”, “us”), operator of Malaga Insiders (the “Site”), collects and processes personal data in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Spanish data-protection law.

1. Data controller

Content Angels Agency SL, NIF ESB75910182, Calle Sonsoles 16, 29631 Benalmádena, Málaga, Spain. Contact: info@studiotoorn.com.

2. What we collect

Account data — the email address and password you provide to register, and profile details you choose to add (display name, handle, bio, location, avatar and banner images).
Activity data — content you create on the Site (comments, RSVPs, poll votes) and your role/level within the clubhouse.
Technical data — essential cookies and local storage used to keep you signed in and remember your preferences (such as language and theme). These are always active because the Site needs them to work.
Analytics data — we use Google Analytics (GA4) with Google Consent Mode to measure how the Site is used (pages viewed, approximate location, device and browser). By default it runs in a privacy-preserving mode with no cookies and without identifying you; only if you accept do we enable analytics cookies for more accurate, aggregate measurement. We never use it for advertising. The iOS app does not use Google Analytics at all.
Newsletter — if you subscribe, the email address you submit.
Payment data — if you become an Insider or a Club Partner, we receive your name, email address, the amount paid, the status of your membership and, for businesses, the billing address, tax ID, website and message you enter. Card and bank details go directly to Stripe; we never see or store them.
iOS app— if you subscribe in the app, Apple handles the payment and sends us the transaction details we need to switch your membership on (a transaction ID, the product, its dates, price and status, linked to your account); we never see your Apple ID or payment details. If you allow notifications, we store your device’s push token with your account so we can send you alerts; it is removed when you sign out or turn notifications off.

3. Why we use it (legal basis)

To create and secure your account and provide the clubhouse — performance of a contract.
To show the community features you use (comments, meetups, member directory) — performance of a contract / legitimate interest.
To take payments, give Insiders access to the clubhouse and run partner listings — performance of a contract; and to keep payment records — legal obligation (tax law).
To send the newsletter — your consent, which you can withdraw at any time.
To measure and improve the Site with analytics — your consent, which you can withdraw at any time (see “Cookie settings” in the footer).
To keep the Site safe and prevent abuse — legitimate interest.

4. Processors and third parties

We share data only with providers that process it on our behalf:

Supabase — authentication, database and image storage.
Netlify — website hosting and newsletter form handling.
Stripe — payment processing for memberships and partner packages (Stripe Payments Europe Ltd., Ireland). Stripe also processes payment data under its own privacy policy, for example to prevent fraud.
Apple — App Store subscriptions and push notifications in the iOS app, under Apple’s own privacy policy.
Google Analytics (Google) — aggregate usage statistics, loaded only after you accept cookies.
Google Fonts — web fonts (served self-hosted at build time).
YouTube (Google) — embedded videos; loading a video may set cookies governed by Google’s policies.

Some providers may process data outside the EEA under appropriate safeguards (e.g. EU Standard Contractual Clauses).

5. Retention

We keep account data for as long as your account exists. You can delete your account yourself at any time (Settings → Delete account, on the website and in the app), after which we remove your personal data except where we must retain it to meet a legal obligation. Payment records are kept for as long as Spanish tax law requires.

6. Your rights

You have the right to access, rectify, erase, restrict or object to processing, and to data portability. To exercise these rights, contact info@studiotoorn.com. You may also lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es).

7. Security

Access to member data is protected by row-level security and encryption in transit (HTTPS). We never sell your data.

8. Changes

We may update this policy; the “last updated” date above reflects the latest version. Material changes will be announced on the Site.