Privacy policy

Last updated: August 7, 2026

This policy explains what personal data we process when you use Picstar, why we process it and what you can do about it. It is provided in compliance with articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

Data controller

The controller of your personal data is:

Registered name
COFFEE SOFTWARE, S.L.U.
Registered address
Avda. Capitán Negrete 25, 07760 Ciutadella de Menorca, Illes Balears
Tax ID (NIF)
B44736213
Phone
722207352
Email
hola@picstar.es
Domain name
www.picstar.es
Companies register details
Registro Mercantil de Menorca, tomo 205, folio 40, hoja IM-00007830. Inscrita el 16/03/2023

For any matter relating to data protection —including exercising the rights described below— you can write to us at the email address shown above or through the contact page.

What data we process

Your account details. Your email address, which is how you sign in: Picstar uses email sign-in links, so we do not store passwords. When you create your profile we also collect your username, first and last name, phone number, date of birth and preferred language. Optionally, your biography, social networks, address and your profile and cover photos.

Federation membership numbers. If you provide them (FIAP, CEF, FCF, FAFPV), we store them so that the relevant bodies can award you their points when you enter contests they sponsor.

Your contest activity. Your entries, the photographs you submit — along with the technical metadata embedded in them, such as the camera, the shooting settings and, if the device recorded it, the geolocation of where it was taken — the scores they receive and any awards won. If you sit on a jury, the scores you award as well.

Your relationship with associations. Your membership requests, your memberships and, where applicable, your role as administrator or jury member.

Payment details. Where a contest charges an entry fee, the payment is processed by Stripe. Picstar does not store your card details: it only keeps the transaction identifier and its status.

Evidence of your acceptances. When you accept contest rules or terms, we record the date and time, your IP address and the browser you used, so that this consent can be evidenced.

Usage data. If you accept analytics cookies, aggregated information about how the site is browsed. The details are set out in the Cookie policy.

Your messages. Whatever you send us through the contact form reaches our mailbox. It is not stored in the application database.

PurposeLegal basis
Creating your account, identifying you and granting accessPerformance of a contract
Letting you enter contests and publish your work and resultsPerformance of a contract
Managing your membership of associationsPerformance of a contract
Charging entry fees and issuing the corresponding receiptPerformance of a contract and legal obligation
Sending you notices about contests you have enteredPerformance of a contract
Sending you notices you can switch off in your preferencesConsent
Measuring how the site is usedConsent
Keeping evidence of legal acceptancesLegitimate interest and regulatory compliance
Preventing fraud and protecting the platformLegitimate interest

You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

For how long

We keep your account data for as long as the account remains active. If you close it, we block the data and keep it only for the applicable limitation periods, after which it is deleted.

Information with tax or accounting relevance is kept for the periods required by commercial and tax legislation. Evidence of your acceptances is kept for as long as it may be required of you or of us.

Photographs submitted to a contest and their results remain attached to that contest's record, which forms part of the organising association's history.

Who else accesses your data

The organising associations. When you enter a contest or apply to join as a member, the relevant association accesses the data needed to manage you: your profile, your submissions and, where you have provided them, your federation membership numbers. Each association is responsible for the use it makes of them.

Providers that serve us. They act on our behalf and under a data processing agreement:

  • Stripe — payment processing
  • Resend — email delivery
  • Amazon Web Services — hosting and storage of images and documents
  • Google Analytics — usage measurement, only if you accept analytics cookies

Some are based outside the European Economic Area. In those cases the transfer relies on the safeguards set out in Chapter V of the GDPR.

We do not share your data with third parties for commercial purposes.

What is public

Your profile is public: anyone can see your username, your description, your social networks, your profile and cover photos, the work you have submitted, the contests you have entered and the awards you have won.

Your email address, phone number, date of birth and address are not public.

Photographs are published exactly as you upload them, with the metadata the file carries inside: anyone who downloads it can read that metadata, including the geolocation if your camera or phone recorded it. If you would rather not reveal it, strip it before submitting the work.

Minimum age

You must be at least 16 years old to create a Picstar account. The date of birth is checked during sign-up and the account cannot be completed below that age.

If we find that an account belongs to someone under 16, we will delete it along with the associated data. If you believe a minor in your care has registered, write to us from the contact page and we will sort it out.

Your rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you have given.

Much of this you can do yourself from your profile settings. For anything else, write to us through the contact page.

If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

Security

We apply technical and organisational measures to protect your data against unauthorised access, loss or alteration. Access is limited to those who need it in order to provide the service, and communications with the platform are encrypted.

Changes to this policy

We may update this policy when our processing activities or the applicable legislation change. The date of the last update appears at the top of the document.

Versions in other languages

This document is published in the eight languages of the application. The original text is the Spanish one: in the event of any discrepancy between versions, the Spanish version prevails.