Who's Right?2.1 Purpose
This policy informs users of the Who's Right application and the whos-right.ai website how their personal data is collected, used, stored and protected by Lumra Technologies S.L., in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Spanish law.
2.2 Data controller
The data controller is Lumra Technologies S.L., CIF B22832893. Contact: support@whos-right.ai.
2.3 Data we collect
- Identification: name, nickname, email address, Apple/Google sign-in identifiers.
- Account: profile info, preferences, language, optional profile picture.
- Incidents: text descriptions, dates, invited participants, context you provide.
- Evidence: files, images, audio, video, screenshots, documents you voluntarily upload.
- Technical: IP address, device type, OS, app version, error logs.
- Payments: transactions handled by Stripe, Apple App Store or Google Play — we never store your card numbers.
- Advertising: anonymized ad identifiers (Google AdMob), subject to your consent.
- Support: content of conversations with our support team.
2.4 Sensitive data
We do not intentionally collect sensitive data (health, political opinions, religion, sexual orientation, etc.). Users agree not to upload such data unless strictly necessary.
2.5 Third-party data
When you invite a participant or upload evidence involving a third party, you confirm you have the right or consent required to share that information.
2.6 Purposes
- A. Provide the service: account creation, incident management, AI verdict generation.
- B. Improve the service: anonymized technical analytics.
- C. Manage payments: billing, subscriptions, fraud prevention.
- D. Security: abuse prevention, fraud detection.
- E. Communication: service notifications, user support.
- F. Personalized advertising: only with your consent.
- G. Legal obligations: accounting retention, responses to authorities.
- H. Legitimate interests: AI model improvement, platform security.
2.7 Legal bases
Consent, performance of the service contract, legitimate interest, and legal obligation, depending on the purpose.
2.8 Artificial intelligence
The content you provide (incident descriptions, evidence) is analyzed by AI models to produce an indicative verdict. No automated decision producing legal effects is made. The analyses do not constitute legal, medical or psychological advice.
2.9 Recipients
Your data may be shared with our technical sub-processors (hosting, AI providers, payment processors, ad networks), strictly limited to what is necessary, under GDPR-compliant agreements.
2.10 Hosting and international transfers
Because hosting is provided by GoDaddy in the United States, some data may transit or be stored outside the EU. Such transfers are covered by Standard Contractual Clauses and/or mechanisms provided by the GDPR.
2.11 Advertising (AdMob)
Google AdMob may display personalized or non-personalized ads depending on your consent. You may withdraw consent at any time in the app settings.
2.12 Payments
Payments are processed by Stripe, Apple App Store and/or Google Play. We never store your banking data — it is handled by those providers under their own policies.
2.13 Retention
Account data is kept while your account is active and up to 12 months after deletion for security, fraud prevention and legal obligations (up to 10 years for accounting).
2.14 Security
We implement technical and organizational measures (encryption, access control, monitoring, backups) to protect your data.
2.15 Your rights
Under the GDPR, you have rights of access, rectification, erasure, restriction, objection, portability, and the right to withdraw consent at any time. To exercise these rights, write to support@whos-right.ai. You may also lodge a complaint with the Spanish DPA (AEPD).
2.16 Account deletion
You may delete your account at any time from the app or by writing to support@whos-right.ai. Deletion is processed within 30 days.
2.17 Minors
The app is intended for users aged 13 or over. Users under 13 are not permitted to create an account.
2.18 Changes
This policy may be modified at any time. The update date appears at the top of the document.
2.19 Comments, votes and audience measurement on the “Conflicts” videos
On the video episode pages of the Conflicts section of whos-right.ai, you can vote and post a comment. These features are optional and do not require an account.
- Comments: we record the nickname and the text you choose to post, the date it was sent and the language of the page. No email address is requested. Comments are reviewed before they are published; the nickname, date and text are then publicly visible. A comment may be refused or deleted if it does not follow the community rules.
- Connection data linked to comments: to comply with our legal obligations and be able to answer requests from judicial authorities, we keep the IP address, date and text of each comment for one year, in a separate, protected file, including when the comment has been deleted from the site. This data is never displayed publicly and is deleted automatically at the end of that period. Legal basis: legal obligation (Article 6(1)(c) GDPR).
- “Who do you think is right?” votes: we only record the number of votes for each episode. So that each person votes only once, we set, only when you vote, a signed technical cookie (“wrVote”, 12 months) that contains nothing but episode identifiers, and we use a fingerprint of your IP address computed with a secret key renewed every day (irreversible, deleted the next day). No IP address is kept. This cookie is strictly necessary for the vote you request.
- Audience measurement: we count the views of each episode page and video plays, without cookies and without keeping any IP address. An irreversible daily fingerprint is used only to count each visitor once per day; it is deleted the next day. Only daily totals per episode are kept. Search engine robots are not counted.
- Reports: when you report a comment, only an irreversible daily fingerprint is kept, to prevent repeated reports.
- Purposes and legal bases: publishing and moderating comments, counting votes, measuring audience and protecting against abuse (spam, abusive reports), based on our legitimate interest in running and securing the site (Article 6(1)(f) GDPR); keeping the connection data of comments, based on a legal obligation (Article 6(1)(c)).
- Hosting and access: this data is hosted with the website, outside any publicly accessible folder, and only the Lumra Technologies S.L. team can access it. When a comment is sent, an internal alert containing the nickname and an excerpt of the text (never the IP address) may be sent to us through the Telegram messaging service.
- Your rights: to request access to, correction or deletion of your comment, write to support@whos-right.ai stating the episode, nickname and date. Deletion removes the comment from the site; the connection data is kept for the one-year legal period, then deleted.