Privacy and cookies
What we collect, why, who else touches it, and how to make us delete it. Short, because we collect very little.
Last updated: September 7, 2026
Who is responsible for your data
What we collect today
Only two things.
The early-access form. The email address you type and, if you pick them, the states you sell in. Nothing else — no name, no company, no phone. We use it for one purpose: to write to you once, when your states go live.
Server logs. Our host keeps the usual access log, including your IP address, for security and troubleshooting. We do not build profiles from it.
Your customer account, if you open one. Your name, work email and password (stored only as an Argon2id hash we cannot read); your company’s registrant details; the products, states, registrations, deadlines, tonnage figures and documents you choose to enter or upload; and a log of who changed what in the account and from which IP address, kept for security and so your team can audit its own work. Documents are stored on our host outside the public web folder and are served only to signed-in members of your account.
We use this data only to run the service you asked for: to build your calendar, calculate fees, remind you of deadlines by email and keep your records. We never ask for, and never store, your state portal passwords.
If you sign in with Google. Signing in with Google is optional — an email and a password work just as well. If you choose it, Google confirms who you are and passes us three things: your name, your email address and the identifier Google uses for your account. We store those and nothing else, and we never see your Google password. What Google does on its side is governed by Google’s own privacy policy.
Why we are allowed to hold it
Your consent, given by submitting the form, for the waitlist address. Our legitimate interest in keeping the site up and secure, for the server logs. You can withdraw consent at any time and it costs you one email.
The performance of the contract you accept when you open a customer account, for the account data and documents; and our legitimate interest in keeping the service secure, for the activity log and failed sign-in records.
Who else touches it
We do not sell, rent or share your data with anyone else, and we never will. We also do not send unsolicited commercial email: under Spanish law (article 21 of the LSSI) that is prohibited even between businesses, and we agree with the rule.
How long we keep it
The waitlist address stays until you ask us to delete it, or until 24 months pass with no contact from you, whichever comes first. Server logs rotate on our host's schedule.
Customer account data stays while the account is open. When you delete your account from Settings, your user is erased at once and, if you were the only owner, so are the company account, its documents and its log. Failed sign-in records are erased after 24 hours. You can download everything first, as JSON or ZIP, from the same page.
Your rights
You can ask us for a copy of what we hold, correct it, delete it, restrict what we do with it, object to it, or receive it in a portable format. Write to info@fertilabel.com and we do it — no forms, no identity theatre beyond what is needed to be sure it is you.
If you think we have handled your data badly, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (aepd.es).
If you are in the United States: we do not sell or share personal information as those terms are used in US state privacy laws, and we do not use it for cross-context behavioural advertising. The rights above are offered to you on the same terms.
Cookies
The public site sets none. The customer panel at /app/ sets two, and only after you use it: fl_sess, a session cookie that keeps you signed in and protects your forms (strictly necessary; deleted when you close the browser or after eight hours), and fl_lang, which remembers the language you chose (one year). Neither is used for analytics or advertising, and neither needs consent under article 22.2 of the LSSI, which is why there is no banner.