Viuu
Back to homeViuu

Privacy Policy & Data Protection

Last updated: October 2026

At Viuu (viuu.cat), safeguarding your personal data and upholding absolute transparency are paramount. This policy details how we process your information in full accordance with the General Data Protection Regulation (GDPR - EU 2016/679) and applicable statutory frameworks.

1. Data Controller

The data controller responsible for personal data processed through viuu.cat is the proprietary team of Viuu Platform. For any privacy questions or to exercise your rights, please contact our official address: info@viuu.cat.

2. Data We Process by Profile

Depending on how you interact with the platform, we collect only strictly necessary data:

  • Subscriber Users (No Registration): Subscribing to public calendars (via Apple Calendar, Google Calendar, or .ics download) requires no name or personal identification. If configuring "My Viuu", an anonymous technical identifier is retained solely to link your chosen subscriptions into a single feed URL.
  • Organizers & Creators (Registered Accounts): We collect your email address, entity name, public profile details (description, logo, official links), and securely encrypted login credentials managed via Supabase Auth. For paid plans, necessary billing details are collected.
  • Google Calendar Integration: When connecting an account or sharing an agenda with our Service Account, we access only the designated calendar identifier to publish and maintain official events. We never read, store, or process personal, private, or family events in your personal calendar.
  • Document & Poster Ingestion: When organizers upload PDF fixtures or graphic posters, our multimodal AI extracts public event data (times, fixtures, venues). Organizers should not upload sensitive personal data not meant for public dissemination.

3. Purposes of Processing

We process personal data for the following lawful purposes:

  • Managing user accounts and enabling the publishing and administration of dynamic calendars.
  • Generating RFC 5545 subscription feeds (.ics, webcal://) and personal curation via "My Viuu".
  • Real-time event synchronization with Google Calendar via API and Service Account.
  • Operating server-side caching infrastructure to protect against external rate limits and ensure uptime during heavy traffic.
  • Providing technical support, processing subscription billing, and fulfilling statutory compliance.

4. Legal Bases for Processing (GDPR Art. 6)

Our data processing is justified by:

  • Contractual Performance (Art. 6.1.b GDPR): Providing calendar publishing, synchronization, and account services requested by the user.
  • Legitimate Interests (Art. 6.1.f GDPR): Securing the platform against fraud/attacks and optimizing feed performance via caching to respect external API quotas.
  • Consent (Art. 6.1.a GDPR): Voluntary OAuth connection with Google or language preference selection.
  • Legal Obligation (Art. 6.1.c GDPR): Invoicing, accounting, and fiscal compliance.

5. Google API User Data Policy Compliance (Limited Use)

Viuu strictly limits its use of information received from Google APIs. Viuu's use and transfer to any other app of information received from Google APIs adheres strictly to the Google API Services User Data Policy, including the Limited Use requirements.

In automated Service Account synchronization mode, the organizer explicitly shares the designated public calendar with Viuu's Service Account email, granting edit rights solely over that specific calendar. We never utilize data obtained from Google APIs to train artificial intelligence models or for advertising, nor do we transfer it to commercial third parties.

6. Artificial Intelligence Processing (Google Gemini)

Viuu uses the Google Gemini API (Google Cloud) for optical character recognition (OCR) and structured calendar parsing. Processing is automated and ephemeral. Extracted document contents are transmitted via encrypted connection to Google Cloud enterprise servers to return formatted calendar drafts. This data is not used to train third-party public foundation models.

7. Data Recipients and Processors

We never sell or rent your personal data. We engage only trusted infrastructure providers acting as Data Processors bound by strict GDPR data processing agreements:

  • Supabase Inc.: PostgreSQL database hosting, encrypted storage, and authentication, with servers located in the European Union.
  • Google LLC / Google Ireland Ltd.: Google Calendar API and Google Cloud AI infrastructure, operating under the EU-US Data Privacy Framework and Standard Contractual Clauses (SCC).
  • Google Ireland Ltd. (Firebase App Hosting / Cloud Run): Application hosting and global CDN network providing secure feed caching.

8. Data Retention

Organizer account data is retained while the account remains active or until deletion is requested. Uploaded source files are purged or dissociated following ingestion review. Billing and fiscal records are retained for statutory retention periods mandated by applicable tax laws.

9. Your GDPR Rights

Under the GDPR, you hold full rights to:

  • Access: Confirm whether we process your data and receive copies.
  • Rectification: Correct inaccurate or incomplete data.
  • Erasure (Right to be Forgotten): Request deletion of your data when no longer needed.
  • Restriction and Objection: Limit processing or object under specific grounds.
  • Portability: Obtain your data in a structured, standard format (such as RFC 5545 .ics).

To exercise any of these rights, email info@viuu.cat with your request and proof of identity or account ownership.

Revoking Google Access: You may revoke Viuu's access to your Google account at any time via your Google Account Security settings ("Third-party apps with account access") or by removing our Service Account email from your calendar sharing settings.

10. Security Measures & Supervisory Authority

Viuu enforces strict technical and organizational safeguards (TLS/HTTPS encryption in transit, encryption at rest via Supabase, Row Level Security isolation). If you believe your data has been handled improperly, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD - aepd.es) or your local European supervisory authority.

AEPD (Agencia Española de Protección de Datos)APDCAT (Autoritat Catalana de Protecció de Dades)