cetra← Back to the website1. Data controller
- Provider: Eduardo Moreno Millán
- Tax ID (NIF): 77216145Q
- Registered address:Av. Patio de los Naranjos 21, Esc. 1, 3.º B · 50022 Zaragoza (Spain)
- Phone: +34 642 19 82 40
- Email:support@cetraapp.com
These details are published under Article 10 of Spanish Law 34/2002 on information society services and electronic commerce.
This policy explains what personal data we process, why, for how long and what you can require from us, under the General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
2. Scope
It applies to the Cetra app (iOS and Android) and to the cetraapp.com website. It does not apply to the streaming platforms or app stores Cetra links to: those have their own policies and answer for them.
3. What data we process
3.1. What you give us
- Email address, needed to register and authenticate.
- Password, if you create the account with an email. It is stored encrypted and we cannot see it.
- Your Apple or Google identifier and email, if you sign in with one of those services, plus any name you choose to share with us through them.
- Catalogue region and language you select, so we know which availability to show you and in which language.
- Which streaming platforms you subscribe to, which you tell us in order to filter results.
- Lists and collections you create, with their name and description, and the groups you take part in.
3.2. What your use generates
- Interaction history: titles shown, saved, dismissed and rated.
- Preference vector derived from that history, which is what makes recommendations possible.
- Technical data: IP address, device model, app version and error logs.
- Device token for push notifications, only if you enable them.
3.3. Subscriptions
We process the purchase identifier and subscription status reported to us by the App Store or Google Play through RevenueCat, in order to give you access to Cetra PRO. We do not see or process your card details: payment happens entirely within the store.
3.4. Advertising
On the free tier, Google AdMob uses the device’s advertising identifier (IDFA on iOS, AAID on Android). It is only used for personalised advertising if you consent through the prompt your operating system shows you; you can withdraw that at any time in your device settings.
3.5. On the website
The server hosting cetraapp.com logs the IP address, browser and page requested, for security and diagnostics. The website uses no cookies and no analytics tools, and the fonts are hosted on our own server, so visiting it sends nothing to third parties.
3.6. Posters
Film and TV images are loaded directly from TMDB’s servers (image.tmdb.org), so TMDB receives your IP address when you view them, as happens with any image hosted outside a website. We send them no other data about you.
4. Why we process it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating your account, authenticating you and providing the service | Performance of the contract |
| Recommending titles based on your taste and your platforms, which is the app’s purpose | Performance of the contract |
| Hosting and displaying your lists, and running Group Mode | Performance of the contract |
| Managing your Cetra PRO subscription | Performance of the contract |
| Sending you confirmation, verification or password-reset emails | Performance of the contract |
| Sending you push notifications | Your consent, given to the operating system |
| Showing personalised ads and using the advertising identifier | Your consent |
| Showing non-personalised ads to sustain the free tier | Legitimate interest in funding a free service |
| Measuring product usage in order to improve it | Legitimate interest in improving the service |
| Detecting and preventing fraud, abuse and automated use | Legitimate interest in protecting the service |
| Keeping the records the law requires us to keep | Compliance with a legal obligation |
Where the basis is consent, you can withdraw it at any time without affecting processing already carried out. Where it is legitimate interest, you can object and we will assess it.
5. Who else is involved
5.1. Providers processing data on our behalf
- Supabase — database, authentication and app server.
- Netlify — website hosting.
- Resend — delivery of authentication and verification emails.
- Firebase Cloud Messaging (Google) — delivery of push notifications.
- RevenueCat — subscription status management.
- PostHog — product usage measurement.
- Google AdMob — advertising on the free tier.
- Google (Gemini API) — generating preference vectors. The processing happens on our server; Google receives the text needed for vectorisation, not your identity.
5.2. Data sources that receive nothing about you
TMDB, JustWatch and Movie of the Night supply us with title metadata and availability. They are information sources: we disclose no personal data about you to them, with the single exception of your IP address when your device downloads a poster from TMDB (section 3.6).
We do not sell your personal data, nor disclose it to third parties for advertising purposes other than those described here.
6. Transfers outside the European Economic Area
Some of those providers are established in the United States or process data there. Where that happens, we require the transfer to rely on an adequacy decision of the European Commission — such as the EU-US Data Privacy Framework — or on standard contractual clauses approved by the Commission, with any additional safeguards required. You can ask us which mechanism applies to a specific provider by writing to support@cetraapp.com.
7. How long we keep it
We keep your data while your account is active.
You can delete the account and all its data from Settings › Account. Deletion is immediate and irreversible: we keep no copy we could restore.
Two things, and only these two, survive deletion:
- Transaction records we must keep to comply with tax and accounting obligations, for the periods Spanish law sets.
- Technical and security logs, which are deleted on a short rolling basis.
8. Profiling and automated decisions
To recommend titles we build a preference profile from your history, using natural-language processing and vector representation. That is profiling in the GDPR sense, and we say so plainly.
We take no automated decisions with legal effects on you. The only thing the algorithm decides is the order in which we show you films and series.
You can object to this processing by writing to us, with the natural consequence that recommendations will stop matching your taste. If you delete your account, the profile is deleted with it.
9. Your rights
You can exercise, free of charge and at any time:
- Access to the data we hold about you.
- Rectification of anything inaccurate.
- Erasure, which you can carry out yourself from Settings › Account.
- Restriction of processing.
- Objection to processing based on legitimate interest, including profiling.
- Portability: receiving your data in a structured, commonly used format.
- Withdrawing consent you have given, without retroactive effect.
How: from the app’s settings, or by writing to support@cetraapp.com. We will reply within one month, extendable if the request is complex.
If you are not satisfied with our reply, or believe we are processing your data improperly, you can lodge a complaint with the Spanish Data Protection Agency, the Agencia Española de Protección de Datos (www.aepd.es), or with the supervisory authority of the EU country where you live. You do not have to complain to us first, although it is usually quicker.
10. Children
Cetra is not aimed at children under 14 and we do not knowingly process data of anyone below that age. If such an account comes to our attention without a guardian’s consent, we delete it.
11. Cookies and storage
The website uses no cookies. There is no advertising, no analytics and no third-party resources that would set them, so there is nothing to consent to and no banner to accept.
The app stores data on the device itself — your session, your preferences and a local copy of content so it runs fast and offline. That never leaves your phone and disappears when you uninstall the app.
12. Security
We apply reasonable technical and organisational measures: encryption in transit, passwords stored with key-derivation functions, restricted database access, and row-level access rules so that nobody can read another user’s data. No system is invulnerable; should a breach affecting your rights occur, we would inform you and notify the authority within the statutory deadlines.
13. Changes to this policy
If it changes, it is published here with a new update date. Where the change is substantial we will announce it in the app or by email before it affects you.
14. Language of this document
The original and only binding version of this policy is the Spanish one. Versions in other languages are informative translations; if any of them says something different, the Spanish version prevails.