Privacy policy
Data controller
The data controller is Ángel González de la Flor. Tax details and the contact channel for exercising rights remain pending publication.
This policy describes the version published at neurodinamicatlas.com and reviewed on 7 October 2026. Fields marked xxxx remain incomplete.
Current operation
The public atlas has no student account registration or payments. The notification form is disabled. Administration uses private access authenticated through Cloudflare Access and is unavailable to anonymous visitors.
The browser remembers language, appearance and background preferences and saves the project locally when session fields change, samples are recorded or an exercise is imported. The project includes project, participant, condition, trial and examiner identifiers, notes and model states. These fields may contain personal data if you enter it. Do not use it as a medical record. See Local storage for the names and retention of these data.
Files, hosting and external services
Exports create files in the browser for download. Viewer resources load from the distribution itself; external links open when consulted.
The website uses Cloudflare Pages for hosting and Cloudflare’s network for delivery and security. Requests may involve IP address, date, requested URL and technical browser data. Storage exclusively in Spain or the EU is not guaranteed. The contracted entity, data processing agreement, international transfer safeguards and specific log retention period must be verified in the owner’s account: xxxx.
If the form is activated, contacts will be stored in Neurodinamic Atlas’s own CRM, with access restricted to the administrator. Production and test databases have been created in Cloudflare D1 with European Union jurisdiction. This restriction applies to the database, not to all access or to Cloudflare request processing. The controller’s identity and contact information must be completed and agreements, recipients, transfers and retention periods verified before collection is activated. The CRM does not send email campaigns or process payments.
If the form is activated, Cloudflare Turnstile is planned to prevent automated submissions. Turnstile will process technical signals such as the IP address and browser and site data. Under its policy, Cloudflare acts as a processor to protect the site and as an independent controller to improve bot detection. Before activation, the applicable agreement, the legal basis for site protection, retention and transfers will be verified and this information updated. Provider policy: https://www.cloudflare.com/turnstile-privacy-policy/.
The site collects its own statistics about navigation and atlas use: pages and sections, link referrals limited to the domain, campaign labels, language, device type, browser, operating system, approximate country, actions, time with the tab visible and performance measurements. Each tab uses a temporary random identifier held in memory, without cookies or persistent browser storage. The application does not store IP addresses, form values, complete URL queries or error messages in these statistics. Cloudflare processes network requests to provide the service. Collection respects Do Not Track and Global Privacy Control and excludes administration and tests. Events are retained for up to 90 days and are accessible only from the private dashboard. Statistics do not identify returning visitors or establish attention or sales.
Purposes, legal bases and retention
No new processing will be enabled without specifying its purpose, required data, legal basis, recipients and retention. General consent will not be used for all purposes.
Plan notices and news: the form is not active yet. When “Notify me” or “Get atlas news” is enabled, we will process your email, your name if provided, your profile, the plan you are interested in, your language, the page you sign up from and the text and date of your consent. The purpose will be to notify you when plans open and send you atlas news. The legal basis will be your consent, which you may withdraw at any time without affecting the lawfulness of earlier processing. We will keep the data until you withdraw consent or request erasure; we will stop sending notices when you withdraw it. Before the form is activated, the controller’s identity and contact channel, currently pending, will be provided.
You can disable first-party statistics from Privacy or Cookies and local storage. The preference is remembered in this browser. Do Not Track and Global Privacy Control also prevent collection. This option does not block the hosting provider’s necessary technical logs.
Using a temporary identifier without cookies does not, on its own, establish that statistics are anonymous or automatically exempt them from data protection obligations. The controller must document the legal basis, legitimate interests balancing test and provider agreements.
| Processing | Purpose and legal basis | Retention |
|---|---|---|
| Preferences and local project | Remember requested settings and the exercise saved on the device. | Until deleted by the user or browser. |
| Website delivery and security | Technical connection data to deliver resources and prevent abuse. Intended basis: legitimate interest in operating and protecting the service, subject to the controller’s necessity and balancing assessment. | Cloudflare log retention period awaiting verification: xxxx. |
| Future accounts, payments or communications | Not active in this prototype. Purposes and legal bases: xxxx. | xxxx |
| First-party usage statistics | Measure usage and performance to improve the atlas. Intended basis: legitimate interests, subject to the controller’s documented assessment and balancing test. | Events for a maximum of 90 days; tab identifier held only in memory. |
Rights and enquiries
Where applicable, you can exercise rights of access, rectification, erasure, objection, restriction and portability, and withdraw consent without affecting the lawfulness of prior processing. Request email: xxxx. The atlas’s own code does not make automated decisions with legal effects or advertising profiles.
Requests will normally be handled within one month; an extension of up to two further months due to complexity or number of requests must be notified within the first month. Additional identification will only be requested where there are reasonable identity doubts. You may lodge a complaint with the Spanish Data Protection Agency at https://www.aepd.es. The controller’s contact channel is still pending.
Minors and changes to the service
The prototype is intended for university and professional education. Age policy and access for minors in a future version: xxxx.
Before adding accounts, progress tracking, analytics, payments, cloud storage or clinical data, this policy and the actual processing must be reviewed.
Sensitive data and educational activities
Use fictional or anonymised exercises. The atlas does not provide medical record storage or a channel for sending health data to the operator.