Privacy policy

Summary

The controller is Burgo, operated by José Burgos (natural person), based in Maracaibo, Venezuela. Contact: dev@burgo.dev.
We ask only for the data each service needs, and we use no third-party cookies or tracking pixels.
Between apps, only your account identity is shared (id, nickname, email, avatar). What you record in one app cannot be seen from another.
We do not sell data and there is no advertising.
You can ask for access, correction, deletion or a copy of your data by writing to the contact email. We aim to reply within 30 days at most.
You must be 16 or older to create an account.
Some features (account deletion and export, versioned acceptance of these texts, own analytics) are in preparation and do not exist yet. We say so wherever it applies.

⚖️ Pending lawyer review. This text is a technical draft. Venezuela has no comprehensive data protection law and no supervisory authority: protection rests on article 28 of the Constitution (habeas data), the principles of Supreme Court ruling 1318/2011 and sector-specific rules. A lawyer must confirm what else is required, especially for users outside Venezuela.

Who is responsible

Burgo, operated by José Burgos (natural person). City: Maracaibo, Venezuela. Email for privacy, rights requests and reports: dev@burgo.dev. That address is forwarded to José’s personal mailbox.

Burgo is not currently an incorporated company. If that changes, this document will be updated with the new legal name and the change will be announced.

When the service is Cabal and the data belongs to a business’s customers, the business is the controller of that data and Burgo acts as processor. See the Cabal data processing agreement.

What data each service handles

Each service states what data it uses, why, on what legal basis, who sees it and how long it is kept. The legal bases we use are: contract (needed to give you the service), legitimate interest (security, abuse prevention, moderation) and consent (you give it expressly and can withdraw it).

Server logs (all sites)

Data: IP address, date and time, page or route requested, browser type.
Why: to keep the service running and detect abuse and attacks.
Legal basis: legitimate interest.
Who sees it: the operator, only for support and security.
Retention: 30 days at most for application logs; 90 days for security logs.

Account and administration

Data: email, password (stored only as a hash, never in plain text), second factor if you enable it, open sessions and access logs.
Why: to create and protect your single account, which signs you in to Burgo’s apps.
Legal basis: contract; security under legitimate interest.
Who sees it: you and the operator, only for support and security.
Retention: as long as the account exists. On deletion, see Delete your account.

Cancha

Data: profile (nickname, avatar), groups, matches, group chat messages and shared expense notes.
Why: to organise matches and groups. Payment requests are informational only: Cancha does not process payments.
Legal basis: contract.
Who sees it: the members of your group. The operator reads only reported messages and their immediate context (see Acceptable use).
Location: the app works with the location of pitches, which are public places; it is not designed to store your personal location.
Retention: as long as the group exists and, for messages, up to 12 months at most.

Pique

Data: whoever hosts a game has an account; players join with a room code and a temporary nickname, without email.
Why: to play live trivia.
Legal basis: contract; legitimate interest to filter offensive nicknames.
Who sees it: the host and the other players in the room.
Retention: data from a guest game is deleted after 24 hours.
Schools: we ask teachers not to use students’ full names. No photos or free chat are requested.

Brío (food and workouts)

Data: weight, measurements, food intake and workouts. This is health data.
Why: to keep your personal food and training log.
Legal basis: explicit consent, separate and revocable. If you withdraw it, we delete that data.
Who sees it: only you, unless you decide to share it.
Notice: Brío is not a medical device and does not replace a health professional.
Retention: until you delete it or delete your account. The versioned record of your consent is in preparation.

⚖️ Pending lawyer review. Health data calls for an impact assessment and a consent text drafted by a professional, especially if there are users in the European Union.

Cuadre (personal finance)

Data: expenses, debts, categories and notes that you enter.
Why: to keep your accounts. Cuadre does not move, receive or hold money.
Legal basis: contract.
Who sees it: only you; debts between users require the other person to accept them.
Rates: when it shows a conversion it uses only the official BCV rate, with its source and time.
Retention: until you delete it or delete your account.

Fase (not published)

Fase, the community power-outage notice, is not published and is under legal review. Today it collects no one’s data. If it is published, this document will be updated beforehand with its handling (planned design: approximate location of about 500 m, closed statuses with no free text, and raw reports kept 90 days at most).

⚖️ Pending lawyer review. Whether publishing Fase carries criminal risk over information about blackouts. It is not published without that review.

Sobre

Data: account, email, Telegram identifier if you link the bot, and your price and stock alerts.
Why: to notify you when a card changes price or stock.
Legal basis: contract; consent to link Telegram.
Who sees it: you and the operator, for support.
Additional provider: Telegram, only if you link the bot.
Retention: as long as the account exists.
Notice: Sobre is an independent project, built on commission for a partner and under construction. It is not affiliated with The Pokémon Company or the stores it checks; prices and stock carry no guarantee.

⚖️ Pending lawyer review. Use of stores’ data, Pokémon trademarks, affiliate links and whether the partner is a joint controller.

Cabal

Business account (owner and team): name, email and sign-in data. Here Burgo is the controller. Legal basis: contract.
Data of the business’s customers (name, ID or tax number, bank, reference, payment receipts): the controller is the business and Burgo is the processor: it handles them only to provide the service and on the business’s instructions. See the processing agreement.
Pay-by-link portal: the payer sees a short notice before uploading a receipt: who receives their data (the business), why (to reconcile the payment) and how to contact it.
Retention: set by the business. Configurable receipt retention and deletion of a customer while keeping their payments pseudonymised are in preparation.
Plans and prices: see Cabal plans.

burgo.dev contact form

Data: name, company (optional), project description and email.
Why: to reply to you and prepare a proposal.
Legal basis: pre-contractual steps and your consent when you send it.
Who sees it: only the operator.
Retention: for the length of the conversation; if there is no project you can ask for deletion. The maximum period is to be defined.

Demos and portfolio

Demos of client proposals: they run only in your browser and send no data. They are not those businesses’ official sites.
Portfolio (jose.burgo.dev): a static site with no forms or personal data.

What is shared between apps

Only the account identity: id, nickname, email and avatar. Each app’s data lives in its own space and cannot be read from the others. We do not share data with third parties for commercial purposes.

Providers and where the data is

These are the real providers involved. More detail in Sub-processors. The services’ data sits on servers in the United States, so your data is transferred outside Venezuela.

Contabo (VPS). Hosting of the applications, databases, files and logs. Where the data is: United States. What data: All data of the services described in the privacy policy. Scope: burgo.dev, Account, Cancha, Pique, Brío, Cuadre, Sobre and Cabal.
Cloudflare. DNS for the burgo.dev domain and inbound email forwarding (from dev@burgo.dev to José’s mailbox). Where the data is: Provider’s global network. What data: DNS queries and the content and metadata of emails sent to dev@burgo.dev. Scope: Domain and contact email of all sites.
Google (Gmail). Mailbox where José receives the email forwarded from dev@burgo.dev. Where the data is: According to Google’s infrastructure. What data: Emails you send us (inquiries, rights requests, reports). Scope: Only handling of those who write to us.
Postfix propio. Our own outbound mail server (application notices and messages), with no sending intermediary. Where the data is: On the same VPS (United States). What data: The recipient’s email address and the message content. Scope: Account, Cabal and notices of the applications that send email.
Telegram. Sobre alert bot, only if the user links it. Where the data is: According to Telegram’s infrastructure. What data: Telegram identifier and the text of the alerts sent. Scope: Sobre only.
Square. Card payments in client projects that use it. Not used on burgo.dev or in Burgo’s apps. Where the data is: United States (per the provider). What data: Payment data that the end customer enters into the Square flow; Square handles it as the client business’s provider. Scope: Only client projects that contract it.
GitHub. Source code hosting. No user data is uploaded. Where the data is: According to GitHub’s infrastructure. What data: Code and its history; no users’ personal data. Scope: Development of all projects.

⚖️ Pending lawyer review. Clauses and notices for international data transfers and, if there are EU users, a transfer mechanism.

How long we keep data

These are the maximum periods we aim for. Automatic log cleanup is in preparation; there is no guaranteed process yet, so these periods are a goal, not a promise.

Data	Period	Notes
Application and access logs	30 days	IP truncated or hashed after 7 days
Security logs	90 days	Sign-ins, failures
Administration action audit	1 year	Append-only, never edited
Reports and moderation decisions	1 year after resolution	Copy of removed content: 30 days, in case of appeal
Deleted account	30-day grace period	Then deleted; backups rotate within 35 days at most
Cancha chat messages	While the group exists, 12 months at most	Those of deleted accounts are anonymised
Pique guest games	24 hours
Brío and Cuadre records	Until you delete them
Backups	35 days	Encrypted

Your rights and how to exercise them

You have the right to:

Access the data we hold about you and know what we use it for.
Rectify incorrect data.
Delete it (erasure).
Receive a copy in a structured format (portability).
Object to processing or ask for it to be restricted.
Withdraw your consent where processing relies on it.

Write to dev@burgo.dev from your account email, saying what you want. We aim to reply within 30 days at most, with no guarantee while handling is manual. Today these requests are handled by email; deletion and export from your own account are in preparation. To delete your account, follow the steps in Delete your account.

Venezuela also recognises the right of habeas data (article 28 of the Constitution), which is exercised before the courts. If you live in the European Union, your rights may be broader (including a complaint to your data protection authority).

Security and breaches

We use encrypted connections (HTTPS), store passwords only as hashes, isolate each business’s data in Cabal, and give the operator access only when needed. No system is infallible. If a breach affecting you occurs, we will tell you without undue delay (goal: 72 hours from confirming it) with what happened and what to do. The internal incident protocol is in preparation.

Minors

To create an account you must be 16 or older. Pique lets you play without an account using a temporary nickname, collecting no personal data. If we find an account belonging to someone under 16, we suspend it and delete its data. If you believe a minor is using an account, write to us.

Cookies and storage

We only use a security session cookie and the browser’s local storage to remember theme, language and demo state. There are no third-party cookies. Details in Cookies and storage.

What is in preparation

Not yet available: versioned acceptance of these texts by each user, per-feature consents with a record, account deletion and export from the app, own cookie-free analytics, automatic log retention, a log of rights requests with deadlines and a formal incident protocol. Until they exist, they are handled by email and manually.

Changes and versions

This is version 1.0, in force since November 2, 2026, and is a draft pending legal review. If it changes materially we will give at least 15 days’ notice on this site and, once available, inside the apps. Earlier versions can be requested by email.