1. Controller / publisher
ARQUIWALK is published under the Arquiweb brand by Joan Manuel Barrera Beltri.
Contact: [email protected]
Project correspondence address: Brendon House, Park Road, Winchester, SO23 7BE, United Kingdom
This is a project correspondence address and is not presented as a registered company office.
2. Data used by the service
The route guide works without a social account. An optional Community account stores email, display name, alias, a one-way salted password hash, account timestamps, session records and profile data you choose to provide. Profiles can include biography, preferred language, interests, an optional broad location label and a symbolic avatar. The social profile has no field for precise live location.
Community activity may create posts, comments, reactions, saved items, follows, notifications, reports, moderation records and reputation events. Newsletter sign-up, if used, stores the email, preferences and consent evidence; automatic newsletter delivery remains disabled until a mail provider and confirmation flow are configured.
3. Security and abuse prevention
Signed-in sessions use a Secure, HttpOnly, SameSite cookie. Passwords are not stored in plain text. Rate limiting derives a pseudonymous hash from request-network information and a server-side pepper; the social rate-limit table does not retain the raw IP address. Cloudflare may separately process request and security logs as infrastructure provider.
4. ARQ Guide and AI
The assistant retrieves ARQUIWALK route data, published Magazine material and eligible public Community content before generating an answer. It is designed not to use private profiles, closed-community content or administrative records in public answers. Questions are not automatically used to train a model. If a user explicitly enables the knowledge-gap option, ARQUIWALK may store a short sample query and normalized topic without the social user ID. Do not put sensitive personal data in assistant questions.
5. Analytics and advertising
Google Analytics and Google AdSense are optional in ARQUIWALK's local consent layer and are not intentionally loaded until the relevant choice permits them. Provider-side consent requirements must also be configured where applicable. The local layer honours Global Privacy Control for advertising choices where supported.
6. Purposes and lawful basis
Data is used to provide requested account/community features, protect the service, respond to moderation or rights requests and meet applicable obligations. Optional analytics, advertising and newsletters depend on the consent or other lawful basis required in the relevant jurisdiction. ARQUIWALK does not claim that one legal basis applies identically worldwide.
7. Retention
Normal social sessions expire after 30 days unless removed earlier. Rate-limit buckets are routinely cleaned after a short anti-abuse window. Account and contribution data remains while the account is active or as needed for the service; the account-deletion control removes the account and data linked through database cascade rules. Some moderation, legal, backup or provider records may need separate retention where justified.
8. Rights and controls
Depending on applicable law, you may have rights to access, correct, delete, restrict or object to processing, portability, withdraw consent and complain to a supervisory authority. Signed-in users can edit their profile, export their ARQUIWALK account data and delete their account. Analytics/advertising choices can be reopened from the footer.
9. International providers
Cloudflare and Google are global providers and may process data in multiple locations subject to their terms and transfer safeguards. ARQUIWALK aims to minimise optional data flows and uses Cloudflare D1/R2 for platform data/media where configured.
10. Younger users
The public route guide is general-audience content and does not require registration. Social registration in v5.26 is restricted to people who confirm they are 18 or older. Social accounts for minors are not enabled until an appropriate age/guardian-consent and risk-control system is implemented. There is no open private-messaging module.
11. Changes
Material changes may require an updated notice or renewed consent. Last updated: 18 October 2026.