Privacy Policy

Account data: email, name and profile photo. When you register with Google, we obtain them from your Google account with your explicit consent. If you upload a photo, we store it in our image storage and delete it when you change it, remove it or delete your account.

Usage data: if you save a draw, we store its name, participant list, winners and public seed. In addition, each completed draw reports a minimal operational event with a random identifier, draw type, participant source and count, winner count, language and whether the session was authenticated. If you are signed in, the event is associated with your internal user identifier.

Unsaved draws are not stored as history. The operational event does not include the draw name, participant or winner names, or the seed.

Payment data: payment history, amount, currency, payment method, status and date. Card data is processed exclusively by Mercado Pago or PayPal; we do not see or store it. From PayPal we keep the payer's country and the payment status, not their name or email.

Connection country: to show you the right currency and payment method, we use the country you connect from, which our hosting provider works out from your connection. We store it with each payment to prevent fraud.

Technical data: access logs for security and troubleshooting, retained for 30 days.

• We do not install tracking or advertising cookies.
• We do not share your data with third parties for marketing.
• We do not sell personal information.
• We do not store plain-text passwords: we use Argon2id with secure parameters.

When you create a draw and save the result, participant names are stored associated with your account. These names are the ones you entered or imported.

The public draw proof may be shared publicly. As organizer, you are responsible for informing participants about the use of their names.

The Import feature may extract public usernames from visible comments in compatible links. Only usernames for the draw are stored, not other profile data.

• Operate the service, save draws and manage payments.
• Send operational emails such as account verification and password reset.
• Prevent fraud and abuse of the service.
• Improve the product based on anonymous usage patterns.

Your data is retained while your account is active. If you delete your account from My account, your email is anonymized, credentials are removed and your draws are detached from your user history.

Minimal operational events are retained as historical metrics. When you delete your account, their association with your user is also removed.

You have the right to access, rectify, delete and request an exported copy of your data.

To exercise these rights, email privacidad@cuki-sorteos.com. We respond within 5 business days.

We use HTTPS, short-lived JWT tokens, httpOnly session cookies and Argon2id for passwords. Database access is restricted to the server's internal network.

Our main providers are Mercado Pago and PayPal for payments, Google OAuth for optional authentication, Apify for assisted import, Netlify for the website and Railway for backend hosting.

If we make relevant changes, we will notify you by email at least 15 days in advance. Minor changes are published directly on this page with the updated date.

For privacy questions: privacidad@cuki-sorteos.com