Personal data protection policy

version 1.2 · 7 August 2026

This policy explains what personal data Vuelopedia processes, what for, who it is shared with, how it is protected and how you can exercise your rights. It applies to the whole of vuelopedia.org and to its mobile application. It complies with Colombia’s Law 1581 of 2012 and Decree 1377 of 2013, and it also takes in the frameworks that cover visitors from other countries: the European Union’s GDPR and its United Kingdom equivalent, Brazil’s LGPD and Mexico’s Federal Personal Data Protection Law. Whatever country you are in, we grant you the same rights over your data.

The essentials, in a few lines. Today you can read the whole encyclopedia without registering and without handing over any data. We install no third-party trackers and we never sell or rent personal data. When we switch on user accounts (for Memories and the games), we will ask for the minimum — your name and your email — and handle it as described here.

1. Who is responsible for the processing

Data controller Fundación Poderia, a non-profit entity incorporated in Colombia, owner of the Vuelopedia project (vuelopedia.org). Institutional site: poderia.org.

Contact channel for personal data [email protected] — handles enquiries, requests and complaints about personal data (habeas data). It is the only channel enabled for these matters.

Administrative office Avenida Centenario, Carrera 6 con Calle 31, Vereda Tigreros, Centro Empresarial el Triángulo, Armenia, Quindío, Colombia.

Registered office Rionegro, Antioquia, Colombia.

The servers hosting the site and its database are located in Phoenix, Arizona (United States). See section 4 on international transfers.

2. What personal data we process

We collect the minimum needed for each function. These are the categories, including those that will be switched on once user accounts exist:

Technical browsing data (today) Visiting the site processes unavoidable technical data: IP address, browser type, pages visited and timestamps. It is used only to run the site, measure usage in aggregate and protect it from abuse. It is not used to profile you.

Strictly technical cookies (today) We only use cookies necessary for the site to work (for example, the light/dark mode preference and, once accounts exist, the session cookie). There are no third-party tracking cookies, which is why you will not see an intrusive cookie banner.

Account data (when you register) Full name, email address and, if there is one, the profile picture your identity provider shares (for example, your Google account). Sign-in will always be through a trusted provider: we will never store passwords of yours.

Content you choose to publish (future) If you record a Memory in an aircraft’s record (a name, a dedication, a story), that content will be linked to your account. You decide what you write and what is shown publicly.

Game data If you play the trivia, we keep your results, the Miles you accumulate and your place in the ranking, linked to your account.

Error reports you send us If you use the «Report errors or inaccuracies» button on a record, we keep your message, the record and the section you pointed to, and the date, linked to your account. Only we read it, to verify the fact and correct it if you are right: your text is never published on the site. We also keep our reply, so we can tell you about it next time you visit. It is deleted if you delete your account.

Payment data (future) Payments for Memories will be processed by a specialist external payment gateway. Vuelopedia will never see or store card numbers or banking credentials.

What we do NOT process. We do not collect sensitive data (health, ethnic origin, beliefs, orientation, biometrics), we do not buy third-party databases and we do not cross-reference your data with external sources to profile you.

3. What we use it for (purposes)

Run and protect the site

Serve the pages, keep your session signed in, prevent fraud, abuse and attacks, and diagnose technical faults.

Manage your account

Create and administer your user account, identify you at sign-in and let you edit or delete your information.

Provide the services you ask for

Record and display your Memories, issue their certificate, keep your trivia scores and show you in the ranking if you choose to take part.

Correct the encyclopedia with your help

If you report an error in a record, we use your message to verify the fact, correct it when you are right and tell you what happened with your report. Only we read your text; it is not published.

Strictly necessary communications

Transactional emails: confirmation of a Memory, security notices or relevant changes to this policy. We will not send advertising or newsletters without your prior, express consent, and you may withdraw it at any time.

Aggregate statistics

Understand, anonymously and in aggregate, which sections are used most, in order to improve the encyclopedia. Never at individual level.

Legal bases (GDPR). For visitors from the EU: performance of the service you request (art. 6.1.b), your consent (art. 6.1.a) for registration and any non-transactional communication, and our legitimate interest (art. 6.1.f) limited to site security and aggregate statistics. In Colombia, the processing rests on your prior, express and informed authorisation, except in the cases the law exempts.

4. Who it is shared with, and international transfers

We do not sell, rent or hand over personal data to anyone for commercial purposes. Only the technical providers essential to running the site are involved, acting as data processors under their own data protection safeguards:

Hosting of the site and the database Our hosting provider (GoDaddy, with servers in its Phoenix, Arizona data centre, United States) stores the encyclopedia database and, once they exist, the user account tables.

Site security and delivery Cloudflare processes the site’s traffic (including your IP address) to protect it from attacks and serve it faster from its global network. It also verifies, through its Turnstile service, that whoever sends an error report is a person and not an automated program; that check does not track you across sites and is not used for advertising.

Identity provider (when you register) If you choose to sign in with an external account (Google, for example), that provider confirms your identity to us and shares your name and email. Its processing is governed by its own privacy policy; we never receive your password.

Payment gateway (once Memories exist) It will process payments as an independent controller. Vuelopedia stores no financial data.

International transfer. These providers involve transferring data to the United States and to other countries where their networks operate. We choose providers with recognised security and data protection standards, and we limit what is transferred to the minimum necessary. In addition, competent authorities may require data by legal order; we will only comply with legally valid requests.

5. Your rights as a data subject

In Colombia (Law 1581 of 2012)

You have the right to know, update and rectify your data; to request proof of the authorisation granted; to be informed of the use made of it; to withdraw your authorisation and request deletion where no legal duty to keep it exists; to access it free of charge; and to complain to the Superintendency of Industry and Commerce (SIC), Colombia’s data protection authority (www.sic.gov.co).

In the European Union and the United Kingdom (GDPR / UK GDPR)

You have the rights of access, rectification, erasure («right to be forgotten»), restriction of processing, portability of your data and objection, as well as to withdraw your consent at any time without affecting the lawfulness of prior processing, and to complain to your country’s supervisory authority.

In Brazil (LGPD, Law 13,709/2018)

You have the right to confirmation that processing exists, to access and correct your data, to its anonymisation, blocking or deletion where it is unnecessary or excessive, to portability, to information about who it is shared with, and to withdraw your consent. You may complain to the National Data Protection Authority (ANPD).

In Mexico (Federal Personal Data Protection Law, 2025)

You have the ARCO rights: Access to your data, Rectification of anything inaccurate, Cancellation when it should no longer be processed and Objection to the processing, as well as withdrawal of consent. This policy serves as the privacy notice. The competent authority is the Anti-Corruption and Good Governance Secretariat.

Are you somewhere else? (United States, Canada, Australia and the rest of the world.) We voluntarily extend the same rights to you: access, correction, deletion and objection, through the same channel and within the same time limits. And our central commitment applies to everyone equally: we never sell or hand over your personal data for commercial purposes — what laws such as California’s (CCPA) call the «sale» or «sharing» of data — we use no trackers, and accounts are intended for people aged 14 and over, above the child protection threshold of laws such as the United States COPPA.

6. How to exercise your rights

Write to us at [email protected] from the email linked to your account (or proving your identity), stating which right you wish to exercise and over what data. Once user accounts exist, you will also be able to view, correct and delete your account directly from the site itself, without having to ask.

Enquiries Answered within a maximum of 10 working days from receipt. If that is not possible, we will tell you why and give a new date, which will not exceed the following 5 working days.

Complaints Handled within a maximum of 15 working days. If the complaint is incomplete, we will ask you to complete it within the following 5 days; if it cannot be handled in time, we will tell you why and give a new date, which will not exceed the following 8 working days.

7. How we protect the information

Encryption in transit The entire site runs exclusively over HTTPS (TLS). No information travels in the clear.

No passwords of our own Access to accounts will always be through external identity providers. Since no passwords exist in our database, none can be stolen from it.

Least privilege The public layers of the site reach the database with minimum-permission users, and the account databases will be kept separate from the encyclopedia.

Minimisation We collect the minimum, we do not keep what is not needed, and sessions are stored using one-way techniques (hashing), not in the clear.

No system is infallible. Should a security incident affecting your data occur, we will notify those affected and the authorities in accordance with the law.

8. Minors, retention and validity

Minors The encyclopedia is open and suitable for everyone: anyone — including children and teenagers — can read it, learn and play without registering and without handing over any data. The minimum age of 14 applies only to creating an account, because an account means giving us personal data and the law requires capacity to authorise that processing; it is not a content restriction. Memories, because they involve payment, require legal adulthood or the involvement of an adult. If we detect the account of someone under 14 without their guardian’s authorisation, we will delete it.

How long we keep data Your account data, for as long as the account exists. If you delete it, your personal data is deleted; we will keep only what legal obligations strictly require (for example, the accounting records of a payment) for the periods the law sets. Technical security logs are kept for short periods.

Changes to this policy This policy is in force from 25 July 2026 and its current version is 1.2 (7 August 2026); it remains valid while the site operates. Version 1.2 removed the statement that the site shows no advertising, since the project may introduce advertising to sustain itself; the other commitments remain (we do not sell or share your data, and we install no third-party trackers nor profile you). Version 1.1 had added the error reports that registered users can send us from each record (what we keep, what for and for how long) and the anti-bot check on that form. If we make substantial changes, we will update the version and the date on this page and, if you have an account, we will notify you by email. Databases holding personal information are kept while the purposes described here still apply.

Language of this policy. This is a translation provided for convenience. Vuelopedia is a Colombian project and the authoritative text of this policy is the Spanish version. In the event of any discrepancy or difference of interpretation between the two, the Spanish version prevails.

Fundación Poderia · Vuelopedia — Personal data protection policy, version 1.2, 7 August 2026.