Privacy policy

Who we are

Bingwa is run by Hekima Labs, S.L., a Spanish sole-member limited company (sociedad limitada unipersonal), tax ID B26960278, registered office in Madrid, Spain, registered in the Madrid Commercial Registry (Registro Mercantil de Madrid). We decide how your data is used (we are the "data controller").

Questions or requests about your data: contacto@hekimalabs.com.

What we collect

• The two names you type to make a card: yours and your friend's. They travel to our server to draw the card and they appear in the card's web address and picture. We do not keep a list of cards or of who made them.
• To check that the names are not abusive: the name, our verdict (ok, doubtful or blocked) and a scrambled code made from your internet address, kept for 30 days. The code cannot be turned back into the address and the name is not linked to a card or to any account.
• Counts only: how many cards were made and shared for each match each day, which share button was used, how many visits came from our Instagram, our WhatsApp channel or our ads, and how many came from each country and for fans of which club. The country is worked out from your internet connection at the moment of the visit and only the country is counted: your address is not kept. These numbers never say who.
• Short technical logs kept by our hosting company (internet address, browser, pages opened). Because the names are part of a card's address, they appear in these logs too.
• Outside Europe, a small measurement script from OpenAI, to know whether our ads on OpenAI bring visitors. It receives the address of the page, the time, an identifier kept in two cookies (see below) and, when you share a card, the fact that you shared one. It never receives the names you type or anything else about you. In the European Union, the United Kingdom, Switzerland, Norway, Iceland and Liechtenstein, and when we cannot tell the country, the script stays off and sets no cookies.

What we never ask for

Your phone number, an account or a password, your contacts, your location, your photos or documents, or any payment details. Bingwa is free.

Why we use it

• To make and show the cards you ask for.
• To keep the service safe: blocking abusive names and limiting how often one connection can ask for cards.
• To know how many people use Bingwa, from which countries and which channels, and for fans of which clubs (and, in the future, to show a sponsor how many cards are seen and shared). Only counts.
• To measure the results of our ads on OpenAI (outside Europe, with the measurement script described above).

Who sees what

• A card is a picture you choose to send. Whoever you send it to sees the two names on it. Nobody else sees it unless you or they share it.
• We do not publish cards or names. There is no wall and no public list.
• Sponsors get only totals (how many cards were made and shared with their name, by country and club). Never names, addresses or anything about you.
• We never sell your data and we do not use it for advertising.

Companies that help us

They only handle your data to provide their service to us:

• Supabase: our database (counts, name checks and the burns for each match), in the European Union (Ireland).
• Vercel: hosts and runs the website (in the European Union, Ireland) and keeps the technical logs described above.
• Anthropic (Claude): writes the burns for each match from the teams and the result (no data about you), and may check the names you type to catch abusive ones. For the check it receives only the name, never your internet address.
• Match results come from football-data.org. We send them no data about you.
• OpenAI (ads measurement): where the measurement script is on, it receives what is described above and applies OpenAI's own privacy policy. Where it is off, it receives nothing.
• Instagram and WhatsApp (Meta): if you follow our accounts, Meta's own privacy rules apply. Opening our links from there tells us only which channel you came from.

Where your data is

Our database and website run in the European Union (Ireland). Some providers may process data in other countries, including the United States. We move data only with the safeguards required by the Data Protection Act of Kenya (2019), the Personal Data Protection Act of Tanzania (2022), the Data Protection and Privacy Act of Uganda (2019) and the European Union's GDPR.

How long we keep it

• Name checks (the name, the verdict and the scrambled code): 30 days.
• Counts per day, including the counts per country and club: as long as we run Bingwa. They contain no personal data.
• Technical logs: the period set by our hosting company, which is short.
• The two measurement cookies (where the script is on): 30 days and 365 days, as explained below.
• The burns written for each match: as long as the match is in our list. They contain no personal data.

Cookies and your browser

We only use what the service needs, plus the measurement cookies of our ads described below. No cookies that follow you across other sites.

• If you arrive from our Instagram, our WhatsApp channel or our ads: for 7 days, a cookie with only which of them you came from, so we can count (never who) how many visits each brings. A second one marks the day, so a visit counts once.
• Outside Europe, the ads measurement script sets two cookies on bingwa.net: one remembers for 30 days which OpenAI ad brought you, and the other holds a random reference of your browser for 365 days. Neither contains your name or anything about you. In Europe, the United Kingdom and Switzerland they are not set.

Your rights

You can ask to see, correct or delete your data, or object to how we use it. Because we keep so little, and none of it is linked to an account, we may need a name and a time to find it.

Write to contacto@hekimalabs.com.

If you are not happy with our answer, you can complain to the Office of the Data Protection Commissioner (Kenya), the Personal Data Protection Commission (Tanzania), the Personal Data Protection Office (Uganda) or the Spanish Data Protection Agency (AEPD).

18 and over only

Bingwa is only for people aged 18 and over. We do not check documents. If we learn that someone is younger, we delete what we hold about them.

Changes

If we change this policy, we will update the date above. If the change is important, we will tell you on the site.