Privacy policy
Last updated: 2 October 2026
This policy explains what personal data Chilli FM collects when you visit our website, listen to us, send a shoutout or get in touch, why we collect it, and the rights you have over it.
1. What we collect and why
What we collect depends on how you use Chilli. Here is each case, with the legal basis under the GDPR and how long we keep the data.
2. Who we share your data with
We never sell your personal data. We share it only with:
- Service providers that help us run Chilli, such as website hosting, Cloudflare, our streaming provider, Google (Firebase and Analytics, in our apps), OneSignal (push notifications), WhatsApp and our email provider. They may only use your data on our instructions.
- Competition sponsors, where you win a prize they provide.
- Authorities, where we are legally required to, or to protect our rights or someone’s safety.
3. Transfers outside the EU
Some of our service providers, such as Google, Meta (WhatsApp) and OneSignal, may process data in the United States. Where they do, the transfer is protected by the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.
4. Cookies
Our website uses no advertising or tracking cookies, so there is no cookie banner. Cloudflare, which protects and delivers the site, may set a strictly necessary security cookie. To count visits we use Cloudflare Web Analytics, which works without cookies.
The player keeps a few things in your browser’s own storage so the site works as you’d expect: your volume, the songs you’ve liked (with a random ID, not linked to your name, so a song can’t be liked twice) and recently shown song covers. You can clear them at any time in your browser settings.
5. Your rights
You have the right to access your data, correct it, have it deleted, restrict or object to how we use it, and receive it in a portable format. Where we rely on your consent, you can withdraw it at any time without affecting what we did before.
To use any of these rights, email [email protected]. We will reply within one month. If you are unhappy with how we handle your data, you can complain to the Spanish Data Protection Agency (AEPD) at aepd.es.
6. Children
Under Spanish law, children under 14 need the consent of a parent or guardian before sending us a shoutout or any personal information. If we learn that we hold data from a child under 14 without that consent, we will delete it.
7. Security
We use appropriate technical and organisational measures to protect your data, such as encrypted connections and restricted access. No system is completely secure, but we work to keep your information safe.
8. Links to other websites
Our website and apps link to websites run by others, including advertisers and partners. Their own privacy policies apply when you visit them.
9. Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last changed, and we will let you know of significant changes where appropriate.
