Ninbux

Privacy Policy

Last updated: 25 October 2026

This translation is provided for your convenience. In case of any discrepancy, the Spanish version prevails.

This policy explains what personal data Ninbux processes, why, and what rights you have, under the General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

Data controller

Joshua Díaz López, Tax ID 77722853B, C/ Formentera 1, 07800 Ibiza, Illes Balears, España. Privacy contact: [email protected].

What data we process

• Account data: name, email and password. The password is stored encrypted and nobody can read it.
• Your files: the photos, videos and documents you upload, with their name, size, date and thumbnail.
• Payment data: handled by our payment provider. Ninbux never sees or stores your card number; it only knows which plan you have and whether it is paid.
• Technical data: IP address and session data, to keep you signed in and protect the service against abuse. When you create your account we also store an encrypted fingerprint of the connection and device (not the plain IP), only to prevent one person from creating several free accounts.
• Language: the language you choose for the website, so we can send you emails in that language.
• Two-step verification (only if you enable it): the key of your authenticator app (encrypted), your mobile number if you choose SMS, your recovery codes and your security word (these two encrypted so that nobody can read them, not even the administrator). SMS messages are sent through Brevo (Sendinblue SAS, France).
• Signing in with Google or Apple (only if you choose to): we receive your name, your email (with Apple this may be a private relay address that forwards emails to you) and an identifier of your account. We never receive your Google or Apple password or anything else from your account.
• Visit statistics: we count how many times the website is opened each day, from which country (provided by Cloudflare), whether on a mobile or a computer, and whether it looks like a person or a robot (search engines, automated programs…). These are totals only: we do not store your IP or use cookies for this. When you sign in we store the country with the session, so you can spot unusual access.
• Security log: if someone tries to get in without permission or attack the service (repeated wrong passwords, probing for hidden pages, attempts to inject code, excessive requests…), we keep their IP address, country, the address they requested and what happened for 30 days, so we can stop the attack. We never store passwords or the contents of your files, and email addresses are stored with some letters hidden.
• “I’m a person” check: when you create an account, your browser solves a small calculation to show it is not a robot. This happens on your device, without cookies and without sending anything to third parties (we do not use Google reCAPTCHA or similar).
• Reports and suggestions (only if you send them): the text you write, the type of report, the date, the app version, the operating system and phone model, the language and the name of the screen you were on, so we can understand and fix the problem or consider your idea. Your files and their content are never sent. Only the administrator reads them, and we keep them for as long as they help improve Ninbux. If you delete your account, the report is no longer linked to your name or email.
• Antivirus check: every file you upload is automatically checked by an antivirus (ClamAV) running on an isolated server. If it contains a virus, it is removed from your account and kept for 7 days in quarantine, where nobody can open it, and then deleted. We keep the file name and the virus name for 90 days so we can notify you.
• Billing: for every payment we keep the amount, the date, the plan, the invoice number and the email you paid with. Your card details are stored only by Stripe, never by us. They are kept, only for accounting and legal obligations, for the period required by law (up to 6 years), even if you delete your account.

Purposes and legal basis

• Providing you with the storage service and managing your plan: performance of the contract (Art. 6(1)(b) GDPR).
• Issuing invoices and meeting tax obligations: legal obligation (Art. 6(1)(c) GDPR).
• Service security and abuse prevention: legitimate interest (Art. 6(1)(f) GDPR).
• Reading and responding to the reports and suggestions you send us, and improving Ninbux: legitimate interest (Art. 6(1)(f) GDPR).
• Keeping invoices and accounting records: legal obligation (Art. 6(1)(c) GDPR).
• Notifying you by email and in the app about anything affecting your account or the service (maintenance, incidents, payments, security, changes to prices or terms): performance of the contract (Art. 6(1)(b) GDPR). You always receive these notices.
• Telling you about Ninbux news by email: legitimate interest as a customer (Art. 21.2 of the Spanish LSSI). You can stop receiving them at any time with the link in each email or in Account → Emails.

We do not use your data for advertising or sell it to anyone.

Smart search (only if you enable it)

From your account you can turn on, separately, three features to help you find your photos. All of them start switched off and the analysis is done on Ninbux’s servers in Spain, without sending your photos to other companies.

• Places: the GPS location your phone saved in the photo is read and turned into the name of the town or city, using GeoNames data (CC BY 4.0) stored on the server itself.
• Objects and scenes: a numerical fingerprint of each photo is calculated so you can find it by typing what appears in it, and any text it contains is read (for example, on a receipt or a screenshot).
• Faces: faces are detected and a numerical fingerprint of each one is stored to group those of the same person. This is biometric data, so it is only enabled with your explicit consent (Art. 9(2)(a) GDPR), which you give when you switch it on. Faces of other people appearing in your photos are grouped the same way and only you can see them.

The legal basis for Places and for Objects and scenes is your consent when you turn them on (Art. 6(1)(a) GDPR). If you turn a feature off, everything calculated with it is deleted immediately.

Where your files are stored and who can see them

Your files are stored on servers located in Spain. Each user only has access to their own files. Their content will only be accessed when required by a judicial or administrative authority in accordance with the law.

Backups

So that the service can be recovered if something fails, we make backups of the database, the configuration and the users' files. Backups stored outside the server are always encrypted, with a key that only the data controller holds. They are kept on an external disk located in the same place as the server and, only the database and the configuration (without your files), in a cloud storage service run by a technology provider, which only stores encrypted data and does not have the key to read it.

Who we share it with

To provide the service we work with payment, network infrastructure and cloud storage providers (the latter only stores encrypted backups that it cannot read), who act as data processors and only process the data necessary for their function. Some may process data outside the European Economic Area, always with the safeguards required by the GDPR. No data is disclosed to third parties except where required by law.

How long we keep it

For as long as you have your account. What you delete first goes to the bin, where it is kept for a few days (shown in the bin itself) in case you want to recover it; after that it is deleted for good, or sooner if you empty the bin. If you delete your account, your account and all your files are removed. They may remain in backups for up to 30 days, until those are renewed. If one of those backups is in a cloud storage service, it may remain there, encrypted and unreadable by anyone, for up to 30 more days in that service's bin. Billing data is kept for the periods required by law. The encrypted connection and device fingerprint from sign-up is deleted after 12 months.

Cookies and on-device storage

We only use what is technically necessary for it to work: a cookie so you can view your photos and videos, and browser storage to keep you signed in and remember your language and theme. There are no advertising or analytics cookies, which is why we don’t ask for your consent.

Minimum age

You must be at least 14 years old to create an account.

Your rights

You can request access, rectification, erasure, objection, restriction of processing and portability of your data by writing to [email protected]. From your account you can download your files and delete the account at any time. If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es).

Español · English · Deutsch · Français · Italiano