What we store, and why

The controller is Equinox Investment Group LLC, incorporated in Wyoming, United States, with registered office at 30 N Gould St, Ste N, Sheridan, WY 82801, United States.

Because the company is established outside the European Economic Area and offers this service to people in Europe, it has designated a representative in the EU under article 27 GDPR: Carlos de Ory Gordillo, Hack Kampmanns Plads 2, 8000 Aarhus, Denmark. You can address that representative instead of us on any data protection matter, and you are not obliged to deal with the company abroad.

For anything about your data, write to privacidad@reply.press. There is no data protection officer: the company is too small to be required to appoint one, and pretending otherwise would just add a title to the same person.

Your email

To sign you in with a one-time link and to write to you about your own case. Nothing else.

Your verification

The organisation you claim to represent, the corporate address you proved, and who approved it.

What you publish

Replies and cases you send. These are public by design — that is the point of the site.

Documents you upload

Stored privately. Only shown when the case they belong to is published, and only the part that matters.

Your identity check

If you verify with Didit: the verdict, the name printed on your document, its type, and a score per check. Not the document number, not your date of birth, not your address, and not a single image — those stay with Didit and never reach us.

Technical logs

Kept briefly by our hosting provider to keep the site up and stop abuse.

Signing in and answering you: because you asked for it, and because we need it to give you the service (article 6.1.b GDPR). Publishing a case: the public interest in accurate information and the right of reply, which is exactly the balance the GDPR asks us to strike (article 6.1.f, read with article 85 on freedom of expression). Keeping the site up and stopping abuse: our legitimate interest in it working. Counting visits, if you ever turn it on: your consent, which you can take back at any time on the cookies page without giving a reason and without losing anything else.

A published case and its replies stay up, because a record that disappears is not a record. Verification documents are deleted once the verification is decided, and the identity check keeps only the verdict and the name. An account you close is deleted; what you published in public stays, without your contact details.

Supabase

Database, sign-in and file storage. It holds your account, what you publish and the documents you upload, and it sends the one-time sign-in link.

Cloudflare

Hosting and delivery. Every page passes through it, so it sees the request and the IP address it came from, and keeps a short technical log.

Didit

Identity verification, and only if you choose it. It is the one that sees your document and your face, under its own privacy policy; it tells us whether it accepted you and the name on the document.

Nothing else. No fonts from someone else's server, no embedded video, no social buttons, no advertising identifiers, and no advertising network. Nobody buys this data, and there is nothing to buy: we do not sell, rent or share personal data with anyone for their own purposes.

Our database and hosting run on infrastructure that may store or process data outside the European Economic Area, including in the United States. Those transfers rely on the European Commission's standard contractual clauses, together with the additional measures each provider documents.

The identity check is automatic: Didit compares your document with your face and returns a verdict, and we act on it. It decides one thing only — whether you are who you say you are — and it never decides what gets published or how a case is labelled. Those are human decisions and stay human.

If the check rejects you and you think it is wrong, write to privacidad@reply.press and a person looks at it and answers. You do not have to accept the machine's answer, and you can always verify the slower way instead, with a document and a corporate email address.

Access, rectification, deletion, objection, portability, limitation, and withdrawal of any consent you gave. Write to privacidad@reply.press and we answer within a month. We do not charge for it and we do not ask you to justify it.

If you think we handled it badly you can complain to the data protection authority of the country where you live or work. In Spain that is the Agencia Española de Protección de Datos. You can also complain to our EU representative first, and we would rather you did, because then we can fix it.

We do not sell your personal information and we do not share it for cross-context behavioural advertising — not as a policy we could quietly change, but because there is no advertising on this site at all. You have the right to know what we hold, to have it deleted and to correct it, and we will not treat you differently for asking. The same address works: privacidad@reply.press.

This site is not built for children. You need to be at least 16 to open an account, and we do not knowingly collect anything from anyone younger. If you believe a child has an account here, tell us and we delete it.

You do not have to accept our account of it. Reply — that reply is published unedited and next to the sentence, which is a stronger remedy than deletion. And if a fact about you is wrong, say so and we correct it.