Privacy Policy
Last updated: October 5, 2026
This policy explains what personal data Wamaba (wamaba.com) collects, why, how long we keep it and the rights you have. It applies to the website and to the Wamaba apps for Android and iPhone.
1. Who is responsible for your data
The data controller is Markarian Global, SL., CIF B71054407, dir@wamaba.com. You can contact us about privacy at any time through our contact form.
2. What we collect
- Account details — your name, email address and password (stored only as a secure one-way hash, never in readable form).
- Profile — anything you choose to add: profile photo, location and a short bio.
- Listening activity — episodes you play and how far you got (so you can resume), your favorites, and reviews and ratings you post. We count plays to show popular episodes.
- Security information — your IP address, browser and device type, and the time of sign-ins, sign-outs, failed sign-in attempts and password resets. We use this to protect accounts (for example, locking an account after repeated wrong passwords).
- Language — to show the site in your language, we work out your country from your IP address using a database kept on our own server. It isn't sent to anyone or stored; if you pick a language, we remember your choice in a cookie.
- Notifications — if you turn on notifications, the address your browser or phone gives us for delivering them, the type of device, and your notification choices (topics, quiet hours, daily limit). To send them at a good time we use your time zone and the hours at which you usually listen, worked out from your activity on Wamaba. We keep a list of the notifications we sent you and whether you opened them.
- Messages — what you send us through the contact form, with your name and email address.
- On your device only — episodes you download for offline listening, and player preferences, are stored in your browser or app. They are not sent to us.
We do not sell your personal data.
3. Why we use it and our legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your account, saving favorites, history and reviews, password resets | Performance of our contract with you — Art. 6(1)(b) |
| Keeping the service secure, preventing abuse and spam, rate limiting, play statistics, showing the site in your language | Our legitimate interests — Art. 6(1)(f) |
| Push notifications you turned on, personalised to the shows and topics you like and timed to your listening habits | Your consent (you turn them on, and can turn them off at any time) — Art. 6(1)(a) |
| Answering messages you send us | Your request / our legitimate interest in replying — Art. 6(1)(b) and (f) |
| Non-essential cookies, including advertising cookies if we show ads | Your consent — Art. 6(1)(a), which you can withdraw at any time |
| Keeping records the law requires | Legal obligation — Art. 6(1)(c) |
4. Cookies and similar technologies
We use only what the service needs to work, plus the third-party items below when the related feature is switched on.
| Name | Purpose | Type and duration |
|---|---|---|
| __Secure-next-auth.session-token | Keeps you signed in | Essential · 14 days |
| __Host-next-auth.csrf-token | Protects sign-in and forms against forgery | Essential · session |
| __Secure-next-auth.callback-url | Returns you to the page you were on after signing in | Essential · session |
| wamaba_lang | Remembers the language you chose | Functional · 1 year |
| Local storage: player settings | Remembers the last episode and position, and your autoplay choice | Functional · until you clear it |
| IndexedDB and Cache Storage | Stores downloaded episodes and parts of the site so they work offline and load faster | Functional · until you remove them |
| Google reCAPTCHA (e.g. _GRECAPTCHA) | “I'm not a robot” check on sign-in, sign-up and contact pages, when enabled | Security · set by Google · up to 6 months |
| Google advertising cookies (e.g. __gads, __gpi, IDE, NID) | Showing and measuring ads, only if we display Google ads and only with your consent where required | Advertising · set by Google · up to 13 months |
You can block or delete cookies in your browser settings. Blocking essential cookies will stop sign-in from working.
Advertising by Google
If we show ads on Wamaba, they are provided by Google:
- Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.
- Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the Internet.
- You may opt out of personalised advertising by visiting Google Ads Settings, and opt out of some third-party vendors' cookies at youronlinechoices.eu or aboutads.info.
- Learn how Google uses information from sites that use its services.
Visitors in the European Economic Area, the UK and Switzerland will be asked for consent before advertising cookies are used, and can change that choice at any time.
5. Who we share data with
- Hosting provider — our website and database run on servers operated by our hosting company, which processes data only on our instructions.
- Email delivery — to send password-reset emails and pass on contact messages.
- Google — for the “I'm not a robot” check and, if we show ads, for advertising, as described above.
- Push services — notifications travel through the push service of your browser or phone (for example Google Firebase Cloud Messaging for Chrome and Android, Mozilla for Firefox, Apple for Safari and iPhone). They receive the notification text and the address of your device, not your account details.
- Podcast hosts — many shows are streamed directly from their creators' own hosting services. When you play or download one, your device connects to that host, which receives your IP address like any website visit.
- OpenAI — our administrators may use it to transcribe podcast audio and draft episode descriptions. Listener personal data is not sent to it.
- Authorities — only where the law requires it.
Some of these providers are located outside the European Economic Area, including in the United States. Where that happens, transfers rely on an adequacy decision (such as the EU-U.S. Data Privacy Framework) or the European Commission's Standard Contractual Clauses.
6. How long we keep it
- Account, profile, favorites, history and reviews — while your account exists. When you ask us to delete your account, we delete them.
- Security records — only as long as needed to protect accounts and investigate misuse.
- Contact messages — as long as needed to answer you and deal with any follow-up.
- Data we must keep by law — for the period the law requires.
7. Your rights
You have the right to:
- access the personal data we hold about you and get a copy of it (portability);
- correct inaccurate data — you can edit your name, photo, location and bio yourself in your profile;
- have your data deleted, or its use restricted;
- object to processing based on our legitimate interests;
- withdraw consent at any time, without affecting earlier processing.
To exercise any of these rights, contact us through our contact form. To delete your account, see Delete your account. We reply within one month. If you are not satisfied, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos) or your local data protection authority.
8. Children
Wamaba accounts are for people aged 14 or over. If you are under 14, please don't create an account. If you believe a child has given us personal data, contact us and we will delete it.
9. How we protect your data
All traffic is encrypted (HTTPS). Passwords are stored as one-way hashes, sensitive settings are encrypted, and accounts are locked temporarily after repeated failed sign-ins. Access to administrative tools is limited to authorised staff.
10. Changes to this policy
We may update this policy. The date at the top shows when it last changed, and the current version is always available on this page.
See also our Terms of Use and Aviso Legal.