Legal Notice and Terms of Use

1.1. Controller Information

In compliance with Article 10 of Law 34/2002, of July 11, on Information Society Services and Electronic Commerce (LSSI-CE), the platform owner's details are provided below:

• Owner: Carlos M. S.

• Address: Las Rozas (Madrid). Spain

• Contact email: legal@TripCoaster.com

1.2. Intellectual and Industrial Property

The platform design, source code, logos, trademarks, database structures, screens, interfaces and other graphical and functional elements are the exclusive property of CMS or are covered by the corresponding usage rights. They are protected by Spanish and international Intellectual and Industrial Property laws.

Prohibition of copying and replication: Total or partial reproduction, modification, distribution or public communication of the platform's interface, code or structure for commercial or replication purposes is expressly prohibited without prior written authorization from the owner.

Citation and Reference Policy: Reference, dissemination and citation of the platform's public content (such as public routes or shared travel diaries) is expressly permitted, provided that authorship (CMS) is clearly indicated and a direct, indexable link (without restrictive nofollow attribute) to the original source on TripCoaster.com is included.

Prohibition of Scraping: The use of automated systems, algorithms or software (bots, spiders, scrapers) to mass-extract content, photos, routes or user data from this website for commercial or AI training purposes without authorization is strictly prohibited.

1.3. Ownership and Rights over User Content (Your Photos and Trips)

At TripCoaster we scrupulously respect the work and authorship of our users. Therefore, the platform's policy is governed by the following principles:

• Absolute Ownership: All user-generated content (photographs, texts, route descriptions, trip names and comments) belongs 100% to the user who uploaded it. TripCoaster acquires no ownership, authorship or intellectual property rights over your materials.

• Prohibition of Commercial Use and Exploitation: TripCoaster has no right to, nor will it use, sell or transfer your photographs or texts to third parties for advertising, commercial, marketing or AI model training purposes without your prior, express and written consent.

• Strictly Limited Technical License: By uploading content to the platform, you only grant TripCoaster a technical, free, worldwide and non-exclusive license to store, host, process and display said content on the website. This license serves solely and exclusively to allow the platform to provide you with the service (i.e., so that your photos load in your profile and are shown to the users you decide, according to your privacy options: public or private trip).

• Content Control and Removal: You have full control at all times. If you decide to delete a photograph, a trip or your entire TripCoaster.com account, the content will be completely deleted from our active servers immediately, and the technical license mentioned in the previous point will be extinguished at that same instant.

1.4. Sharing content with other users

TripCoaster lets you decide to share your trips, diaries and photographs with other users of the platform, through several mechanisms that you control at all times:

In every case you can revoke the access you granted from within the app itself. Keep in mind that, once granted, the person accessing it can technically save or screenshot the content outside TripCoaster; we have no control over that later use. If a photo you share shows other people, it is your responsibility to have their consent to upload and share it, especially when minors are involved.

1.5. Minimum registration age

Use of TripCoaster is permitted from age 14, in accordance with Article 7 of Organic Law 3/2018 (LOPDGDD), which sets that age as the minimum for a person to give their own consent to the processing of personal data in Spain. Registration is not permitted below that age. The date of birth provided at registration is used to automatically verify this requirement; declaring a false date of birth to bypass this check is a breach of these Terms of Use.

1.6. Community rules, reporting and blocking

TripCoaster is a space to share trips with the people you choose. To keep it safe, by using the platform you agree to these rules:

• Zero tolerance: You may not post sexually explicit, violent, hateful, discriminatory, defamatory or illegal content, or content that infringes the rights of others, nor harass, threaten or impersonate other people. There is no tolerance for objectionable content or abusive users.

• Reporting: You can report any user, trip or photo you see directly from that content. Reports are anonymous to the reported person.

• Blocking: You can block any user from their profile or when reporting them. A blocked user is no longer your friend, cannot find you, send you requests or invite you to trips, and is removed from the trips you manage. You can manage your blocks from your profile.

• Moderation within 24 hours: We review reports within 24 hours. If content breaks these rules we will remove it or make it private, and we may deactivate the account that posted it. Contact: legal@tripcoaster.com.

In accordance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD), we inform you of how we process your personal data:

Basic Information on Data Protection

• Controller: CMS

• Purpose: Management of user registration, creation of the travel diary, platform maintenance, sending of technical service notifications, sending of push notifications in the iOS and Android apps (only if you allow them on your device) and sending of communications about TripCoaster news (you can unsubscribe at any time from the link in every email or from your profile).

• Legal basis: Performance of the contract (acceptance of the terms of use upon registration), explicit user consent and, for news communications, your existing relationship as a TripCoaster user (art. 21.2 Spanish LSSI), with an unsubscribe option in every email.

• Recipients: No data is transferred to third parties except by legal obligation. We use the technology providers detailed in section 2.2 (international transfers) as data processors. Your account and trip data is processed within the European Union; push notifications and signing in with Google or Apple also rely on those providers' global infrastructure, as described in section 2.2.

• Rights: Access, rectification, erasure, restriction, portability and objection.

2.1. Exercise of Rights

You can exercise your rights by sending an email to legal@tripcoaster.com attaching a copy of your identity document and indicating "Data Protection" in the subject line. If you consider that your rights have not been addressed, you can file a complaint with the Spanish Data Protection Agency (AEPD).

2.2. International transfers and data processors

To provide the service we rely on external technology providers that act as data processors. Your data is processed in data centers located in the European Union (Madrid/Frankfurt); however, since these are corporate groups headquartered in the United States, an international data transfer takes place within the meaning of Chapter V GDPR, covered by the Standard Contractual Clauses approved by the European Commission. We are currently formalizing the corresponding Data Processing Agreements (DPAs) with each of them.

We do not share your data with these providers for their own purposes: they act solely on our instructions, as a technical component needed to operate TripCoaster. You can request more information about these transfers and the applicable safeguards by writing to legal@tripcoaster.com.

2.3. iOS and Android apps

When you use TripCoaster from the mobile apps, the following data is also processed:

• Push notifications: if you allow notifications on your device, we store a technical device identifier (Firebase Cloud Messaging token) and its platform (iOS or Android) linked to your account, to notify you about friend requests, trip invitations and activity on your trips. The notification text only includes user names, never locations. You can turn them off at any time in your device settings or, per type of notice, in the notification preferences of your profile. When you sign out, the identifier is revoked on the device itself and stops receiving notifications; we remove it from our systems as soon as the provider confirms it is no longer valid (also after uninstalling the app), when another account signs in on the same device, or when you delete your account.

• Sign in with Google or Apple: if you choose these options, we receive your name and email address from the provider (with Apple, this may be a private relay address if you choose so) to create or identify your account. We never receive your Google or Apple password.

• Location: only when you take a photo with the camera from within the app, and only if you allow it, your current location is read to store it in the photo's metadata (EXIF) and place it on your trip map. Location is never accessed in the background or when picking existing photos from the gallery.

• Camera and gallery: they are only accessed when you choose to take or add a photo. Photos taken from the app are also saved to your device's gallery.

This platform uses only technical and security cookies, managed directly by our server (backend) using advanced security attributes (httpOnly, Secure and SameSite). Since these cookies are strictly necessary for the correct functioning of the site, to secure your account and allow access to your private area, they do not require prior user consent pursuant to Article 22.2 of Law 34/2002 (LSSI-CE). The application's frontend does not read or write these cookies directly via JavaScript.

3.1. List of cookies used

The following are the only cookies the system may install on your browser:

3.2. Local Storage (LocalStorage)

We also inform you that the platform uses your browser's local storage (localStorage) exclusively to temporarily store the state of the user interface session (non-sensitive technical profile data), optimizing website loading speed. This data is not shared with third parties or used for advertising tracking purposes.

3.3. User control

Although these cookies are necessary to use the travel platform, you can block or delete them at any time by configuring the privacy options of your own web browser (Chrome, Firefox, Edge, Safari, etc.). Please note that if you block these cookies, it will not be possible to log in or record your trips on the platform.