Privacy Policy

Last updated: 4 October 2026.

1. Who is responsible

ManyChanger (manychanger.com) is responsible for processing your personal data, in line with the GDPR and as described in this policy.

2. What data we collect

• Account: email, password (stored encrypted by our authentication provider; we never see it), display name and profile photo. If you sign in with Google, we receive your name, email and profile picture from Google. We also save the country from which the account was created. • What you contribute: exchange houses (name, address, map position, phone), exchange rates, photos of rate boards, ratings and comments, linked to your account. • Location: only when you tap a location button and allow it in your browser. We use it to show nearby exchange houses or to place a new one on the map, and we only store it as the position of an exchange house you add. • Messages: what you send through the contact form, the feedback form or a report (your name and email if you give them, and the message). • Usage: pages visited, date and time, browser and device type, the page you came from and a temporary session identifier that is deleted when you close the tab. We also record the country from which the site is accessed, detected from the connection: we only keep the country, never the IP address or exact location, and we look at it and use it to improve the user experience. Our own statistics do not record your IP address; our hosting and authentication providers keep technical logs, which include IP addresses, for security for a limited time. • Security: counters and alerts from our anti-abuse system (for example, contributions per day).

3. Why we use it and on what legal basis

• To provide the service and your account: performance of our terms of use. • To show community information publicly, prevent abuse, fake reviews and fraud, and keep the site secure: our legitimate interest. • To measure how the site is used, in aggregate, and improve it: our legitimate interest. • Location: your consent, which you can withdraw at any time. • To answer and handle the messages, feedback and reports you send us: our legitimate interest. • To meet legal obligations and answer requests from the authorities.

4. What is public

Your display name, profile photo, ratings and comments, and the exchange houses, rates and photos you add can be seen by everyone. Your email, country of access and usage data are never shown publicly. Rate-board photos are public: do not include people, documents or any other personal data in them.

5. Who processes data for us

• Supabase: database, accounts and file storage. • Cloudflare: website hosting and delivery. • Google: sign-in with Google (only if you use it) and the artificial intelligence that reads the rate-board photos you choose to analyse (the photo is sent to Google to be processed). • Our email delivery provider: confirmation and password emails. • Maps and address search: OpenStreetMap (maps and Nominatim search), Komoot Photon (address search) and Esri (satellite view) receive your IP address and the address or map area you look at. • Exchange-rate data: ExchangeRate-API and Frankfurter receive your IP address when rates are loaded. • Fonts, icons and images: Bunny Fonts, cdnjs (Cloudflare) and Pexels. When you open directions, Google Maps or Waze apply their own privacy policies. We do not sell your data or share it for advertising.

6. International transfers

Some of these providers are based in, or may process data in, countries outside the European Economic Area, such as the United States. In those cases the transfer is covered by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses.

7. How long we keep it

• Account and profile: until you delete your account. • Ratings and comments: when you delete your account they stay anonymous, shown as "deleted user", with no name, photo or link to you. • Exchange houses and rates you added: kept after you delete your account, without your name, because they describe a business, not you. • Usage data: 14 months. Anti-abuse alerts: 12 months. Photo-analysis counters: 30 days. • Contact messages, feedback and reports: up to 24 months. Our providers may keep backups for a short additional period.

8. Your rights

Under the GDPR you have the right to: • access your data • correct it • delete it • restrict or object to its processing • get a copy in a portable format • withdraw your consent at any time You can edit your profile and delete your account yourself from your profile page. For any other request: [email protected]. You can also complain to the Spanish Data Protection Agency (www.aepd.es) or to the data protection authority of your country.

9. Automatic anti-abuse rules

To keep the data reliable, automatic rules limit contributions per day and may hide contributions that look abnormal. This only affects whether a contribution is shown and counts towards points; it has no legal or similarly significant effect on you. You can ask us to review any decision.

10. Security

Connections are encrypted (HTTPS), access to data is restricted by strict database rules, and passwords are stored encrypted by our authentication provider. No system is 100% secure; if a security breach affected your data, we would notify you and the authorities when the law requires it.

11. Minors

ManyChanger is only for people aged 16 or over. By creating an account you confirm you are at least 16. We do not knowingly collect data from younger people, and any account we find belonging to someone under 16 will be deleted.

12. Cookies and local storage

We do not use advertising cookies or third-party trackers. We use your browser's storage to keep you signed in; to remember your language, currencies and theme; to save exchange rates for a while so pages load faster; and for a temporary session identifier used in our own visit statistics, which is deleted when you close the tab.

13. Changes to this policy

We may update this policy as the service evolves. Important changes will be shown on this page with a new date.