Privacy Policy

Sagrada Watcher (“we”, “us”) operates an independent ticket-availability alerting service. We are the data controller for the personal data described in this policy.

We are not affiliated with, endorsed by, or connected to the Basilica de la Sagrada Familia or its official ticketing provider.

For any privacy question, write to [email protected].

We keep the data set deliberately small. We collect:

• Contact details: the phone number you register for WhatsApp alerts, and an email address if you provide one.
• Your alert preferences: the dates, time ranges and visitor count you ask us to watch for.
• Payment metadata: a payment reference, amount, currency and status returned by our payment processor. We never see or store your full card number.
• Message records: the alerts we sent you and any replies you send us on WhatsApp, so we can support and troubleshoot your alerts.
• Technical logs: IP address, browser type, timestamps and error traces generated when you use the site or when our systems run.

We do not collect special-category data, and we do not ask for identity documents.

• To run the service you paid for: matching newly-released slots against your preferences and messaging you. Legal basis: performance of a contract.
• To take payment and handle refunds. Legal basis: performance of a contract and compliance with a legal obligation.
• To keep the service secure and working: abuse prevention, rate limiting, debugging. Legal basis: our legitimate interests.
• To meet accounting and tax obligations. Legal basis: compliance with a legal obligation.

We do not sell your data, we do not share it with advertisers, and we do not use it to build profiles or train models.

Alerts are delivered over WhatsApp using the WhatsApp Business Platform (Meta). To send you a message, your phone number and the message content are processed by Meta under their own terms and privacy policy.

We only message you about the alerts you signed up for, with no marketing and no third-party promotions. You can stop messages at any time by replying STOP in the WhatsApp thread or by emailing us.

Our ChatGPT plugin answers questions about Sagrada Familia ticket availability with the same public data shown on this site. It is free, needs no account and is separate from the alert service: using it does not sign you up for anything.

• What it receives: only what ChatGPT sends to answer your question, which is the visit dates you ask about. It never receives your name, email, phone number or the text of your conversation, and it never asks for them.
• What we record: which question type was asked (for example “tickets for these dates”), the dates asked for, and when. The requests come from OpenAI’s servers, not from your device, so we don’t see your IP address.
• Why: to answer the question, to count how often the plugin is used, and to fix problems. Legal basis: legitimate interests.
• Who receives it: our hosting and network providers, as part of running the service. We don’t sell it or share it with anyone else. Your conversation itself is handled by OpenAI under its own privacy policy.
• How long: these records live only in our rolling server logs, typically for no more than 30 days.
• Your controls: you can disconnect the plugin in ChatGPT’s settings at any time. Because we hold no account or contact details for plugin users, there is nothing to delete; questions about it go to [email protected].

We use a small number of processors, each with access limited to what their function requires:

• Meta Platforms: delivery of WhatsApp messages.
• Stripe: payment processing. Card details go directly to Stripe and never touch our servers.
• Hosting and infrastructure providers: storage and running of the application and its database.

We may also disclose data where we are legally required to, or where it is necessary to establish, exercise or defend legal claims.

Some of our processors operate outside the European Economic Area. Where data is transferred outside the EEA, it is protected by an adequacy decision or by Standard Contractual Clauses together with appropriate technical safeguards.

• Alert preferences and contact details: for the duration of your watch window, then deleted or anonymised within 90 days.
• Message records: up to 12 months, for support and dispute handling.
• Payment and invoice records: for as long as tax and accounting law requires, typically several years.
• Technical logs: typically 30 days.

You can ask us to delete your data sooner; see Data deletion.

Subject to local law, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another provider in a portable format. Where we rely on consent, you can withdraw it at any time.

Email [email protected] and we will respond within 30 days. If you are unhappy with our response, you have the right to complain to your local data protection authority.

We use a session cookie to keep you signed in and to protect forms against abuse, and a small first-party cookie that remembers your cookie choice. These are strictly necessary for the site to work and need no consent.

With your consent we also use Google Ads conversion tracking. It sets a Google cookie so that, if you arrived through one of our ads and then set up an alert, Google can tell us that the ad worked. We share no name, email or phone number with Google, only the fact that a signup happened and its value. Without consent the tag sends Google an anonymous, cookieless signal only. You can change your choice at any time via the “Cookies” link in the footer. Google’s own handling of this data is described in its privacy policy at policies.google.com.

With your consent we also use Microsoft Clarity, which records how visitors move around the site (clicks, scrolling, page views) and builds heatmaps and session replays from it, so we can see where the site is confusing. Clarity sets its own cookies to recognise a returning browser. Text you type into forms is masked before it leaves your browser. Without consent Clarity sets no cookies and does not link one visit to the next. Microsoft’s handling of this data is described at privacy.microsoft.com.

Separately, when you arrive from an ad or a link that tags the address bar, we keep those tags (such as Google’s click id, any campaign tags, and the site that linked to you) in your browser’s session storage until the tab closes. If you then set up an alert we store them with your account, so we can tell which ads are worth paying for. It is not used to profile you or shared with anyone, and it is deleted with the rest of your data when you ask us to delete your account.

Data is transmitted over TLS and stored on access-controlled infrastructure. Passwords are stored hashed, and card data never reaches our systems. No system is perfectly secure, but we keep the amount of data we hold small precisely to limit the impact if something goes wrong.

The service is not directed at children under 16. If you believe a child has given us personal data, contact us and we will delete it.

If we change this policy we will update the date at the top of this page. If the change is significant and affects data we already hold about you, we will tell you directly on the channel you registered with.