Controller of diffatonce.com: Francisco Manuel Arrabal Campos. Privacy enquiries and data rights requests: fmarrabal@ual.es.
Optional analytics
Statistics are sent only after you accept measurement. Rejecting does not restrict the website. We also respect Do Not Track and Global Privacy Control.
Recorded fields are the public page, UTC day, referring domain (not its path or query), device group (mobile or desktop), and a random session identifier transformed with a key and rotated daily. Full IP addresses, names, precise locations and form text are not stored in analytics.
Events older than 90 days are deleted when the website receives new requests. Daily sessions are not identified people or cross-device unique users. Refusals and blockers make totals incomplete.
Preferences and administration
Your browser retains your consent choice; a random session identifier is created only after acceptance. Change your choice from the footer. The admin panel uses a necessary authentication cookie and abuse-prevention controls.
Requests also pass through Hostinger, the hosting provider, which maintains its own technical logs. You may request information and exercise your rights of access, rectification, erasure, objection, restriction and portability, where applicable, by emailing fmarrabal@ual.es. You may withdraw consent through “Privacy preferences” without losing access to the website. You may also lodge a complaint with the Spanish Data Protection Agency (https://www.aepd.es).
Support, security and optional analytics
Updated: 29 September 2026. This section supplements the previous notice and takes precedence for the new features. Controller: Francisco Manuel Arrabal Campos. Support and privacy contact: fmarrabal@ual.es.
Private support requests
We process your contact email, optional name, product, version and submitted message or file to handle your request, not for marketing. Processing is based on handling your request and pre-contractual steps where applicable; security safeguards serve the legitimate interest of protecting the service. Scientific data is not collected automatically. An ID and random key grant ticket access and replies; anyone holding both can access it. The key is sent by POST, not in the URL, and stored as a cryptographic digest. Do not publish it.
Open requests are retained while being handled; closed or resolved requests for up to 12 months after their last update. Completed email records are retained for 30 days; audit records for 180 days. Cleanup runs when the application is accessed. You may request erasure: administrators can remove messages, attachments and associated email. Hosting backups have separate retention and must be addressed during erasure. Do not attach confidential or third-party data.
Necessary cookies and anti-spam
diffatonce_support and diffatonce_admin are session cookies for CSRF security and private access, not advertising. Admin sessions expire after 30 minutes idle or 8 hours total. If reCAPTCHA v3 (Google) or Turnstile (Cloudflare) is enabled, it loads on form submission and processes technical network/browser data under its policy. It does not replace the password. Rate limits use temporary HMAC identifiers, not full IP addresses in application tables. Hosting may keep its own access logs.
Operational registration of Prime, ResinAtOnce and Legacy
Access-controlled releases show a notice before registration. They send a random installation identifier, product, version, Windows platform, optional label, registration and check dates. They do not send computer/user names, hardware fingerprints, paths, spectra or results. The local credential is protected with Windows DPAPI; the server stores its cryptographic digest. The administrator can approve or block one copy, not delete its files or execute commands on its computer through this system. In-app messages are linked to that copy. A previously approved blocked copy can still contact support.
This registration is required for access control in these releases, separate from optional statistics and Google Analytics. A different folder or Windows user may require a new registration. Checks occur at launch and every 15 minutes; offline use requires a time-limited signed authorization (24 hours by default). Minimal authorization/block records are kept while needed to administer that copy; contact us to review retention or exercise rights. Registration does not establish who is using the software or how many physical computers exist. Older releases are not registered retroactively.
Three separate analytics choices
First-party statistics, only with consent: public paths without queries, referring domain, broad device/browser/OS, opened FAQs, predefined search topics and measured visible time. No free-text searches, names, emails, full IP addresses, forms, keystrokes or recordings. Daily pseudonymous sessions, not identified people. Maximum retention: 90 days.
Google Analytics 4, if configured and you consent, sends navigation data to Google. Its script does not load before consent. This site does not enable advertising or Google signals; measurement cookies are configured for 60 days. The owner must set GA4 event retention to 2 months and disable enhanced measurement.
Approximate country, with additional consent: sends the IP to IPinfo Lite for a country code. The full IP is not stored here; city, address and physical location are not calculated. A VPN or proxy may alter the result.
Your choice is stored locally for 180 days. You may reject, change or withdraw it under “Privacy preferences” without losing access. DNT/GPC are respected. Admin, tickets and support forms are not measured. New metrics do not reconstruct past visits.
Providers and external AI
Hosting: Hostinger. Email uses the selected SMTP service, Resend or Brevo only when configured; no bulk campaigns or automatic replies to unverified addresses. Providers may process data outside the EEA: the owner must review contracts, safeguards and terms before activation. External AI requires an authorized, scoped token; support.read permits reading private content and contact details. No AI provider connects automatically. Proposed publications, replies and email require human review. Arbitrary code execution and reading secrets are not allowed.
Google · Cloudflare · IPinfo · Resend · Brevo. You may exercise applicable access, correction, erasure and other rights using the contact above and lodge a complaint with the relevant supervisory authority, including the AEPD.
DiffAtOnce Legacy Online: account and projects
Updated: 2 October 2026. The online laboratory uses the existing DiffAtOnce platform. Access management stores email, alias, language, a password hash, verification and approval status, and activity dates. Sessions use a necessary authentication cookie. Researcher accounts do not grant administration access.
Scientific files are read and processed in the browser. They are not automatically transmitted or used for analytics. Choosing Save to my account transfers processed spectra, parameters, decisions and project results to private server storage. Original Bruker files remain on your device. Initial limits are 5 MiB per project, 20 projects and 50 MiB per account. You can download a local copy and delete saved projects. Project data remain until you delete them or request erasure through the privacy contact.
The administrator manages verification, approval, suspension and global pauses; decisions are recorded in platform audit logs. Pausing does not delete projects. Verification and recovery messages use the email transport configured by DiffAtOnce; links are temporary and single-use. If email is unavailable, contact support. Audit logs are retained for 180 days; verification links expire after 24 hours and recovery links after one hour.
The controller, contact and providers listed in this notice apply. To delete an account or exercise other rights, contact fmarrabal@ual.es.
