Act 18.331 · URCDP

Legal

Bitácora.btc is a community logbook run from Colonia del Sacramento, Uruguay. It is not an exchange, it does not custody funds and it does not open accounts. The law that orders this text is Uruguay’s Act 18.331 on Personal Data Protection and Habeas Data, regulated by Decree 414/009, under the URCDP. Brazil and Argentina are in the annex. This notice meets the information duty in art. 13 of Act 18.331. It describes what the site does today. It is not a certificate of compliance or legal advice.

Version 2.18

Earlier versions: 2.0, 2.2 and 2.4.

Legal notice · controller

The site’s brand is Bitácora.btc. The controller is a natural person, domiciled in Colonia del Sacramento, Department of Colonia, Oriental Republic of Uruguay, under the Consciencia Bitcoin by LATAM Cripto Mom initiative. The civil identity is on this page; the address for legal notices will be added once it is set up. The URCDP filing is still in progress. Anyone exercising their rights writes to privacidad@bitacorabtc.org, with no captcha, after proving their own identity.

No Data Protection Officer is appointed: it is not required (Act 19.670 art. 40 and Decree 64/020) because we are not a public body, we do not process sensitive data as a core activity and we do not operate at large scale. There is no EU representative (GDPR art. 27). The service is offered from Uruguay to the Latin-American bitcoiner community; if it is later aimed at the EEA market, a representative will be designated.

Notices and rights requests go to privacidad@bitacorabtc.org, with no captcha. There is no user registration, no authentication, no custody of funds and no wallet linking. Bitácora.btc is not a virtual-asset service provider (Act 20.345; Act 20.446, art. 693; Central Bank Circular No. 2507, art. 127.22).

You can also exercise your rights with no captcha, free of charge, within 5 business days, by writing to privacidad@bitacorabtc.org. Controller: Pablo Daniel Perez Correa (Colonia del Sacramento, Colonia, Uruguay). The address for legal notices will be published on this page once it is set up. Until then, notices and personal-data requests are received at privacidad@bitacorabtc.org. Exercise my rights

Terms of use

These rules are the terms of use.

1. Acceptance

Reading or browsing the site is not acceptance of these rules. You accept them in the checkbox, when you publish a listing, an announcement or an experience, or when you send the Contact form.

2. What it is not

Bitácora.btc does not custody, intermediate or hold keys. It does not, on a habitual and professional basis, exchange, transfer or custody virtual assets, and it does not take part in an issuer’s offering (Central Bank Circular No. 2507, art. 127.22). Act 20.345 and art. 693 of Act 20.446 include those providers among the entities the Central Bank supervises (Act 16.696, art. 37, letter H).

3. Third-party content

Map and announcement content is published by third parties. The controller may take it down if it is unlawful, misleading or breaches these rules.

4. Loading a shop

Whoever loads or edits a shop states that the data is accurate and is responsible for keeping it up to date.

5. Verification

The check does not change: the CARGA code is published on a public link and the map updates only when that proof is confirmed.

6. Contributions and maps

Directory contributions of our own are published under CC BY 4.0: they may be copied with attribution to Bitácora.btc. OSM and BTC Map geographic data remain under ODbL (© OpenStreetMap contributors). The program stays AGPL-3.0. The licence of a card built from that data is not stated here.

7. Market

The Market module is educational information: it is not financial advice or an investment recommendation.

8. Verified star

The verified star means two public links, a high average with votes, or the founding allowlist. It is not a BCU seal or a commercial warranty.

9. Law and courts

Governing law: Oriental Republic of Uruguay. Jurisdiction: Uruguayan courts. Privacy: this page, Privacy anchor.

10. Experiences

Whoever publishes an experience states that the activity, city, date or recurrent character, the price in sats or the deal, and the proof link are accurate. That becomes public under CC BY 4.0, with attribution to Bitácora.btc. The edit code is not published and is deleted after 30 days.

11. Announcements

Whoever publishes an announcement states that the text and the link are accurate. The announcement stays on the board for 7 days. The CARGA code is not published and is deleted after 30 days.

12. Disputes

A listing dispute is sent through the Contact form, with a ticket. This page states no separate dispute deadline. If the request is for access, rectification or erasure, the deadline is 5 business days (arts. 14 and 15 of Act 18.331).

13. Removal

Whoever published a listing, an announcement or an experience may ask for removal through the same form. Removal covers our copies. What is already on GitHub or on a public network is not fully erased.

14. Changes

These rules may change. The text published on this page is the one in force.

Annex · Brazil, Argentina and Europe

If you are in Brazil, Lei n.º 13.709/2018 (LGPD) may also apply. If you are in Argentina, Act 25.326. If you are in the European Economic Area, the GDPR (EU 2016/679) and the ePrivacy Directive, where they apply. The regime that orders this text remains the Uruguayan one (Act 18.331). There is no representative in the European Union and no separate processor in Brazil or Argentina: the controller remains in Colonia del Sacramento.

What data we process and why

We apply data minimisation (arts. 7 and 8 of Act 18.331): only what is needed for each purpose, accurate and not excessive. We do not score people, sell data or run behavioural ads.

We do not collect passwords, identity documents, biometrics, financial history or crypto keys. The public directory does not include private email or phone numbers: only socials or identifiers you publish.

Art. 2 of Act 18.331 also covers legal persons where it applies. Shop listings and votes are third-party data with reputational effect: the business may request rectification at privacidad@bitacorabtc.org.

Art. 13 information. The controller is a natural person in Colonia del Sacramento, Uruguay; the civil name is on this page; the address for notices will be added once it is set up. The purposes are to reply to contact, publish the directory and experiences, and limit abuse. Recipients are in the third-party section. On Contact, name, email and message are required: without them there is no reply. On the map, the name is required to publish. You may request access, rectification, update, inclusion and erasure, free of charge, within 5 business days, at privacidad@bitacorabtc.org. Retention: contact, 12 months; announcement, 7 days; CARGA code, 30 days; listing and experience, while they exist; the experience edit code, 30 days.

Interaction	Data	Legal basis (Act 18.331)	Retention
Contact	Name, email, topic and message	Free, prior, express and informed consent (art. 9), recorded by the form checkbox	Up to 12 months, unless a claim or legal duty requires more
Map / listings	Place name, description, address, hours, socials, logo URL, coordinates, votes	Consent to publish an open directory (art. 9). What you upload is public	While the listing exists. GitHub history may persist
Community announcements	Name, text, proof URL and socials, CARGA code	Consent to publish, weekly TTL	7 days on the board. The CARGA code is kept 30 days and is not in the public CSV
Experiences	Activity, city, date or “recurrent”, price in sats or “deal”, proof URL	Consent to publish (art. 9). The edit code is not published	While it exists. The edit code is deleted after 30 days
GPS location	Device coordinates	Browser permission. It does not run on its own	Not stored on the server; it only centres the map in your session
City by IP	Approximate city (GeoJS)	Consent: device extras or the locate button	Not persisted. On abuse, a truncated HMAC-SHA256 of the IP is stored: pseudonymised data, not the IP in the clear
Security	Truncated HMAC-SHA256 of the IP (pseudonymised), captcha ticket, send limits	Necessary to run the service and mitigate spam or attacks (not telemetry or analytics)	Rate-limit window: 2 hours. Captcha expires. That digest's key was rotated on 14 October 2026; the previous key is not kept
This device	Language; if you accept, nick and map cache	Language: necessary to render the site. The rest, banner consent (ePrivacy)	Until you clear site data or choose “Necessary only”

Transfers, processors and immutability

Processing runs on a contracted server (Njalla VPS) and in your browser. Processors and recipients sit outside Uruguay and, in some cases, outside the EEA. The list, with name and country, is below.

GitHub (US) hosts the public map and announcement CSV, without CARGA codes or emails. FormSubmit forwards the Contact form to Gmail. Nominatim/OpenStreetMap resolves addresses. GeoJS estimates the city if you allow it. Market and event APIs feed the desk. The Contact checkbox that names FormSubmit records consent to that transfer to the United States (Act 18.331, art. 23, subsection 2, letter A). The checkbox on publish records the GitHub one. The other requests do not use that checkbox.

What you publish on the map, on GitHub or on a public network (Nostr, Lightning, chain) cannot be fully erased. Erasure applies to our copies; open history and public networks are beyond absolute oblivion. That is stated before you publish.

The site runs on an Njalla VPS. Data-center country: Finland.

Your browser contacts these directly

OpenFreeMap · Hungary · tiles.openfreemap.org. Map tiles. Also listed in font-src.
BTC Map · country not reported by the provider · static.btcmap.org, *.btcmap.org, api.btcmap.org. Icons, listings and API of the federated directory.
OpenTopoMap · Germany · *.tile.opentopomap.org. Relief tiles.
OpenStreetMap France · France · *.tile.openstreetmap.fr. Street tiles.
Luma · United States · images.lumacdn.com, *.lumacdn.com. Event images.
Meetup · United States · *.meetupstatic.com. Event images.
Eventbrite · United States · img.evbuc.com, cdn.evbuc.com. Event images.
Unsplash · Canada · images.unsplash.com. Supporting images.
GeoJS · country not reported by the provider · get.geojs.io. Approximate city, only if you ask.
Nominatim (OpenStreetMap Foundation) · United Kingdom · nominatim.openstreetmap.org. Addresses from the pin.
FormSubmit · United States · formsubmit.co. Forwards the Contact form to Gmail. The browser also sends it your IP.

These receive what you publish or what you write to us

GitHub · United States · github.com. Public CSV of the map and announcements. No CARGA codes or emails.
Google (Gmail) · United States · mail.google.com. Inbox where Contact ends up. The browser does not call it.

Our server asks these (they do not get your data)

Google Translate · United States · translate.googleapis.com. Translates headlines. It receives the text, not your IP.
MyMemory · Italy · api.mymemory.translated.net. Fallback for headline translation.
Lingva · country not reported by the provider · lingva.ml. Another fallback for headline translation.
Njalla · Finland. Server that runs the site.
Cotizaciones · several. Binance, OKX, Coinbase, Bybit, Bitget, Gate, KuCoin, HTX, MEXC, Kraken, BingX, Hyperliquid and Yahoo Finance. They see the server IP, not yours.
Datos on-chain · several · mempool.space, blockstream.info, blockchain.info. Fees and block height. They see the server IP, not yours.

Rights

You may exercise access, rectification, update, inclusion and erasure (arts. 14 and 15 of Act 18.331). You also have the right not to be subject to a decision with legal effects that significantly affects you, based on processing meant to evaluate aspects of your personality, and to challenge that valuation (art. 16). We do not make that valuation and we do not score people, and, where the GDPR applies, you may also exercise restriction, portability and objection.

Requests are made by writing to privacidad@bitacorabtc.org, with no captcha, and with proof of identity. The Uruguayan deadline is 5 business days (arts. 14 and 15). You may complain to the URCDP (Uruguay) and, in the EU, to the supervisory authority under GDPR art. 77.

Registration of the contact and security databases with the URCDP has been requested. The URCDP has not yet assigned a procedure number. The number will be published on this page when it exists.

If a security breach affects personal data, it is contained within 24 hours and reported to the URCDP within 72 hours. After it is closed, if the impact is significant, the people affected are told.

Storage on the device (cookies)

We do not use analytics, advertising or third-party social cookies. There is no gtag, pixel or marketing CMP.

Language is not stored in the browser: it stays in the page address. This device’s notice stores the choice and, only if you accept the cache, the nick and the map cache. The table lists each key. That is terminal storage (ePrivacy art. 5.3). The banner lets you choose “Necessary only” or accept the cache. Fonts are served from this site (not Google Fonts). City-by-IP is not requested until you accept extras or use the locate button.

To withdraw consent: “Necessary only” on the notice, or clear this site’s data in the browser.

Key	Where	What for
bitacora-storage	localStorage	The notice choice: necessary only, or cache.
bitacora-nick	localStorage	Nick, only if the cache is accepted.
bitacora-map-csv-v1	localStorage	Map cache, only if accepted.
bitacora-places-v1	localStorage	Shop cache, only if accepted.
bitacora-communities-v1	localStorage	Community cache, only if accepted.
bitacora-map-pending	localStorage and sessionStorage	A listing left half-finished, this visit.
bitacora-pin-pending	localStorage and sessionStorage	An announcement left half-finished, this visit.
bitacora-xp-pending	sessionStorage	An experience left half-finished, this tab.
bitacora-storage-seen	sessionStorage	The notice was already shown in this tab.
bitacora-join	sessionStorage	The join button was already used in this tab.
bitacora-chunk-reload	sessionStorage	One retry if part of the page failed to load.

Accessibility

Technological sovereignty includes using the site with a keyboard and a screen reader. Self-assessment dated 14 October 2026: code and keyboard review. This is not an external audit or a WCAG 2.2 AA or Directive (EU) 2019/882 certificate.

Today: skip link to main (first tab stop, including LABIF), language control with aria, landmarks, a focus ring when tabbing, the storage bar as a region (not a modal), QR alt text, labelled nav, a text list of places under the map, prefers-reduced-motion on the globe (no auto-rotate) and map flights, and a captcha with audio plus a screen-reader announcement (the drawing is visual support).

Children

The site is not directed at children. Act 18.331 does not set a digital-consent age: the Code on Children and Adolescents and evolving capacity apply; as a rule a legal representative consents. For EEA visitors, GDPR art. 8’s age 16 also applies. We do not verify age. If an adult shows that we collected a child’s data, we erase it.

Source · license

Bitácora.btc’s program is published under the GNU Affero General Public License v3 (AGPL-3.0). The corresponding source code is what this site serves and the repository https://github.com/prezpablo/bitacora.btc. The full text is at /LICENSE. The short notice is at /COPYRIGHT. OSM and BTC Map data remain under ODbL.

Information on current processing. It is not legal advice or a statement of conformity.

Contact

Consciencia Bitcoin started in Colonia del Sacramento, Uruguay. Write to us, add your node, or contribute to the bitácora.

Consciencia Bitcoin · LATAM Cripto Mom

Colonia del Sacramento, Colonia, Uruguay

See on the map Add a community or shop

NameEmail *TopicMessage

Confirm you are not a bot

You do not need to type a code. Wait a second and tap Verify. You can listen to the code if you want. Captcha accessibility

If you cannot, email accesibilidad@bitacorabtc.org

I agree to the processing of my name, email and message so you can reply, under the Privacy.

Name, email and message are required; without them we cannot reply. They go through FormSubmit (United States) to Gmail and are kept for up to 12 months. Exercising your rights is free, needs no captcha, and the deadline is 5 business days. Email: Controller: Pablo Daniel Perez Correa (Colonia del Sacramento, Colonia, Uruguay). The address for legal notices will be published on this page once it is set up. Until then, notices and personal-data requests are received at privacidad@bitacorabtc.org. privacidad@bitacorabtc.org.

I agree that my name, email and message are transferred to FormSubmit (United States) to be forwarded to the controller’s inbox, under the Privacy.

Send me a copy at this email.

Lightning / on-chain

Contribute to Bitácora.btc

Donate opens the code and the gift notice.

bc1q e2f3 fu7n wqnl 00an kn2g 22r8 zv2f rs4c kkk8 3t

bitcoin:

Bitácora does not take custody or intermediate (Act 20.345, Act 20.446 art. 693 and BCU Circular 2507: not a VASP). Compare the first and last characters with this text before sending.