Draft. This text must be completed with the owner's details and reviewed by a legal professional before the site is published.
This policy explains which personal data helloAptisUP processes, why, and what rights you have, under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018. The Spanish version of this text prevails.
1. Data controller
- Controller: [pending: owner's name]
- Tax ID (NIF): [pending: tax ID]
- Address: [pending: address]
- Privacy contact: [pending: contact e-mail]
2. Data we process
- Account data: name, e-mail address and password. The password is stored hashed; nobody can read it, including us.
- Profile data: target level, interface language and, when you provide them, exam date and study availability.
- Study data: lessons and exercises done, answers, scores, mock test results, Writing texts and Speaking voice recordings.
- Subscription and payment data: plan, status and dates. Card details are handled directly by the payment provider; helloAptisUP neither receives nor stores them.
- Technical data: IP address, date and time of access, and security logs.
The free level test can be taken without an account. Its answers are marked on the spot and are not stored.
3. Purposes and legal bases
- Creating and managing your account and providing the academy service: performance of the contract (Art. 6(1)(b) GDPR).
- Generating your study programme, marking activities and showing your progress: performance of the contract.
- Managing subscriptions, payments and invoicing: performance of the contract and compliance with legal obligations (Art. 6(1)(c) GDPR).
- Protecting the service against misuse and fraud: legitimate interest (Art. 6(1)(f) GDPR).
- Producing aggregate statistics on how the academy is used, in order to improve it: legitimate interest. These statistics do not identify individuals.
We do not send marketing communications without your consent, we do not build advertising profiles and we do not take automated decisions with legal effects about you. Automatic marking is for learning purposes only.
4. Who has access to your data
We do not sell or share your data. It is only accessed by the providers we need to run the service, acting as data processors:
- Supabase: database, authentication and file storage. Data region: [pending: data hosting region].
- Hosting of the web application: [pending: web hosting provider].
- Stripe: payment processing, once paid plans are available.
- A transactional e-mail provider, for account confirmation and recovery messages.
If any of these providers processes data outside the European Economic Area, it will do so under the safeguards set out in the GDPR, such as the European Commission's standard contractual clauses.
The administrator of the academy can view account data in order to give support and manage the service. Other students cannot see your data.
5. How long we keep it
- Account and study data: while your account is active. Deleting the account erases them, recordings included.
- Invoicing data: for the periods required by tax and commercial law.
- Security logs: for as long as needed to investigate incidents.
6. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to [pending: contact e-mail] and stating which right you wish to exercise. We will reply within one month.
You can change your personal details at any time from your account.
If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).
7. Minors
The service is intended for people aged 14 or over. Younger users need the consent of their parents or guardians to register.
8. Security
We apply technical and organisational measures to protect your data: encrypted connections, per-user access control in the database, hashed passwords and a log of administrative actions.
9. Changes to this policy
If we make significant changes to this policy, we will say so on the site and update the date at the top.